They will further claim that CUAG ransomware virus has seized control of the victim’s entire database as contained in the computer and also made use of a powerful encryption key to lock it, based on that, if the victim hopes to ever retrieve the encrypted files, they must have to pay certain fees as ransom to those behind the attack. To facilitate the payment process, two email addresses (support@sysmail.ch and helpsupportmanager@airmail.cc) will also be dropped so the victim will be able to communicate with them. Other pieces of information that are contained in the ransom notes include their so-called decryption service prices as well as terms and conditions of payment. The cybercriminals will emphasize that payment should be made ASAP and to encourage that, they will state that complying within 72 hours/3 days would earn the victim 50% discount. In other words, instead of having to pay the full ransom fee of $980, they would now pay $490, but once the “grace period” elapses, only full payment would be acceptable. However, the moment their victim reaches out to them with intent to pay, they would emphasize that only payments made with cryptocurrency would be acceptable to them. Thus they would forward a wallet address to the victim and instruct them to pay the equivalence of the ransom fee into it. The apparent reason why they usually opt for this channel of payment is because of the anonymity it provides, unlike other means of payment that could be easily traced to them by law enforcement agents. The cybercriminals sometimes request for excerpts of the encrypted files from their victims for them to decrypt as a way of proving their capability to restore the entire files once payment is made but will be quick to warn that such excerpts must not contain information that would be perceived as vital. Whatever be the case, our cybersecurity experts have a standard policy that victims SHOULD NOT PAY RANSOM, and this recommendation is similar to the FBI’s guidelines concerning cybercrimes/ransom payment. Victims should understand that paying ransom to cybercriminals does not guarantee file recovery. Also, paying such huge amounts of money to cyber criminals would only encourage them to expand their rogue operations and victimise more people. There are other information-stealing Trojans computer users should be wary of, they include VIDAR and AZORULT, and they are often spread disguised as decryptors. They are notorious for covertly stealing sensitive data such as software login details, banking details, saved passwords, cryptocurrency wallets, browsing history, etc. Remember that such sensitive information in the wrong hands can lead to blackmail and other criminal activities. Victims of STOP/DJVU are hereby advised to remove CUAG ransomware virus from their infected computer without further delay. They can get this done by setting up their computer in Safe Mode with Networking option before activating any good antivirus to detect and safely remove every trace of malware that could be found in the compromised computer. You can always make use of any antivirus you fancy, but it is essential to ensure it is strong enough. However, our experts recommend INTEGO Antivirus because they’ve certified it to be an excellent computer protection software. In addition, you can also download RESTORO to aid in repairing Windows OS files damaged by the virus.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques you should beware of

From a general perspective, computer systems are often infected by STOP/DJVU ransomware versions such as CUAG virus after its user downloads malicious software contents from online torrents. Cybercriminals make use of such online torrents platforms as a hideout where they upload malware-laden pirated software copies. When users download such contents in the form of “cracks” or key generators, they unwittingly trigger ransomware attack. Over time, lots of victims have reported a diverse array of software contents as often used by the cybercriminals. They include illegal activation tools, “cracks”, famous but pirated software games and utilities etc. Some of the most common ones uploaded on online torrents platforms are listed below:

Cubase;Corel Draw;Tenorshare 4ukey;AutoCad;Opera browser;Fifa 20;VMware Workstation;Adobe Photoshop;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

For those that purposely or ignorantly visit such dangerous online torrents platforms, it is high you totally desist from such risky behavior. You could become a victim of ransomware attack any moment you’re on such platforms, aside that, it is also considered as a criminal offence and such person could be prosecuted under the existing copyright infringement laws. Therefore, instead of engaging in such unethical practices fraught with danger, it is a lot better to get such software contents from the legitimate/authorized platforms, and by so doing, you will be helping the IT industry to grow. Moreover, you won’t be at risk of losing critical data or being asked to pay outrageous fees as ransom. In their desperation to deceive their target victims, they would also attach files with compelling names such as Order Summary, Invoice or Tracking Details among similar ones. Sometimes, they opt for the use of email spoofing techniques to obfuscate their real address. Whichever one they chose, you’re advised to apply desecration when opening emails, especially the ones you weren’t expecting. If you have any doubt concerning any email that pops up in your inbox, you consider it a a red flag and thread carefully. Many computer users tend to throw caution to the wind when they fall victim to STOP/DJVU ransomware variants and wouldn’t mind seeking for solutions even from suspicious websites. This is a wrong approach to take because such sites hardly provide any actual help. Worse still, they’re owned by crooks seeking to further scam you. Some of them equally spread other versions of ransomware like ZORAB disguised as so-called STOP/DJVU decryptor and downloading them can lead to double-file encryption.

More information concerning the malware

This section talks about the technical aspect of what transpires during CUAG ransomware attack. The first thing the malware does is to launch what is known as build.exe or build2.exe executables which would be accompanied by winupdate.exe (the prompt that triggers fake Windows update screen). It then makes a connection with https[:]//api.2ip.ua/geo.json and forwards the outcome to geo.json file. The malware then gathers information about your computer such as its geolocation, latitude and longitude, time zone, and zip code. It will also create another file that will contain hardware details, installed software list and forwards them to information.txt. The image below shows some typical examples of geo.json file. See an example of information.txt file below. With the details it obtained above, the malware will profile the country code against a list containing some Eastern European and Middle East countries which they designated as encryption-protected nations. They are Russia, Ukraine, Uzbekistan, Syria, Kyrgyzstan, Belarus, Kazachstan, Tajikistan and Armenia. If the malware detects that the computer is domiciled in any of the countries, it will instantly abort its operation. But if otherwise, it will move to the next stage where it will obtain online encryption key from their server and combines it with the victim’s ID before sending them to bowsakkdestx.txt file and to PersonalID.txt file. Shown in the diagram below are examples of these files. In a situation where the virus couldn’t extract any online encryption ID, it will opt for the use of an offline encryption ID. The difference between the two ID’s is that online ID is unique for each victim while offline ID is uniform for all victims of the same virus variant. What shows whether an offline key was used is the presence of t1 characters appearing at the end of the victim’s personal ID. The implication is that such .cuag encrypted files could be decrypted going forward. More details about is provided below. Afterwards, the ransomware would begin full data encryption by scanning the folders and encrypting the files with Salsa20. It will then lock it using RSA-2048 encryption key. Meanwhile, it will simultaneously mark the files with more extensions. Here is a screenshot of _readme.txt ransom note that is left in all folders. The next thing the virus does is to delete Volume Shadow Copies using the Command Prompt task displayed here: vssadmin.exe Delete Shadows /All /Quiet To complete the entire process, the virus would add some blacklisted domains to the Windows HOSTS file and attaches them to the localhost IP, thus preventing access to the blacklisted websites. Whenever the victim tries to gain access to the websites, DNS_PROBE_FINISHED_NXDOMAIN error will pop up. The criminals usually do this to prevent the victim from getting help online.

Remove CUAG Ransomware Virus and Recover Your Files

As stated earlier, victims of ransomware should not pay ransom to cybercriminals but instead follow the steps outlined below in order to effectively remove CUAG ransomware and prevent any further damage/losses. Steps to take after CUAG ransomware virus removal:

Use any available backup device to restore lost data;Report to the nearest local law enforcement agent and inform them accordingly;Change all passwords associated with the compromised computer;Learn possible ways STOP/DJVU variants could be decrypted.

The guide provided below will assist you when using Safe Mode with Networking option to your computer. Once it is set up using this option, it becomes easier for the antivirus to function at its optimal capacity. However, it is also essential to make use of only tested and trusted antivirus software such as INTEGO Antivirus in order to achieve great results and ensure complete computer protection. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove CUAG Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove CUAG Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt CUAG files

Fix and open large CUAG files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. CUAG Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt CUAG files, follow the given tutorial.

Meanings of decryptor’s messages

The CUAG decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your CUAG extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of CUAG Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.