An infection with the dangerous ONI Ransomware leads to serious security issues. Victims can restore and protect their computers by following our complete removal guide.
Remove ONI Ransomware and Restore PC
Manual Removal Guide
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Distribution of ONI Ransomware
The Oni ransomware is currently targeted mainly against large Japanese organizations. Its operators utilize different attack scenarios to attempt the intrusion into the protected internal network. At the moment the exact details are not known and as such we presume that the most widely used strategies are being used.
It is very possible that the bulk of the infections may be caused by email messages. Depending on their type and the made customizations they can contain the Oni ransomware either directly attached, linked or via payload files. Advanced delivery methods can utilize a combination of all of them at once. Usually social engineering methods are employed which seek to increase the infection ratio to the maximum. The users are offered helpful-looking links, disclaimers and redirects which may affect them emotionally. Such strategies seek to impact the users by manipulating them with content that may pose as being sent by an official company or government institution.
The ONI ransomware at the moment is being delivered by payloads. They come under the form of office documents which include dangerous scripts (macros). The messages that have been analyzed come with archive(zip) attachments. When the targets open them up a notification prompt will ask them to enable the built-in macros. If this is done the Ammyy Admin Trojan is delivered to the victims. This is done via a VBScript which has been premade by the hackers and included in all messages associated with the threat.
It is used to make an in-depth audit of the compromised machine and the network. The script configures the Trojan code to run as a service with administrative privileges. As a consequence the malware is able to launch its own processes, access system data and modify settings. The hackers can configure a special pre-infection sequence of commands. It may include any of the following procedures:
- Information Harvesting ‒ The Trojan instance is capable of obtaining a large number of sensitive metrics about the compromised system. The list includes not only the hardware components, but also installed software and use settings.
- Network Reconnaissance ‒ The infection module is able to probe the discovered network hosts for any services that can be easily compromised. The hackers can automate the lookup by scoring the discovered file servers, application servers, network shares, printers and etc.
- Additional Malware Delivery ‒ As the main payload is delivered through a dangerous Trojan instance the compromised computer can be infected with several viruses at once.
One of the methods that have been linked to the Oni ransomware is the EternalBlue exploit which is associated with some of the biggest and most successful hacking attacks in the past few months. As a consequence the criminal operators compromise the DC and Active Directory servers of the corporate users. Other methods may be used in the future to target end users, including browser hijackers which are usually made for the most popular web browsers. The list includes Mozilla Firefox, Internet Explorer, Google Chrome, Microsoft Edge, Safari, Opera and others. They usually follow a standard infection sequence:
- The plugins modify important settings of the infected applications. The goal is to redirect the users to a specific hacker-controlled site by manipulating the default home page, search engine and new tabs page.
- The hijacker code is able to obtain sensitive information from the browsers and relay it to the hackers in an automated way. For example this can mean any of the following: cookies, bookmarks, history, passwords, account credentials, form data and etc.
- Depending on the hacker configuration the browser hijacker is able to deliver several malware instances at once.
Impact of ONI Ransomware
The Oni ransomware once deployed on the victim computers execute a sequence of commands. The security analysts detected that the strain shares its code with some of the latest Globe Imposter ransomware threats. It is very likely that the operators have used the code from the malware family and modified it to produce the Oni ransomware. At the moment the main goal of the strains is to encrypt sensitive files and blackmail the victims into paying a ransomware fee. This is the typical formula used by many computer viruses of late.
The serious concerns surrounding the Oni ransomware lies within its mechanism of intrusion. The worrying aspect is that it uses the DiskCryptor utility which was featured in the massive Bad Rabbit ransomware attacks. It modifies the original master boot record of the hard drive and overwrites the operating system boot loader. This makes it impossible for the computer to start normally unless the malware code is completely removed and the original state is restored.
The code analysis and comparison has revealed that the reason why this has been implemented is because the DiskCryptor itself is open-source. The hackers have integrated the application while retaining much of the original code. In comparison with other strains the Oni ransomware actually allows for the recovery of the encrypted partitions when the right decryption key is present. The code itself contains several lines of comments written in Russian. It is possible that the hackers behind this strain have devised it from a country where the language is spoken.
Before proceeding with the actual encryption phases several procedures are executed. Depending on the exact configuration the pattern may switch the places of the commands or their arguments. Examples include:
- Information Harvesting ‒ The Oni ransomware is capable of extracting a lot of sensitive information available on the victim computers. This includes the hardware components, installed applications and user configuration. Included are also all usernames, passwords and other related credentials that may be stored on the machines.
- Trojan Instances ‒ It is used to spy on the victim machines, take over control of the computers at any given time or initiate another malware process.
- Data Theft ‒ It is possible to hijack chosen files before the encryption process begins.
- Log Deletion ‒ The Oni ransomware has been found to delete more than 460 log files using the “wevtutil” command.
Once the actual ransomware process begins the Oni virus engine calculates an unique infection ID for each computer. Next the encryption phase targets files of a particular type, like other related malware families. The hackers tend to use ready-made lists of target file type extensions. In the most common scenario they tend to target data such as: archives, images, music, videos, documents, backups, configuration files, databases and etc. As a result all victim files are renamed using the .oni extension. When all data has been processed a ransom note is generated in a !!!README!!!.html file. Its contents reads the following message:
重要な情報!
すべてのファイルは、RSA-2048およびAES-256暗号で暗号化されています。
心配しないで、すべてのファイルを元に戻すことができます。
すべてのファイルを素早く安全に復元できることを保証します。
ファイルを回復する手順については、お問い合わせ。
信頼性を証明するために、2ファイルを無料で解読できます。ファイルと個人IDを私たちにお送りください。
(ファイルサイズ10MB未満、機密情報なし)
An English translation reads the following:
Important information!
All files are encrypted with RSA – 2048 and AES – 256 ciphers.
Do not worry, you can restore all the files.
We guarantee that all files can be safely restored quickly and safely.
For instructions on recovering files, contact us.
To prove reliability, you can decipher two files for free. Please send us the file and personal ID.
(File size less than 10 MB, no confidential information)contact information
[email protected]
As usual the criminals have opted to resort to the traditional blackmail tactics. The victims should not pay the criminals or contact them in any case. Follow our Oni ransomware removal guide below to effectively restore your computer from any active infections.
Remove ONI Ransomware and Restore PC
WARNING! Manual removal of the ONI Ransomware requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
ONI Ransomware – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Remove ONI Ransomware from Windows
Here’s a way to remove the program. This method will work regardless if you’re on Windows 10, 8, 7, Vista or XP. Simply selecting the program and pressing delete won’t work, as it’ll leave a lot of small files. That’s bad because these leftovers can linger on and cause all sorts of problems. The best way to delete a program is to uninstall it. Here’s how you can do that:
1. Hold the “Windows” button (It’s between CTRL and Alt on most keyboards) and press “R”. You’ll see a pop-up window.
2. In the textbox, type “appwiz.cpl”, then press“ Enter ”.
3. The “Programs and features” menu should now appear. It’s a list of all the programs installed on the PC. Here you can find the program, select it, and press “Uninstall“.
Remove ONI Ransomware Virus From Your Browser
Before resetting your browser’s settings, you should know that this action will wipe out all your recorded usernames, passwords, and other types of data. Make sure to save them in some way.
- 1. Start Mozilla Firefox. In the upper right corner, click on the Open menu icon and select “Add-ons“.
2. Inside the Add-ons Manager select “Extensions“. Search the list of extensions for suspicious entries. If you find any, select them and click “Remove“.
3. Click again on the Open menu icon, then click “Options“.
4. In the Options window, under “General” tab, click “Restore to Default“.
5. Select “Search” in the left menu, mark the unknown search engine and press “Remove”.
- 1. Start Google Chrome. On the upper-right corner, there a “Customize and Control” menu icon. Click on it, then click on “Settings“.
2. Click “Extensions” in the left menu. Then click on the trash bin icon to remove the suspicious extension.
3. Again in the left menu, under Chrome, Click on “Settings“. Go under “On Startup” and set a new page.
4. Afterward, scroll down to “Search“, click on “Manage search engines“.
5. In the default search settings list, find the unknown search engine and click on “X“. Then select your search engine of choice and click “Make default“. When you are ready click “Done” button in the right bottom corner.
2. In the “Manage add-ons” window, bellow “Add-on Types“, select “Toolbars and Extensions“. If you see a suspicious toolbar, select it and click “Remove“.
3. Then again in the “Manage Add-ons” window, in “Add-on Types“, Select “Search Providers“. Chose a search engine and click “Set as default“. Select the unknown search engine and click “Remove and Close”.
4. Open the Tools menu, select “Internet Options”.
5. In the “General” tab, in “Home page”, enter your preferred page. Click “Apply” and “OK”.
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
