Just imagine this scenario. You are working on your device, and then suddenly it seems to slow down. Or perhaps you can’t access critical files that were previously available; you could be getting some error messages informing you that Windows can’t open a file or the file type is unknown. Whatever the case, all these experiences are frustrating. It is even worse when the cause of the problem is ransomware attacks. In this post, we will discuss how to stop this menace, especially the STOP ransomware.
The STOP virus is one of the recent and most widespread crypto-malware variants. It was first discovered in 2017, but new variants have emerged since then. Actually, new versions of the ransomware have been emerging almost every month. Users have witnessed files with weird extensions, such as .keypass, .shadow, .todar, .lapoi, .daris, .tocue, .gusau, .docdoc, .madek, .novasof, .djvuu, and many other extensions. But the most active ones are Djvu ransomware and Keypass ransomware.
The STOP Virus Overview
The virus uses a combination of RSA and AES algorithms to encrypt data, then add .STOP file extension, thus making it impossible to open or use this data. It can lock up videos, pictures, documents, music, and other files. The extortionists want you to pay a ransom to restore these files.
Recently, security researchers estimated that the virus affected more than half a million victims worldwide. On average, the virus has been demanding a ransom of $300 – $600 to decrypt the data. This malicious payload is usually distributed through software cracks, keygens, email attachments, and tools like KMSPico.
An infection with the dangerous STOP virus can lead to serious security issues. Luckily, in this STOP virus removal guide, we will include some tools you can use to prevent ransomware attacks. Some victims have recovered their files using Djvu STOP Ransomware Decryptor and Removal. It is a tool developed by Emsisoft and Michael Gillespie that is capable of decrypting more than 100 virus variants.
Threat Summary
Name: STOP ransomware
Category: Cryptovirus
Encryption technology: AES and RSA-1024
Variants: .STOP, .WAITING, .SUSPENDED, .CONTACTUS, .KEYPASS, .PAUSA, .DATASTOP, .DATAWAIT, .WHY, .INFOWAIT, .SAVEfiles, .puma, .shadow, .djvuu, .djvu, .udjvu, .djvus, .uudjvu, .charck, .chech,. Kroput1, .kropun, .doples, .luceq, .luces, .proden, .daris, .tocue, .lapoi, .pulsar1, .docdoc, .gusau, .todar, .ntuseg, and .madek, among others.
Ransom messages: !!! YourDataRestore !!! txt, !!RestoreProcess!!!.txt, !!!DATA_RESTORE!!!.txt, !!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!!RESTORE_FILES!!!.txt, !!SAVE_FILES_INFO!!!.txt. Usually, these files appear on your desktop after file encryption completes.
Ransom: It ranges from $300 – $600. Sometimes, the fraudsters might offer a 50% discount to those who heed their call within 72 hours.
Contact email addresses: stopfilestore@bitmessage.ch; suspendedfiles@bitmessage.ch; topfilesrestore@india.com; decryption@bitmessage.ch; suspendedfiles@india.com; decryptionwhy@india.com; helpshadow@india.com; savefiles@india.com; restoredjvu@india.com; vengisto@india.com; and keypassdecrypt@india.com.
Distribution methods: Hacked websites, rogue email attachments, brute-force attacks, cracks, exploits, and keygens.
System modification: The virus may modify the Windows registry, delete shadow volume copies, create scheduled tasks, and start/stop some process, among other modifications.
Removal: To get rid of this virus, run a full system scan using a powerful anti-malware program. On top of this, you need to unlock your files using a reliable decryptor. Most versions are decryptable.
STOP Ransomware Variants
As touched on earlier, new variants of the threat keep re-emerging with time. One of its common versions is Djvu ransomware, which can be identified by its several extensions, including .djvu, .udjvu, .djvus, .uudjvu, .djvur, and .djvuq. Besides the Djvu ransomware, other new and popular malware variants include:
- CONTACTUS ransomware
- SaveFiles ransomware
- Keypass ransomware
- Puma ransomware
- Suspended ransomware
- Shadow ransomware
In December 2019, several new variants were introduced to the scene. These include .nawk, .kodg, .toec, .coot, .mosk, .derp, .lokf, .mbed, .peet, .meka, .rote, .righ, .zobm, .grod, .merl, .mkos, .msop, and .nbes. As of January 2020, a few additional variants have also been detected. The most notable ones are: .kodc, .alka, .topi, .npsg, .reha, .repp, and .nosu.
How the STOP Virus Might Get into Your Computer
The virus typically spreads through spam emails that have malicious attachments. With the help of social engineering, hackers can trick users into opening malicious attachments, therefore letting the malware into their systems. Nevertheless, you can easily spot these emails by looking for these signs:
- You did not anticipate getting an email like that. For instance, you may receive an email from Amazon, yet you ordered nothing from the store.
- An email is full of weirdly-structured sentences or mistakes.
- The email lacks credentials like a company logo or signature.
- The email neither has a subject heading nor a body. It only includes an attachment. Sometimes, the email might prompt you to check the information in the attached documents.
- The sender’s email address appears suspicious.
Besides spam emails, the virus can also sneak into your system if you download a corrupted program or its update, click on malicious ads, or other similar techniques. It is, therefore, critical for internet users to learn how to identify potential dangers that might be lurking on the web.
How to Stop Ransomware Attacks?
Paying the requested ransom fee isn’t the most effective way to solve the problem created by the STOP virus. In fact, you are only encouraging the attackers to continue spreading the cryptovirus if you pay the ransom. So, instead of paying the ransom fee, plan to get rid of the virus immediately, then find other effective ways to recover your data.
Option 1: Remove the STOP Virus Manually
Step 1: Boot Your Computer into Safe Mode
Starting your computer in Safe Mode will enable you to isolate all files interfered with by ransomware so that they can be removed safely. The STOP virus might block access to your security software, which is required to get rid of the virus. In this situation, you may only reactivate your virus by booting into Safe Mode with Networking. To boot your computer into Safe Mode, follow the instructions below:
- Press the Windows and R keys together to open the Run window.
- When the window appears, type msconfig into it, and then hit Enter.
- Wait for the Configuration window to appear, then navigate to the Boot tab.
- Check the Safe Boot option, then do the same for the Network option, too.
- Click Apply, and then OK to activate the settings.
Step 2: Display Hidden Files
As often the case, ransomware may hide some of their malicious files on your system. For this reason, you should show all the hidden files. Here is how to do it:
- Go to My Computer or This PC, depending on how it is named on your PC.
- If you are using Windows 7, click on the Organize button, then highlight Folder and search options. You can then navigate to the View tab, then move to the Hidden files and folders section, and check Show hidden files and folders.
- For Windows 8/10, navigate directly to the View tab, then check the Hidden items box.
- Now, click Apply, and then OK.
Step 3: Use the Task Manager to Stop Malicious Processes
To open the Task Manager, use the CTRL + Shift + ESC keyboard shortcut, then follow these steps:
- Navigate to the Processes tab.
- Search for all the suspicious processes, and then right-click on each of them and choose Open File Location.
- After that, go back to the Task Manager window and terminate the malicious processes. To do so, right-click on a suspicious process, then select End Process.
- To get rid of it completely, go to the folder where the suspicious file is located and delete the file from there.
Step 4: Repair the Windows Registry
To delete illegal entries in the Windows Registry, follow the steps below:
- Use the keyboard shortcut Windows + R to open the Run window.
- Type regedit into the search box, then press Enter.
- Now, press the CTRL + F shortcut, then type the name of the malicious file in the search field to locate the file.
- If you find any registry key and value related to that filename, delete them. But you should be careful not to delete legitimate keys.
Step 5: Recover Encrypted Files
There are several ways that you may recover some lost data. Here are the most common ones.
1. Use Present Backups
It is usually advisable to keep a backup of your most valuable data in an external drive or cloud storage. This way, you can quickly recover your files if they are destroyed, corrupted, or stolen.
2. Use the System Restore Feature
Alternatively, you can use the System Restore utility to revert to a previous working point. This option will only be possible if you had created restoration points before the infection, meaning you may not recover files and applications that were introduced later.
To recover your files using the System Restore utility, follow the steps below:
- Tap on the Windows key and type system restore into the search box, and hit Enter.
- Now, choose Open System Restore, and then follow the instructions that follow next. This option will be displayed if you have an active restoration point.
3. Use File History
Here is how it goes:
- Go Start, and then type restore your files into the search field.
- You will see the Restore your files with File History option.
- Click on it, and then type the name of the file into the search bar or just select a folder.
- Click on the Restore button.
4. Use Professional Recovery Tools
Specialist recovery software can restore data, partitions, photos, documents, and over 300 file types that may have disappeared during the attack. One of the most effective recovery solutions is the Djvu STOP Ransomware Decryptor and Removal tool.
According to Emsisoft, the tool can recover data for over 70% of all victims. Unfortunately, new variants of the virus keep emerging, so the tool might only decrypt files locked by offline keys. In most cases, offline keys take a while to extract.
How to Know If Offline or Online Keys Were Used in Encryption?
If the STOP virus infected your computer after August 2019, then you have to find out whether the hackers used online or offline keys to encrypt your files.
The latest version of the ransomware usually encrypts files via online keys if it can connect to its Command & Control Server during the attack. But if that is not possible, then it will use an offline key. The key is usually the same for all victims of a particular ransomware variant.
If the ransomware encrypts files using an offline key, you have higher chances of recovering all your data immediately. Unfortunately, the same cannot be said of online keys. To find out which keys the ransomware, use to encrypt your files, follow these steps:
- Navigate to C: disk, and then open the SystemID folder.
- Once there, launch the PersonalID.txt file, and then check all the keys listed on it.
- If any of the keys end with t1, it is possible to recover some of the data.
Option 2: Remove the STOP Virus Automatically
Typically, manual removal of the STOP virus requires that you be familiar with registries and system files. This cyber threat might modify your registry, create new keys, interfere with legitimate processes, or even install malicious files. Therefore, manual removal might not be the most effective way to reverse the damage and get rid of all the traces of this virus.
The cyber threat includes several files and components that resemble legitimate system processes. So, locating and deleting some entries might cause damages to your computer, further worsening the situation. That is why you should use professional security tools to remove the STOP virus. Download a reliable tool like Outbyte Anti-malware to scan your system for the virus and remove it.
If the virus disables or blocks access to your security solutions, try booting your computer into Safe Mode, and then running your antivirus program to detect and remove the virus. Once you have gotten rid of the STOP virus, you can then export the needed files from a cloud storage or plug in your external storage disk with backup files.
How to Prevent Ransomware Attacks?
Most hackers are enticed by quick and easy payloads that ransomware offers. The problem with these attacks is that they go beyond stealing your money. They can get away with your valuable information, such as usernames and passwords, personal ID numbers, and bank details, exposing you to more risks. And if you are on a network, every device in that network is at risk.
Ransomware can infiltrate your computers, tablets, and even smartphones. So, if you have been thinking your iOS device is safe from ransomware, you should be aware. Generally, all devices are vulnerable to ransomware attacks, only that some are more vulnerable than others.
iOS users tend to be safer than other device users, but you can still encounter ransomware if you have jailbroken your device. One of the techniques that crooks use to carry out ransomware attacks is to obtain iCloud credentials for iOS users, lock their devices, then cause the devices to show a ransom message.
So, don’t wait for the STOP virus to get into your system. With such attacks on the rise, you have to prioritize prevention. Here are common ways to defend yourself against ransomware attacks:
1. Create a Backup of Your Important Files
Back up your computer regularly to minimize cases of data loss. You can store these files locally in an offline system or the cloud. With this measure, your information will be backed up in a safe place, free from hackers. Furthermore, you can easily recover your files, even if your device gets infected with ransomware.
2. Avoid Pop-Up Installation Requirements
You should always treat pop-ups as your enemy, especially if you receive them when connected to the internet. If you get a pop-up requesting you to download or update a plugin, close it immediately. It could be a malicious source trying to infiltrate your device with ransomware.
3. Update Your Antivirus
To defend yourself against the relentless ransomware, install a top-quality antivirus program. New ransomware variants are being released each month, so you have to keep your antivirus program up to date.
4. Be Cautious When Clicking Links
As you may already know, phishing scams are still the main avenue that hackers use to distribute the STOP virus. So, you should check your email sources before clicking on any link or attachment within those emails, even if they appear harmless.
5. Avoid Pirated Applications
While there are several legitimate marketplaces for PC software, third-party app stores have had the reputation of being hackers’ hotspots. So, when you are installing apps, it is better to stick with trusted sources like Apple App Store, Microsoft Store, or Google Play Store.
6. Keep Your Apps and Your Operating Systems Updated
Ransomware often exploits security vulnerabilities in your system, so we can’t stop stressing how important it is to keep your computer up to date. Be sure to keep it secure with regular patches and security updates.
7. Create Restore and Recovery Points
If you are a Windows user, create restore points using the System Restore functionality. In the event that the virus encrypts some of your files, you can revert to a previous working point.
8. Enforce a Robust Password Security
Statistics show that a regular computer user uses the same login credentials for multiple sites. What is even more worrying is that a third of them use a significantly weak password, which makes it even easier for hackers to penetrate. Sure, it is not always easy to remember several passwords for different accounts, but you can solve this problem by using a password management system.
9. Block Suspicious Email Addresses on Your Server
You can filter out suspicious emails by rejecting all the mails with executable attachments. You can also improve on this by setting your mail server to reject addresses from known spammers. Even if you don’t have a mail server in-house, your security service will more likely allow you to filter incoming mails.
You can even improve email security by adding virus control at the mail server level. Install an antivirus program on your email server to function as a safeguard.
10. Block Vulnerable Plug-Ins
Cybercriminals can use several plug-ins to get into your computer. The most common ones are Flash and Java because they are easy to attack and are standard in a majority of sites. For this reason, try updating them regularly. Alternatively, you can block them altogether.
Final Thoughts
Hopefully, our STOP Virus removal guide has helped you to restore your stolen files. Even after restoring your system, we recommend that you scan your system with a powerful anti-malware program. In most cases, you will not find malware leftovers, but it won’t hurt to double-check.
Additionally, we highly recommend that you prevent the ransomware from getting into your computer. So, remember to practice safe surfing, stay up to date, back up your files often, keep your antivirus active and up to date, and install applications from reliable sources.