Avaddon (.avdn) ransomware virus - removal and decryption options

What kind of malware is Avaddon?

This ransomware was discovered by GrujaRS. Avaddon encrypts files with the AES encryption algorithm and encrypts an AES key using the RSA algorithm. It also changes the desktop wallpaper and renames all files by appending the ".avdn" extension. For example, it renames a file named "1.jpg" to "1.jpg.avdn", "2.jpg" to "2.jpg.avdn", and so on.

Instructions about how to access the website, which victims must supposed use to pay the ransom, are provided in the "[random_numbers]-readme.html" file. Avaddon drops this file in every folder that contains encrypted files.

Screenshot of files encrypted by Avaddon (".avdn" extension):

Ransom note overview

The ransom message within the HTML file states that Avaddon encrypts documents, photos, databases and other important files, and that it is impossible to decrypt them without software called "Avaddon General Decryptor".

Victims can apparently purchase this decryption tool by following the instructions provided on a Tor website, which contains information such as cost of the aforementioned decryption tool, how much time victims have to purchase it until the cost is doubled, and various other details.

It is stated that decryption software costs the equivalent of 0.05346968 Bitcoin and must be purchased by transferring this BTC amount to the provided address (BTC wallet). If victims make not purchase within 7 days and 12 hours, the cost is doubled. Victims supposedly receive the Avaddon General Decryptor after the transaction is made and the payment is confirmed.

More about ransomware

You are strongly advised not to pay any ransom to these cyber criminals - it is very likely that they will not send any decryption tool, even if you meet all of their demands. Unfortunately, there are no free tools that can decrypt files compromised by this ransomware (only the developers have valid decryption tools).

In such cases, victims can avoid data loss by restoring files from a backup. It is possible to prevent further encryption of unaffected files by uninstalling ransomware from the computer, however, already compromised files remain encrypted even when the malware is no longer installed on the operating system.

Malware such as Avaddon encrypt files so they cannot be recovered without specific software and/or a decryption key. Some examples of other ransomware programs are Kkll, Professeur and PGP. Main differences are size of ransom and encryption algorithm that ransomware uses to encrypt data.

Only the cyber criminals behind ransomware have tools that can recover files that were encrypted by it, unless in rare cases the ransomware is not finished (contains bugs, flaws). Therefore, you are advised to have data backed up on a remote server or unplugged storage device.

How did ransomware infect my computer?

Users often infect their computers inadvertently with malware (including ransomware) through malspam campaigns, unofficial software activators and updaters, dubious file and software download channels and Trojans. Cyber criminals use spam campaigns to proliferate malware by sending emails with malicious attachments or website links that download malicious files.

They attempt to trick people into executing a malicious file by disguising their emails as important, official and legitimate. When recipients open the malicious file, however, they cause installation of malware.

Examples of files that cyber criminals attach to their emails are malicious Microsoft Office documents, executable files (.exe), JavaScript files, PDF documents, archive files (ZIP, RAR). Users also infect computers when they use various unofficial, third party activation tools to activate licensed software.

These tools supposedly bypass activation free of charge, however, they often install malware instead. The same applies to third party updaters - rather than updating any software, they install malicious programs. They also exploit bugs/flaws of installed software that is out of date.

Malicious software is also distributed through dubious download channels. For example, third party downloaders, unofficial websites, Peer-to-Peer networks (torrent clients, eMule), freeware download sites, free file hosting pages, etc. Systems become infected when users open/execute malicious files that were downloaded through such channels.

Note that the rogue files are often disguised as regular and legitimate. Trojans are malicious programs that distribute malware and cause chain infections, however, they can only install additional malware they are already installed onto the user's computer.

Threat Summary:

Name	Avaddon virus
Threat Type	Ransomware, Crypto Virus, Files locker.
Decryption Tools	Files can be decrypted with a tool developed by Emsisoft or Bitdefender.
Encrypted Files Extension	.avdn, random string (depends on the variant).
Ransom Demand Message	readme.html (with random numbers within its name), desktop wallpaper and Tor website.
Ransom Amount	0.05346968 Bitcoin.
BTC Wallet Address	3JtU8efLk6c176nnntDYCTyBg9biuSdKiE
Detection Names	Avast (JS:Downloader-FYY [Trj]), BitDefender (Exploit.HTML.BitsAdmin.Gen), ESET-NOD32 (PowerShell/TrojanDownloader.Agent.DV), Kaspersky (HEUR:Trojan-Downloader.Script.Generic), Full List Of Detections (VirusTotal)
Rogue Process Name	237502353.exe (its name might vary).
Symptoms	Cannot open files stored on your computer, previously functional files now have a different extension (for example, my.docx.locked). A ransom demand message is displayed on your desktop. Cyber criminals demand payment of a ransom (usually in bitcoins) to unlock your files.
Distribution methods	Infected email attachments (macros), torrent websites, malicious ads.
Damage	All files are encrypted and cannot be opened without paying a ransom. Additional password-stealing Trojans and malware infections can be installed together with a ransomware infection.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

How to protect yourself from ransomware infections

All software should be downloaded only from official, trustworthy websites and direct links. Third party downloaders, installers and other channels (mentioned above) are often used to proliferate malware. Installed software must be updated and activated (if necessary) through tools/functions that are designed by the official developers.

Unofficial, third party updating and activation tools should never be used. Note that it is illegal to activate licensed programs with 'cracking' tools (third party activators). Do not open attachments or links in irrelevant emails that are received from suspicious, unknown addresses.

Open email contents when there is no doubt about safety. Regularly scan the operating system for threats with reputable antivirus or anti-spyware software. Keep this software up to date. If your computer is already infected with Avaddon, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate this ransomware.

Appearance of "[random_numbers]-readme.html" file (GIF):

Text in this HTML file:

Your network has been infected by Avaddon
All your documents, photos, databases and other important files have been encrypted and you are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!

 

The only way to restore your files is to buy our special software - Avaddon General Decryptor. Only we can give you this software and only we can restore your files!

 

You can get more information on our page, which is located in a Tor hidden network.

 

How to get to our page
Download Tor browser - hxxps://www.torproject.org/
Install Tor browser
Open link in Tor browser - avaddonbotrxmuyl.onion
Follow the instructions on this page
Your ID:
-

 

DO NOT TRY TO RECOVER FILES YOURSELF!

DO NOT MODIFY ENCRYPTED FILES!

OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER!

Screenshot of the HTML file:

Appearance of the Avaddon Tor website (GIF):

Text in this website:

Brand
Your network has been infected by Avaddon

 

Don't worry, we can help you to restore all your files!

 

Avaddon General Decryptor price is 500 USD* 7:11:58:31
*If you don’t pay before the time runs out, the price will be doubled!

 

All your documents, photos, databases and other important files have been encrypted!

 

To restore all your files you need to buy our special software - Avaddon General Decryptor!

 

You can do it right now. Follow the instruction below. But remember that you do not have much time!
500 USD
≈ 0.05346968 BTC
3JtU8efLk6c176nnntDYCTyBg9biuSdKiE
NOT PAID

 

1. Buy the Bitcoin cryptocurrency. You will find instructions how you can do it below.

 

2. Send 0.05346968 BTC to the address: 3JtU8efLk6c176nnntDYCTyBg9biuSdKiE (in ONE payment, this amount doesn’t include the transaction fee)

 

3. The transaction will be confirmed after receiving 6 confirmations

 

4. When the payment is confirmed, you can download the Avaddon General Decryptor.
Attention!

 

Please be careful and visually check the address after copy-paste (because on your PC there is probably a malware monitoring and changing the address in your clipboard)

 

How to buy Bitcoin

- Buy Bitcoin from a bank account or by bank transfer
Coinmama, Bitpanda, Coinfloor, Kraken, Coinfinity, BTC Direct, Change Invest, Coinbase, EXMO, CEX.IO, Bitfinex, Bitstamp, Gemini, Lykke, BTCBIT

- Buy Bitcoin through PayPal
Etoro, Local Bitcoins

- Buy Bitcoin with a Credit/Debit Card
Changelly, Bitpanda, Bitstamp, Coinbase, EXMO, CEX.IO, Lykke, BTCBIT, Change now

- Buy bitcoin in cash or cash deposit
Local Bitcoins, Bitquick, Libertyx, Bit it, Bitcoin ATMs, Bitcoin ATM Radar

Screenshot of Avaddon desktop wallpaper:

Screenshot of Avaddon malicious process running in Task Manager as "237502353.exe" (its name might vary):

Update 10 June 2020 - Cyber criminals have recently started an email spam campaign to spread Avaddon ransomware. The text within the email is a smile: ";)". The email subject, however, is "Your new photo?" and also contains an archive file attached ("IMG159131.jpg.js.zip").

The archive contains a JavaScript file named "IMG159131.jpg". For users who do not have the "display file extensions" option enabled, the file may seem to be an ordinary image (.jpg format), however, this is a script designed to download and execute Avaddon ransomware.

Screenshot of the spam email:

Screenshot of a website displayed after paying the ransom to Avaddon's developers. Note that paying does not guarantee that your files will be decrypted (in most cases, criminals scam the victims and paying gives no benefit):

Update 26 June 2020 - One victim has confirmed that paying gives no value - the Download button for the decryption tool does not work and simply leads to a nonexistent web page:

Update 1 July 2020 - A new variant of Avaddon ransomware has been discovered. This variant drops a different ransom message, sets a different desktop wallpaper and adds a random file extension.

Screenshot of this variant's ransom message:

Text presented within:

Your network has been infected!
All your documents, photos, databases and other important files have been encrypted and you are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!

The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files!

You can get more information on our page, which is located in a Tor hidden network.

How to get to our page
Download Tor browser - hxxps://www.torproject.org/
Install Tor browser
Open link in Tor browser - ZY010ndXea30XMmPb5s.avaddonbotrxmuyl.onion/?AdYOgB3ONcK
Follow the instructions on this page
Your ID:
-
DO NOT TRY TO RECOVER FILES YOURSELF!

DO NOT MODIFY ENCRYPTED FILES!

OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER!

atM3v99uMHyfEjFPIYgyCvf

Screenshot of this variant's desktop wallpaper:

Text presented within:

Files are encrypted
If you do not pay, YOU WILL LOSE ALL FILES FOREVER!

Find: Hl_readme.html
in folders or on your desktop!

You have a few days TO PAY or
ALL INFORMATION ABOUT YOU
WILL BE PUBLISHED IN PUBLIC ACCESS !!!

Screenshot of files encrypted by this variant (random extension):

Example of a ransom message ("G_readme.html") delivered by yet another Avaddon ransomware variant:

Text presented within:

Your network has been infected!
Your files are locked due to a vulnerability in your system

You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly.

The only way to unlock your data is to buy the decryption program.

Go to the link written below to more details.

If you do not pay for recovery, then all the confidential data from your computer WILL BE TRANSFERRED TO PUBLIC ACCESS. Follow the instructions below to restore your files and keep them confidential.

If you cannot do this yourself, find a data recovery company in internet.

They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees.

ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE.

Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move!

How to get to our page
Download Tor browser - hxxps://www.torproject.org/
Install Tor browser
Open link in Tor browser - zcQ3LA.avaddonbotrxmuyl.onion/?5JM0UXN905lovYAeikPgkwa9nY
Follow the instructions on this page
Your ID:
-

DO NOT MODIFY ENCRYPTED FILES!

OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER!

Yet another variant of a ransom note delivered by Avaddon ransomware:

Text presented within:

-------===    Your network has been infected!    ===-------

*****************    DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED    *****************

All your documents, photos, databases and other important files have been encrypted and have the extension: .beEdeCDAea

You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!

The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files!
We have also downloaded a lot of private data from your network.

If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info.

You can get more information on our page, which is located in a Tor hidden network.

How to get to our page

----------------------

|

|  1. Download Tor browser - hxxps://www.torproject.org/

|

|  2. Install Tor browser

|

|  3. Open link in Tor browser - avaddonbotrxmuyl.onion

|

|  4. Follow the instructions on this page

|

----------------------

Your ID:

----------------------
-
----------------------
* DO NOT TRY TO RECOVER FILES YOURSELF!
* DO NOT MODIFY ENCRYPTED FILES!
* * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * *
9M

Update February 9, 2021 - Javier Yuste has recently shared a GitHub page providing an open-source decryptor for Avaddon ransomware. The decryption process is rather simple. You can download the tool and find its manual in Javier Yuste's GitHub page.

Update June 14, 2021 - Cyber criminals have closed the Avaddon ransomware operation and released all the decryption keys. This allowed Emsisoft team to develop a decryption tool (download link) capable of restoring data compromised by Avaddon ransomware.

Screenshot of Emsisoft's Avaddon decryptor:

Update June 06, 22 - Bitdefender has also released a decryption tool for Avaddon ransomware (download link and user manual).

Screenshot of Bitdefender's decryption tool for Avaddon ransomware:

Avaddon ransomware removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Video suggesting what steps should be taken in case of a ransomware infection:

Quick menu:

• What is Avaddon virus?
• STEP 1. Reporting ransomware to authorities.
• STEP 2. Isolating the infected device.
• STEP 3. Identifying the ransomware infection.
• STEP 4. Searching for ransomware decryption tools.
• STEP 5. Restoring files with data recovery tools.
• STEP 6. Creating data backups.

Reporting ransomware to authorities:

If you are a victim of a ransomware attack we recommend reporting this incident to authorities. By providing information to law enforcement agencies you will help track cybercrime and potentially assist in the prosecution of the attackers. Here's a list of authorities where you should report a ransomware attack. For the complete list of local cybersecurity centers and information on why you should report ransomware attacks, read this article.

List of local authorities where ransomware attacks should be reported (choose one depending on your residence address):

•  USA - Internet Crime Complaint Centre IC3
•  United Kingdom - Action Fraud
•  Spain - Policía Nacional
•  France - Ministère de l'Intérieur
•  Germany - Polizei
•  Italy - Polizia di Stato
•  The Netherlands - Politie
•  Poland - Policja
•  Portugal - Polícia Judiciária

Isolating the infected device:

Some ransomware-type infections are designed to encrypt files within external storage devices, infect them, and even spread throughout the entire local network. For this reason, it is very important to isolate the infected device (computer) as soon as possible.

Step 1: Disconnect from the internet.

The easiest way to disconnect a computer from the internet is to unplug the Ethernet cable from the motherboard, however, some devices are connected via a wireless network and for some users (especially those who are not particularly tech-savvy), disconnecting cables may seem troublesome. Therefore, you can also disconnect the system manually via Control Panel:

Navigate to the "Control Panel", click the search bar in the upper-right corner of the screen, enter "Network and Sharing Center" and select search result:

Click the "Change adapter settings" option in the upper-left corner of the window:

Right-click on each connection point and select "Disable". Once disabled, the system will no longer be connected to the internet. To re-enable the connection points, simply right-click again and select "Enable".

Step 2: Unplug all storage devices.

As mentioned above, ransomware might encrypt data and infiltrate all storage devices that are connected to the computer. For this reason, all external storage devices (flash drives, portable hard drives, etc.) should be disconnected immediately, however, we strongly advise you to eject each device before disconnecting to prevent data corruption:

Navigate to "My Computer", right-click on each connected device, and select "Eject":

Step 3: Log-out of cloud storage accounts.

Some ransomware-type might be able to hijack software that handles data stored within "the Cloud". Therefore, the data could be corrupted/encrypted. For this reason, you should log-out of all cloud storage accounts within browsers and other related software. You should also consider temporarily uninstalling the cloud-management software until the infection is completely removed.

Identify the ransomware infection:

To properly handle an infection, one must first identify it. Some ransomware infections use ransom-demand messages as an introduction (see the WALDO ransomware text file below).

This, however, is rare. In most cases, ransomware infections deliver more direct messages simply stating that data is encrypted and that victims must pay some sort of ransom. Note that ransomware-type infections typically generate messages with different file names (for example, "_readme.txt", "READ-ME.txt", "DECRYPTION_INSTRUCTIONS.txt", "DECRYPT_FILES.html", etc.). Therefore, using the name of a ransom message may seem like a good way to identify the infection. The problem is that most of these names are generic and some infections use the same names, even though the delivered messages are different and the infections themselves are unrelated. Therefore, using the message filename alone can be ineffective and even lead to permanent data loss (for example, by attempting to decrypt data using tools designed for different ransomware infections, users are likely to end up permanently damaging files and decryption will no longer be possible even with the correct tool).

Another way to identify a ransomware infection is to check the file extension, which is appended to each encrypted file. Ransomware infections are often named by the extensions they append (see files encrypted by Qewe ransomware below).

This method is only effective, however, when the appended extension is unique - many ransomware infections append a generic extension (for example, ".encrypted", ".enc", ".crypted", ".locked", etc.). In these cases, identifying ransomware by its appended extension becomes impossible.

One of the easiest and quickest ways to identify a ransomware infection is to use the ID Ransomware website. This service supports most existing ransomware infections. Victims simply upload a ransom message and/or one encrypted file (we advise you to upload both if possible).

The ransomware will be identified within seconds and you will be provided with various details, such as the name of the malware family to which the infection belongs, whether it is decryptable, and so on.

Example 1 (Qewe [Stop/Djvu] ransomware):

Example 2 (.iso [Phobos] ransomware):

If your data happens to be encrypted by ransomware that is not supported by ID Ransomware, you can always try searching the internet by using certain keywords (for example, a ransom message title, file extension, provided contact emails, crypto wallet addresses, etc.).

Search for ransomware decryption tools:

Encryption algorithms used by most ransomware-type infections are extremely sophisticated and, if the encryption is performed properly, only the developer is capable of restoring data. This is because decryption requires a specific key, which is generated during the encryption. Restoring data without the key is impossible. In most cases, cybercriminals store keys on a remote server, rather than using the infected machine as a host. Dharma (CrySis), Phobos, and other families of high-end ransomware infections are virtually flawless, and thus restoring data encrypted without the developers' involvement is simply impossible. Despite this, there are dozens of ransomware-type infections that are poorly developed and contain a number of flaws (for example, the use of identical encryption/decryption keys for each victim, keys stored locally, etc.). Therefore, always check for available decryption tools for any ransomware that infiltrates your computer.

Finding the correct decryption tool on the internet can be very frustrating. For this reason, we recommend that you use the No More Ransom Project and this is where identifying the ransomware infection is useful. The No More Ransom Project website contains a "Decryption Tools" section with a search bar. Enter the name of the identified ransomware, and all available decryptors (if there are any) will be listed.

Restore files with data recovery tools:

Depending on the situation (quality of ransomware infection, type of encryption algorithm used, etc.), restoring data with certain third-party tools might be possible. Therefore, we advise you to use the Recuva tool developed by CCleaner. This tool supports over a thousand data types (graphics, video, audio, documents, etc.) and it is very intuitive (little knowledge is necessary to recover data). In addition, the recovery feature is completely free.

Step 1: Perform a scan.

Run the Recuva application and follow the wizard. You will be prompted with several windows allowing you to choose what file types to look for, which locations should be scanned, etc. All you need to do is select the options you're looking for and start the scan. We advise you to enable the "Deep Scan" before starting, otherwise, the application's scanning capabilities will be restricted.

Wait for Recuva to complete the scan. The scanning duration depends on the volume of files (both in quantity and size) that you are scanning (for example, several hundred gigabytes could take over an hour to scan). Therefore, be patient during the scanning process. We also advise against modifying or deleting existing files, since this might interfere with the scan. If you add additional data (for example, downloading files/content) while scanning, this will prolong the process:

Step 2: Recover data.

Once the process is complete, select the folders/files you wish to restore and simply click "Recover". Note that some free space on your storage drive is necessary to restore data:

Create data backups:

Proper file management and creating backups is essential for data security. Therefore, always be very careful and think ahead.

Partition management: We recommend that you store your data in multiple partitions and avoid storing important files within the partition that contains the entire operating system. If you fall into a situation whereby you cannot boot the system and are forced to format the disk on which the operating system is installed (in most cases, this is where malware infections hide), you will lose all data stored within that drive. This is the advantage of having multiple partitions: if you have the entire storage device assigned to a single partition, you will be forced to delete everything, however, creating multiple partitions and allocating the data properly allows you to prevent such problems. You can easily format a single partition without affecting the others - therefore, one will be cleaned and the others will remain untouched, and your data will be saved. Managing partitions is quite simple and you can find all the necessary information on Microsoft's documentation web page.

Data backups: One of the most reliable backup methods is to use an external storage device and keep it unplugged. Copy your data to an external hard drive, flash (thumb) drive, SSD, HDD, or any other storage device, unplug it and store it in a dry place away from the sun and extreme temperatures. This method is, however, quite inefficient, since data backups and updates need to be made regularly. You can also use a cloud service or remote server. Here, an internet connection is required and there is always the chance of a security breach, although it's a really rare occasion.

We recommend using Microsoft OneDrive for backing up your files. OneDrive lets you store your personal files and data in the cloud, sync files across computers and mobile devices, allowing you to access and edit your files from all of your Windows devices. OneDrive lets you save, share and preview files, access download history, move, delete, and rename files, as well as create new folders, and much more.

You can back up your most important folders and files on your PC (your Desktop, Documents, and Pictures folders). Some of OneDrive’s more notable features include file versioning, which keeps older versions of files for up to 30 days. OneDrive features a recycling bin in which all of your deleted files are stored for a limited time. Deleted files are not counted as part of the user’s allocation.

The service is built using HTML5 technologies and allows you to upload files up to 300 MB via drag and drop into the web browser or up to 10 GB via the OneDrive desktop application. With OneDrive, you can download entire folders as a single ZIP file with up to 10,000 files, although it can’t exceed 15 GB per single download.

OneDrive comes with 5 GB of free storage out of the box, with an additional 100 GB, 1 TB, and 6 TB storage options available for a subscription-based fee. You can get one of these storage plans by either purchasing additional storage separately or with Office 365 subscription.

Creating a data backup:

The backup process is the same for all file types and folders. Here’s how you can back up your files using Microsoft OneDrive

Step 1: Choose the files/folders you want to backup.

Click the OneDrive cloud icon to open the OneDrive menu. While in this menu, you can customize your file backup settings.

Click Help & Settings and then select Settings from the drop-down menu.

Go to the Backup tab and click Manage backup.

In this menu, you can choose to backup the Desktop and all of the files on it, and Documents and Pictures folders, again, with all of the files in them. Click Start backup.

Now, when you add a file or folder in the Desktop and Documents and Pictures folders, they will be automatically backed up on OneDrive.

To add folders and files, not in the locations shown above, you have to add them manually.

Open File Explorer and navigate to the location of the folder/file you want to backup. Select the item, right-click it, and click Copy.

Then, navigate to OneDrive, right-click anywhere in the window and click Paste. Alternatively, you can just drag and drop a file into OneDrive. OneDrive will automatically create a backup of the folder/file.

All of the files added to the OneDrive folder are backed up in the cloud automatically. The green circle with the checkmark in it indicates that the file is available both locally and on OneDrive and that the file version is the same on both. The blue cloud icon indicates that the file has not been synced and is available only on OneDrive. The sync icon indicates that the file is currently syncing.

To access files only located on OneDrive online, go to the Help & Settings drop-down menu and select View online.

Step 2: Restore corrupted files.

OneDrive makes sure that the files stay in sync, so the version of the file on the computer is the same version on the cloud. However, if ransomware has encrypted your files, you can take advantage of OneDrive’s Version history feature that will allow you to restore the file versions prior to encryption.

Microsoft 365 has a ransomware detection feature that notifies you when your OneDrive files have been attacked and guide you through the process of restoring your files. It must be noted, however, that if you don’t have a paid Microsoft 365 subscription, you only get one detection and file recovery for free.

If your OneDrive files get deleted, corrupted, or infected by malware, you can restore your entire OneDrive to a previous state. Here’s how you can restore your entire OneDrive:

1. If you're signed in with a personal account, click the Settings cog at the top of the page. Then, click Options and select Restore your OneDrive.

If you're signed in with a work or school account,  click the Settings cog at the top of the page. Then, click Restore your OneDrive.

2. On the Restore your OneDrive page, select a date from the drop-down list. Note that if you're restoring your files after automatic ransomware detection, a restore date will be selected for you.

3. After configuring all of the file restoration options, click Restore to undo all the activities you selected.

The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups.

Frequently Asked Questions (FAQ)

How was my computer hacked and how did hackers encrypt my files?

It is known that cybercriminals distribute Avaddon ransomware via email - they send emails containing malicious attachments. In other cases, ransomware can encrypt data via files downloaded from unreliable sources, installers for pirated software (or cracking tools), fake software updating tools, Trojans, drive-by downloads, etc.

How to open ".avdn" files?

These files cannot be opened until they are decrypted.

Where should I look for free decryption tools for Avaddon ransomware?

Files encrypted by Avaddon ransomware can be decrypted with a tool created by Emsisoft of Bitdefender.

Should I pay cybercriminals a ransom?

Not all threat actors provide decryption tools after the payment. Thus, it is strongly recommended not to trust (pay) them.

Will Combo Cleaner help me remove Avaddon ransomware?

Yes, Combo Cleaner will remove ransomware from the infected computer. It should be removed to prevent more data loss. Files remain encrypted even after the removal. Antivirus software does not decrypt encrypted files.

▼ Show Discussion