Remove Drume Virus Ransomware (+File Recovery)

How to Remove Drume Ransomware?

Drume is a cyber threat, part of the ransomware family. It gets its name from the extension, you get slapped with, once it strikes. Ransomware tools invade your system, and take over. They use algorithms to encrypt your data and, then, extort you. After they seize control of your files, you find a ransom note. It lists their demands, and the ransom amount. No matter what you find in that note, ignore it. Complying with their requests is futile. Though, they promise compliance solves your problems, it doesn’t. Think about it. The note may claim that, if you pay, they’ll send you the decryption key, you need. But that’s all you get. A claim, a promise. And, promises can get broken. What if these people don’t keep their word? And, don’t forget, they’re cyber criminals, who kidnapped your data. Then, extorted you for monetary gain. These are hardly trustworthy individuals. So, why would you rely on them to fulfill their promises? You have zero guarantees that doing what they ask, results in decrypting your files. What if you pay, but they send you nothing? Or, send a key that proves useless? And, even if you get the proper one, what then? You paid them to remove a symptom of an infection. Not the infection itself. There’s no point in engaging with these people, at all. Don’t write to them. Don’t contact them in any way. And, above all, don’t pay them.

How did I get infected with?

The Drume tool slithered into your system via deception. It turns to slyness and subtlety, and not only invades, but does it undetected. Yes, it manages to slip by you, unnoticed. How? Well, it preys on your carelessness. Yes, it resorts to the old but gold invasive methods. And, relies on you to give into gullibility, haste, and distraction. Your carelessness eases its infiltration. The infection turns to all manner of trickery, in its attempt to slip past you. Ultimately, it’s up to you whether it succeeds. You’re the last line of defense. If you’re thorough, you can spot the tool, trying to invade. Vigilance helps you to prevent infections from infiltrating your PC. Carelessness does not. It has the opposite outcome. Do your best to be thorough. Always take the time to do your due diligence. Even a little extra attention can save you a ton of troubles. The usual antics, the tool turns to, include the following. Hiding behind freeware, fake updates, corrupted links, and spam emails. If, say, you receive a shady email that claims to come from a legitimate source. And, urges you to click a link, or download an attachment. Don’t obey, in blind faith. Take a second look! Look for the fine print. Double-check everything. Caution helps to keep an infection-free PC. Remember that.

Why is Drume dangerous?

As soon as the ransomware invades, it strikes. Its programming kicks in, and it locks your files. Every single file gets encrypted, using cryptography algorithms. Documents, pictures, videos, music, archives. You find it all under lock-down. The infection appends the ‘.drume’ extension, at the end of each file. Say, you have a music file called ‘mix.mp3.‘ Once the tool finished with it, it becomes ‘mix.mp3.drume.’ And, after that, you can no longer access it. Your data becomes unusable. The only way to change that is via unique decryption key. But, to get it, you have to pay up. Once the ransomware takes your files hostage, it leaves you a ransom note. You can find it on your Desktop, as well as in reach folder with locked data. The ransom amount varies, but it’s usually between 500 and 1000 US Dollars. And, you’re expected to pay it in Bitcoin. The note urges you to pay the cyber extortionists. Don’t. Payment guarantees nothing. Well, nothing besides a loss of money. Don’t waste your money, time, and energy, dealing with these people. Don’t follow their demands. Don’t comply.

Drume Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Drume Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Drume encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Drume encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.