Diamond Virus 🔐 (. Diamond Files) — How to Remove?

Diamond virus: what is known so far?

The pattern of renaming is the following: .diamond. The file name is then changed to a random string. After the encryption, a file entitled, for example, “report.docx” will be changed to “DQoncqiou19H-cBCjhawy1b9c8173bKJACIU1=cnqiH.diamond”.

In each directory that contains the encoded files, a HOW TO RECOVER ENCRYPTED FILES.TXT text document will be created. It is a ransom money memo. Therein you can find information about the ways of paying the ransom and some other information. The ransom note usually contains a description of how to buy the decryption tool from the tamperers. You can obtain this decrypting software after contacting by email. That is basically the scheme of the felony.

The HOW TO RECOVER ENCRYPTED FILES.TXT document accompanying the Diamond ransomware states the following:

ALL YOUR DATA IS ENCRYPTED MILITARY ENCRYPTION !

Your PERSONAL id
-

If you want to get a decoder, you need to pay !
We only accept bitcoins !
With your mail  
we can decrypt 2 files proof of !
send us the id that is written in the ransom letter !
write id which is listed in the ransom note !
The price will be doubled in 72 hours !

In the screenshot below, you can see what a directory with files encrypted by the Diamond looks like. Each filename has the “.diamond” extension added to it.

How did my machine catch Diamond ransomware?

There are currently three most popular methods for evil-doers to have the Diamond virus working in your system. These are email spam, Trojan infiltration and peer file transfer.

If you open your inbox and see emails that look like familiar notifications from utility services companies, postal agencies like FedEx, web-access providers, and whatnot, but whose “from” field is unknown to you, be wary of opening those emails. They are very likely to have a ransomware item enclosed in them. Thus it is even more dangerous to download any attachments that come with letters like these.

Another option for ransom hunters is a Trojan virus scheme². A Trojan is an object that infiltrates into your computer disguised as something else. For example, you download an installer of some program you need or an update for some software. However, what is unboxed turns out to be a harmful program that encodes your data. Since the installation package can have any name and any icon, you have to make sure that you can trust the resource of the stuff you’re downloading. The optimal way is to trust the software developers’ official websites.

As for the peer-to-peer file transfer protocols like BitTorrent or eMule, the threat is that they are even more trust-based than the rest of the Internet. You can never know what you download until you get it. Our suggestion is that you use trustworthy websites. Also, it is a good idea to scan the directory containing the downloaded files with the antivirus as soon as the downloading is done.