Remove Onion File Virus (Dharma Ransomware)

How to Remove Onion Ransomware?

The Dharma Ransomware has been harassing PC users since 2016. According to some researchers, it’s very similar to the CrySis Ransomware – another file-encrypting virus. And, as per usual, hackers didn’t give up on this parasite. We’ve witnessed numerous variants of Dharma and today’s article is all about its latest version. This particular infection adds the .onion extension to the target files. Yes, onion. It seems crooks could draw inspiration from basically anything. Even though the .onion extension doesn’t sound too intimidating, you’re in for trouble. Dharma Ransomware has proved itself to be destructive. Its brand new version is just as dangerous and problematic as the original. Immediately after installation, the virus scans your computer. This is just the beginning of this parasite’s aggravating tricks. You see, by scanning your device, Dharma Ransomware finds your personal files. All your personal files. That includes photos and music and videos and MS Office documents. Long story short, ransomware goes after all your data. It’s searching for private information to encrypt and it eventually finds your files. The problem is, once the scan is complete, your data gets renamed. Ransomware modifies the format of your personal files and adds a specific extension to them. In this case, the bizarre .onion extension. Seeing such a random appendix added to your files is rather nerve-wracking. What is much more nerve-wracking is finding out that you cannot open your data. The virus uses a complicated encrypting algorithm and locks your files. That whole thing happens behind your back. Apart from being harmful, ransomware is also secretive. It works in silence so when you do discover the parasite’s modifications, you’re caught off guard. Obviously, this is just another trick to get you to panic. Keep in mind that ransomware is a cyber attempt for a scam. It encrypts your private data in order to ask for money. You’ll notice an info.hta ransom note, for example. The virus drops its instructions in all folders that contain locked information. In other words, Dharma Ransomware makes sure its ransom messages don’t remain unnoticed. This program might also modify your default desktop wallpaper. All its ransom messages are trying to play mind games with you and, ultimately, steal your Bitcoins. To prevent getting scammed, tackle the virus as soon as possible. Don’t even consider paying the ransom.

How did I get infected with?

Unless you’ve agreed to install this program, Dharma Ransomware has relied on stealth. It is in hackers’ best interest to leave you oblivious to the installation. However, it is in YOUR best interest to be aware what lands on your machine. How do you prevent virus infiltration? For starters, stay away from random spam email-attachments and messages. Crooks often send malware straight to the victim’s inbox. Therefore, infections rely on your curiosity so you could compromise your own PC. One single click on the wrong email or message could cause you damage. Stay away from anything you receive in your inbox unless you know the sender. Note that all sorts of parasites travel the Web via fake emails or messages in social media. More often than not, malware gets disguised as job applications or emails from shipping companies. Keep an eye out for potential intruders and save yourself the headache. Ransomware also gets spread online with some help from Trojan horses. You should check out the computer for more parasites because you could have a Trojan on board too. Also, the Dharma Ransomware could have been attached to some unreliable freeware or shareware bundle. You might have installed a corrupted torrent as well. Infections have a rich variety of techniques to choose from. It’s up to you whether your device will remain virus-free.

Why is Onion dangerous?

The ransomware is lying shamelessly to your face. As mentioned, this infection creates detailed payment instructions. Dharma Ransomware also turns your files into unreadable, unusable gibberish. Do you keep important files on your PC? That’s what hackers are hoping for. We would strongly recommend that you keep backups of your valuable data. By doing so, you’ll successfully protect yourself from ransomware’s trickery. Remember that hackers have no intention whatsoever to free your files. Even if you pay the entire ransom ASAP, you won’t receive a decryptor. If anything, you will only lose your Bitcoins. That is why you have to stay away from the email addresses provided in the ransom notes (for instance, amagnus@india.com or bitcoin143@india.com). This parasite must be uninstalled on the spot. Please follow our detailed manual removal guide. You will find it down below.

Onion Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Onion Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Onion encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Onion encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.