Math Ransomware

Math Ransomware is a dangerous computer infection that mainly targets users in Italy. Although ransomware programs often lead to the point of no return, the good news is that there is a public decryption tool for this infection, and you don’t need to pay the ransom fee. Of course, no one should ever pay the fee eve if there was no public decryption tool available. But let us just emphasize that you can get your files back, and the thing you need to focus on right now is removing Math Ransomware from your system.

How do we know that Math Ransomware targets Italians? Well, the entire interface of this infection is in Italian. So, it is pretty obvious that the program is highly localized. Nevertheless, we can assume that it employs the same distribution methods as other infections from the Jigsaw Ransomware family. In other words, this infection is not a stand-alone program that comes out of nowhere. It is basically identical to Jigsaw Ransomware, and that is why the public decryption tool works on it in the first place. It is not that common for the public decryption tool to work on several infections in the same family, but we’re lucky enough with Math Ransomware.

Although it is possible to restore all the affected files, we should still learn more about ransomware distribution, so that we could avoid similar intruders in the future. So, as far as we know, Math Ransomware usually comes in spam email attachments. There might be other channels for ransomware distribution as well, but just bear in mind that you need to look out for files you receive from unfamiliar senders. The installer file for this infection looks like a PDF file. Hence, if you deal with such files every single day, you need to make sure that the source is reliable.

As a matter of fact, if you want to protect your computer from various threats, you can always scan the received files with a security tool before opening them. It applies to all the files you download, not just the ones you receive from unknown people.

However, if Math Ransomware manages to reach the target system, what does it do? Well, it behaves like your regular ransomware infection. It runs a full system scan and then encrypts all the personal files. You will see the files that were affected by the encryption at once because they will have the ‘.math’ extension added to their filenames. To notify the user, Math Ransomware displays several messages. Please note that all messages we talk about here are translated from Italian.

Once the program is executed, it opens a message that says “Invalid extension, the file is corrupted.” Then, when the encryption is complete, Math Ransomware displays a ransom note that says the following:

Good morning, I want to play a game with you, let me explain
Your files are about to be deleted, photos, videos, documents, etc…
But don’t worry, it will only happen if the payment is not successful

It goes on to say that the files will be deleted if the user fails to transfer the ransom. However, the note itself is very obscure about how you’re supposed to transfer the money. Either way, since there is a public decryption tool, you don’t need to worry about the ransom. However, please note that you should remove Math Ransomware as soon as possible, so that it wouldn’t do anything bad with your files.

In fact, if you have a file backup, you don’t need to worry about anything. You can even skip downloading the public decryption tool. Just terminate the infection, delete the encrypted files, and then transfer the healthy copies into your system.

We do understand that only few users can afford doing that. However, keeping a file backup should be one of your top priorities. It’s just as important as preventing the likes of Math Ransomware from entering your system.

After malware removal, you should run a full system scan because there might be more unwanted or dangerous files present. It is also strongly recommended to invest in a powerful antispyware tool that should help you protect your system from various intruders in the future.

How to Remove Math Ransomware

1. Press Win+R and type regedit. Click OK.
2. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
3. On the right side, right-click and delete the firefox.exe value.
4. Press Win+R and type %LOCALAPPDATA%. Click OK.
5. Delete the Drpbx folder and press Win+R again.
6. Type %APPDATA% into the Open box. Click OK.
7. Delete the Frfox folder, System32, Address.txt, dr, and EnctryptedFileList.txt.
8. Run a full system scan with SpyHunter.