![\"\"](\"http:\/\/ekiwi-blog.de\/wp-content\/uploads\/2023\/03\/virus_1.png\")
<\/p>\nEncryption Trojans are still a big problem, a field report.<\/p>\n
<\/p>\n
Somewhat desperately, a customer called me this week, all the files on his computer have been given a new file extension. The files now have a .craa extension and can no longer be opened after testing software from the internet.<\/p>\n
It quickly became clear to me that an encryption Trojan was probably the cause, which a quick Google search also confirmed. The Djvu ransomware, which has been doing its thing for many years, is behind this. As soon as you have kicked the thing in, the software starts to encrypt the data in the background.<\/p>\n
Documents, text files, pictures and videos are affected.<\/p>\n
<\/p>\n
In addition, the Trojan drops a “readme” file, which informs the victim accordingly and demands the money.<\/p>\n
![\"\"](\"http:\/\/ekiwi-blog.de\/wp-content\/uploads\/2023\/03\/virus_2.png\")
<\/p>\n
In terms of price, the variant is aimed at private users. The price is just under 1000 dollars and there is a discount for the first 72 hours. One file can be decrypted free of charge as proof that the crooks do indeed have the key.<\/p>\n
We have not tested whether this works in practice. In any case, it is not a good idea to throw money at the fraudsters, so this should only be considered in exceptional cases. It is better to have a backup or a backup strategy. More on this later.<\/p>\n