Divine Ransomware

When a program has the word “divine” in its name, you would expect the application to be good and useful. However, there is nothing useful about Divine Ransomware, unless of course, you are its developer. This malicious program has been created with the sole purpose of reaping financial profit for its developers at the expense of innocent computer users. What’s more, it is very annoying to fight it because you do not even need to remove Divine Ransomware: this program deletes itself after its job is done. And you are left to deal with the consequences.

Judging from what we have gathered during our research, Divine Ransomware happens to be one of the many versions of the Everbe 2.0 Ransomware infection. On its own, Everbe 2.0 Ransomware is also a new version of Everbe Ransomware. These programs use the RSA-2048 encryption algorithm, which is one of the strongest encryption algorithms out there, and if you fall victim to it, the chances are that there’s no other way to decrypt your files unless you have the decryption key.

The decryption key is usually in the possession of the cyber criminals who have created these malicious programs. They make it sure that there is no way to restore your files because upon the installation, all programs from the Everbe family delete the Shadow volume copies. If the Shadow volume copies are enabled, it is usually possible to restore delete files (although that requires some in depth computer knowledge). Divine Ransomware, on the other hand, makes sure that you would not have such a possibility. So the only way to restore your files is to seek copies of your data that could be saved on an external hard drive, some cloud storage, your mobile device, or your inbox.

Such an infection can be quite devastating for small businesses because small businesses are less likely to have a backup of their files. What’s more, it is very common that ransomware programs target small companies. Small companies may be more likely to pay the ransom fee as they could be desperate in their attempts to retrieve their files. Does Divine Ransomware issue the decryption key though? That is very hard to tell. Normally, the chances are that the developers simply scram with the ransom money without even bothering to give their victims a second glance.

Another likely outcome is the server downtime. What we mean is that the server that hosts the email that you have to contact might have a very shaky connection, so it could go down even before you reach out to these criminals. And even if you do manage to contact them, paying the ransom isn’t an option. Sure, if you’re a small business you might not have another choice, but let’s think about it: By paying the ransom fee you would only encourage these criminals to continue their practice. As a result, more systems would be infected with Divine Ransomware and other programs just like it.

Since this ransomware program deletes itself after the execution, there is nothing much to tell about its removal. However, we would like to point out that you should not panic if you get infected. You will know immediately if Divine Ransomware really enters your computer because once the encryption is complete, this program will drop this ransom note:

Hello! All your files have been encrypted!

Don’t worry, we can help you to return all of your files.

If you want to know price for decryptor, write to our email – divine@cock.lu

The message goes on to say that if you wait for seven days, the price for the decryption tool will double. Also, if you do not receive an answer from these criminals within 24 hours, you should use a backup email to contact them. Which, by the way, only proves that their server connection is really shaky.

Since there is no program to remove, you might as well want to scan your computer with a reliable antispyware program to look for other potential threats. If you have no other choice but to delete the encrypted files, make sure that you transfer healthy copies into your hard drive only when your system is absolutely clean.

How to Remove Potential Threats

1. Delete unfamiliar files from your Desktop.
2. Open the Downloads folder.
3. Remove the most recently downloaded files.
4. Scan your computer with SpyHunter.