Do you know what Shrug2 Ransomware is?
Shrug2 Ransomware is a new version of a threat known by a similar name (Shrug Ransomware). According to our computer security specialists, the recent release has a different appearance, adds a bit different extension to encrypted files, and targets more data than the previous variant. For users who came across it, we would recommend reading the rest of this report if they wish to understand what they have encountered. Further, in the article, we will provide with the most important detail about the malware, for example, its possible distribution channels, working manner, etc. Another thing we would like to stress is we advise deleting Shrug2 Ransomware instead of putting up with any demands mentioned on the malicious application’s ransom note. The reason is we do not think these people can be trusted and there are no reassurances they will hold on to their words. If you suspect paying the ransom might not end well too, we encourage you to follow the removal guide available below instead of paying it.
For starters, we should explain how one might end up receiving Shrug2 Ransomware. Our computer security specialists believe the new version should be spread same as the previous variant, which means the threat could be traveling with malicious Spam emails, harmful software installers, unsecured RDP connections, and so on. In other words, if the malware enters the system, it could be because of the user’s careless browsing habits or the computer’s vulnerabilities. Either way, we recommend updating all outdated software and replacing old passwords with stronger ones. Another thing users should do if they do not want to receive malicious application alike in the future is stay away from email attachments if they have no idea who sent them or why they were sent. Besides, it would be smart to keep away from unreliable file-sharing web pages to avoid downloading installers bundled with infections or fake setup files.
Shrug2 Ransomware screenshot
Scroll down for full removal instructions
As soon as, Shrug2 Ransomware infects the computer, the malware should start encrypting various personal user’s files located in the C: disk. Apparently, the list of targeted file types is more significant in the new version, meaning it should damage more files. It may mark its encrypted data with .SHRUG2 extension, for example, picture.png.SHRUG2. Later on, the malicious application is supposed to create a file called @ShrugDecryptor@.lnk. Launching it should open the main threat’s window, which is supposed to show the victim a ransom note. The note claims the user has three days to pay the ransom or else his files will be not only encrypted but also deleted. Doing so is inadvisable if you have a backup or simply do not wish to risk losing your money. The chances of you getting scammed are quite realistic as there is not knowing how the hackers will choose to do. If you do not want to gamble with your savings we recommend not to pay any attention to the ransom note and eliminate Shrug2 Ransomware at once. The removal guide below will tell you how to erase it manually and for users who wish to use automatic features we would suggest installing a reliable antimalware tool instead.
Erase Shrug2 Ransomware
- Press Ctrl+Alt+Delete.
- Go to the Task Manager.
- Find the malware’s process.
- Mark this process and click End Task.
- Exit Task Manager.
- Tap Win+E.
- Navigate to:
%TEMP%
%USERPROFILE%\desktop
%USERPROFILE%\downloads - Locate an executable file launched before the computer got infected.
- Right-click the malicious file and press Delete.
- Then check your Desktop again.
- Look for @ShrugDecryptor@.lnk, right-click it and select Delete.
- Close File Explorer.
- Press Windows Key+R.
- Navigate to HKEY_CURRENT_USER
- Look for a key titled ShrugTwo, right-click it and choose Delete.
- Right-click this key and select Delete.
- Close Registry Editor.
- Empty Recycle bin.
- Reboot the system.
In non-techie terms:
Shrug2 Ransomware is another malicious application that could infect your system if you open suspicious email attachments, visit potentially harmful web pages, or if the system has vulnerabilities the threat might be able to exploit. In case, the malware can enter it should encrypt most of the user’s files making them unusable. As you see once encrypted, the data cannot be opened as the system might be unable to recognize it. To restore them the user needs a decryption key and a decryptor, but sadly, if anyone has these means, it would be the threat’s developers. In exchange, the cybercriminals should demand the user pays a ransom in given time. Needless to say, no matter what they promise there are no guarantees they mean to do so, and you could easily be tricked. Thus, we advise users not to pay the ransom if they do not want to risk their money. We believe it would be safer to get rid of the infection and then recover the files you can from backup. To eliminate it manually users could complete the removal guide available a bit above. However, should the task look too complicated users should not hesitate to employ reputable antimalware tools instead.