FORMA Ransomware

FORMA Ransomware is a dangerous program that was released a few months ago. This ransomware infection seems to be targeting computer users in Poland, but there is no telling where else it might go. Ransomware infections are really frustrating computer security threats because it is often hard to revert the damage they cause. Even so, users should remove FORMA Ransomware and other similar infections immediately because no one should tolerate these threats. You might also want to find out more about file recovery options because this program clearly encrypts personal files, and you need to get your data back.

Like most of the ransomware infections, FORMA Ransomware is thought to spread via spam email attachments. This is a very old malware distribution method that still works just fine today. What’s even more frustrating is that users download and install FORMA Ransomware themselves. They think that they download PDF or MS Word documents that carry important information. But in reality, they are only tricked into thinking that these documents are real, because the messages that they come with often look legitimate. And these messages also come with a sense of urgency, trying to force users to take action. Eventually, FORMA Ransomware and other similar infections manage to enter target systems because users are too hasty.

If you are about to open an unfamiliar file and you are not sure whether the file is safe or not, there is always the option of scanning that file with a security tool. In fact, that should be your new habit. Do not hesitate to scan anything remotely suspicious.

We always talk about these programs as though they infect individual desktops, but the reality is that, more often than not, ransomware apps target businesses. Smaller companies can be especially vulnerable to a ransomware infection because they are less likely to invest in their cybersecurity. As a result, they might not have a system or a data backup, and paying the ransom could be the only way to retrieve their important data. So what can businesses do to avoid the likes of FORMA Ransomware?

It is necessary to educate their employees about the importance of cybersecurity. Also, opening attached files from emails shouldn’t be a robotic action. Everyone should take every single message seriously. Just because an email doesn’t get filtered into the Junk folder, it doesn’t mean it is 100% reliable. If you didn’t expect to receive some message and if the message says it’s urgent, that’s the first sign that things could go very wrong.

However, if FORMA Ransomware somehow entered your computer system, the ransomware program will launch a full system scan because it needs to locate the files it can encrypt. Then it will encrypt all the picture and document format files. From this, it is easy to see that most of your personal files will end up being locked once the encryption is complete. You will also be able to tell, which files were encrypted because the ransomware adds ‘.locked’ to all the affected file names.

Aside from encrypting your files, this program also displays a ransom note that is entirely in Polish. However, it doesn’t take a genius to understand what this program wants from you. It says that your files were encrypted with a powerful encryption algorithm, and that you have 48 hours to pay the ransom fee. The program doesn’t indicate the ransom fee itself, it only says that you have to contact these cybercriminals via the given email address. Would they actually issue the decryption key if you contacted them? It’s hard to say. The program might be too old for that already.

Nevertheless, the point is that you should never contact these criminals. Simply remove FORMA Ransomware following the instructions below and then restore your files from a system backup (provided you have one). You might also have most of your latest files saved on your mobile device or in a cloud drive. The point is that there is always a way to restore at least part of the encrypted files, so you should not panic. If all else fails, you can also address a professional who would be willing to help you sort this issue out.

How to Delete FORMA Ransomware

1. Press Win+R and the Run prompt will open.
2. Type %TEMP% into the Open box and click OK.
3. Remove the following files from the directory:
   invisible.vbs
   FORMA.exe
   AdobeAcrobatReader.exe
   admin.exe
   1.bat
   2.bat
   3.bat
   4.bat
4. Access these directories with the Win+R command and remove the syswin32.lnk file (location depends on your operating system):
   %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
   %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   %ALLUSERSPROFILE%\Start Menu\Programs\Startup
   %APPDATA%\Microsoft\Windows\Start Menu\Startup
   %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
5. Scan your system with SpyHunter.