Do you know what SYSDOWN Ransomware is?
SYSDOWN Ransomware is a malicious infection that will encrypt your files and will leave you no other choice, but to remove them all. This program is more of a wiper rather than your usual ransomware infection. It means that it does not intend to make money out of you; it could also be possible that program is used as a direct weapon to destroy certain systems. While it is not hard to remove SYSDOWN Ransomware from the infected system, the damage may not be reversible. Hence, you have to be ready to face the fact that you might have to start building your file library from scratch.
Normally, ransomware infection would enter target systems via spam email attachments. That is the most common ransomware distribution method, and users often get tricked into installing dangerous programs because the attached files they get through spam do not look dangerous. Knowing this, you should be ready to counter such spam attacks by deleting the unwanted and unfamiliar email messages without even opening them. This would surely decrease the possibility of getting infected with ransomware. However, SYSDOWN Ransomware is extremely dangerous because it does not employ spam emails to spread around (at least not yet).
It looks like the people behind this infection target particular users because, at the time of writing, the program is distributed via a chat service at Discord’s server via cdn.discordapp.com. This application provides a chat service, so it is very likely that the ransomware program gets distributed across the network, and those who use this service are bound to be exposed to this infection. According to our research team, someone might be deliberately trying to sabotage someone’s system, and this program could be a very good tool for that.
SYSDOWN Ransomware screenshot
Scroll down for full removal instructions
Technically, SYSDOWN Ransomware functions like any other ransomware out there. When it enters a target system, it scans it, looking for the files it can encrypt. This program uses the AES algorithm to encrypt target files. It also means that without the original decryption key it is almost virtually impossible to restore the affected files. Also, as far as we know, this program targets files in the %Userprofile% directory. This is the directory where most of the default file folders are located. So if you use the default folders provided by the system to store your data and SYSDOWN Ransomware enters your PC, you can be sure that most of your files will be lost for good.
It will be easy to see which files were affected by this encryption. Once the encryption is complete, SYSDOWN Ransomware adds the .SysDown extension to every single filename, and it also adds underscores, too. For example, a cat.jpg filename would look like cat_jpg.SysDown after the encryption. Needless to say, the system will no longer be able to read those files. Also, SYSDOWN Ransomware will display a small pop-up window that says “SYSDOWN Pwned by the SYSDOWN virus!” It will also show an ID that will be displayed in gibberish.
And here comes the tricky thing about this infection. It does not have a ransom note. Which means it does not intend to collect your money and it does not even pretend that it can issue a decryption key. Therefore, we can say that the program is a type of wiper that merely intends to cripple various systems. Furthermore, you have to understand that dealing with the infection consequences could be quite difficult, and you may have to give up on certain files for good.
It is a lot easier to deal with it if you have a backup drive. That is to say, if you store copies of your files in an external hard drive or perhaps on a cloud drive. Also, you may have a lot of your files saved on your mobile device or in your email outbox. Whichever it might be, there are often ways to retrieve some of the affected data, so there is no need to panic.
As far as SYSDOWN Ransomware is concerned, there might be no files left to delete because, in some cases, the infection deletes itself once the encryption is complete. Either way, you can still run a full system scan with a security tool to be sure. After all, there might be more potentially harmful programs on-board, too.
In non-techie terms:
SYSDOWN Ransomware is a wiper ransomware infection that encrypts target files and then disappears. It does not want anything from you; it only wants to destroy your data. Unfortunately, there is no way to decrypt the files at the moment because a public decryption tool is unavailable. You should focus on protecting your system from similar intruders in the future. Investing in a powerful antispyware tool is always a good idea, and you should also review your web browsing habits because that is also very important.