They would further claim that IIPS ransomware virus has succeeded in encrypting (to make unreadable) all files contained in the compromised computer. Therefore, it was necessary for them to comply by paying the ransom being demanded since that’s the only way they would be able to retrieve their files. To establish a channel of communication, the cybercriminals will equally include two email addresses namely: support@sysmail.ch and helprestoremanager@airmail.cc. In addition to that, they will also notify the victim about conditions and terms of payment. For instance, they will state that payment must be made before 3 days/72 hours elapses if the victim desires to pay only 50% of the ransom fee. Therefore, instead of paying $980, they would now have to pay $490, but failing to do so within the ‘grace period’ means that only the maximum ransom fee would be acceptable. It becomes more complicated if/when the victim contacts the cybercriminals via any of the emails. They will direct the victim to buy cryptocurrency worth of the ransom fee and transfer same to wallet address they will provide. They take such measures because any other medium of payment is fraught with danger since law enforcement agencies could trail such channels to get them arrested unlike cryptocurrency that offers anonymity. In their desperation to influence the victim to believe there files would be decrypted by them after making payment, they often request for parts of the encrypted files to be sent to them for test decryption but would be quick to warn that such excerpt must not contain any information that could be deemed as vital to the victim. Regardless of how important the encrypted files may be to the victim or the pressure the cybercriminals put on them, our cybersecurity experts advise that ransom demands should not be honored. This position is also shared by the FBI in their guidelines about ransom payments. The reason for such strict stance is due to the following factors:

Paying ransom does not guarantee recovery of encrypted files.The more money cybercriminals receive, the more emboldened they become in perpetrating such criminal acts since they would find it profitable.More funds at the disposal of cybercriminals would enable them to employ more rogue IT personnel thereby increasing their capacity to inflict more harm to a greater number of people.Paying ransom might be considered illegal by law in your country.

This virus is also capable of spreading other Trojans like AZORULT and VIDAR that are notorious for stealing sensitive information such as software account login details, cryptocurrency wallet’s ID/password, banking information, browsing history and computer-saved passwords etc. Once they have access to those aforementioned details, it gives them an opportunity to perpetrate more crimes that could include stealing and blackmails. For those that are unfortunate to have fallen victim to any of the STOP/DJVU ransomware variants including the one under review, you’re hereby advised to remove IIPS ransomware virus from your PC ASAP. The recommended way to go about it is to boot your PC using the Safe Mode with Networking option before running any reliable antivirus on it. This method will ensure that the malware is completely removed from your system. If you’re not sure of any strong antivirus to use, then we strongly recommend INTEGO Antivirus because it has proven to be nearly 100% effective and efficient. You can also download RESTORO to repair and restore damaged Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution methods frequently used by cybercriminals

Downloading malicious torrents is the most common way through STOP/DJVU ransomware variants, including IIPS virus are spread. Cybercriminals exploit some internet users’ penchant for visiting online torrents, by attaching virus to such pirated software copies. They would remain dormant/in hibernation mode until they become triggered by unsuspecting users who download them. There have been diverse reports of ransomware attack following the downloading of certain software contents gotten from online torrents. The most common pirated software copies used for spreading malware are listed below for awareness purposes:

League of Legends;Corel Draw;Tenorshare 4ukey;AutoCad;Opera browser;Fifa 20;VMware Workstation;Cubase;Adobe Illustrator;Adobe Photoshop;Internet Download Manager;KMSPico (illegal Windows activation tool).

At this point, it has become clear that those visiting online torrents are taking unnecessary risk and should stop doing so right away. Cybercriminals are motivated by their greed to extort money from unsuspecting software content users. Therefore, instead of visiting online torrents platforms to obtain so-called “cracks”, key generators, or have access to paid game versions at no cost, you should source for them through the appropriate channels, even if you’re required to pay for them. At least, you won’t be at risk of losing vital files or sensitive information and neither would cybercriminals be able to extort you. Moreover, downloading copyrighted software contents illegally from online torrent platforms is considered a criminal offense and is punishable by law. Another distribution method often used by cybercriminals is through malicious email attachments. In this case, cybercriminals would create ordinary looking emails to deceive their target victims into believing they were sent by loved ones, acquaintances or popular corporate brands. They will attach documents formatted on DOCX, XLS, PDF or similar ones that enable macro functions or JavaScript which can be used to download payload from external sources and trigger them on random computers. Lastly, becoming a victim of STOP/DJVU is not the end of the road or enough reason to throw caution to the wind and start seeking for help from suspicious sites offering dubious decryption services. Most of these sites are scam. They disguise as decryption service providers but their real intention is to spread other variants of ransomware disguised as fake decryptors. Only DiskTuna and Emsisoft have proven to a substantial extent of having the expertise to decrypt files. Downloading fake decryptors can cause double file encryption.

More details concerning the infection

This part discusses the technical aspects of ransomware attack and how it manipulates your computer, especially in the wake of IIPS ransomware attack. The first thing malware does after a successful invasion is to launch its algorithm is to download additional build.exe or build2.exe executables coupled with winupdate.exe (this is what displays fake Windows screen). Once it completes that task, it will make a connection with https[:]//api.2ip.ua/geo.json before sending the result to geo.json file. The malware then begins information gathering of every detail concerning the computer under attack and stores all geolocation related information, this will include; zip code, geolocation, time zone, latitude and longitude. Below is an image showing geo.json file. After that, it will create another file for installed software list, hardware details and forwards them to information.txt. By making use of the geolocation information, it will profile it against their list of encryption-exempted countries, listed as; Ukraine, Belarus, Russia, Syria, Armenia, Tajikistan, Kazachstan, Kyrgyzstan and Uzbekistan. If by any chance it reads positive to any of the listed countries, it will abort any further attempts and reverse itself. However, if on the other hand it is negative, the malware will extract online encryption key from their database and will combine it with the victim’s ID before saving them in bowsakkdestx.txt file and to PersonalID.txt file. Examples of these files are shown in the image below. In situations whereby the malware wasn’t able to extract any online encryption key (this happens sometimes), it will decide to use an offline key as alternative. The striking difference both forms of ID is that while online key is unique per victim, offline encryption key is uniform for all victims subject to offline encryption. The appearance of t1 characters after the personal ID is an indication that offline ID was used. The implication is that such victim can reasonably hope to decrypt .iips files going forward unlike online ID that is far more difficult to decrypt. More information about this is provided in this article. At this stage, the ransomware will commence full data encryption process by scanning every folder and encrypting the files with Salsa20 before using RSA-2048 encryption key to lock it. While this is ongoing, the virus will mark each file with more extensions. Shown in the screenshot below is _readme.txt ransom note the malware leaves behind following an infiltration. The virus will now delete Volume Shadow Copies using the command prompt shown here: vssadmin.exe Delete Shadows /All /Quiet More domains will be added to Windows HOSTS file to prevent access to them. When the victim tries to open any of the blacklisted sites, DNS_PROBE_FINISHED_NXDOMAIN error message might come up.

Remove IIPS Ransomware Virus and Decrypt Your Files

Victims of ransomware attack should remove IIPS ransomware virus ASAP. Once it is finished, the following tasks should be done.

Report the incident to appropriate authorities in your country.Restore your lost data using any available backup means.Learn possible ways to repair STOP/DJVU-affected files.Change all passwords directly or remotely used on the computer.Consider downloading RESTORO (download link) to identify and repair virus damage on Windows operating system files.

In summary, consider using a security software recommended by our experts – INTEGO Antivirus unless you already have an antivirus that is just as capable when removing a malware. However, as we always advise, prevention is better than cure; therefore do not engage in cyber activities that could put your computer and privacy at risk. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove IIPS Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove IIPS Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt IIPS files

Fix and open large IIPS files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. IIPS Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt IIPS files, follow the given tutorial.

Meanings of decryptor’s messages

The IIPS decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your IIPS extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of IIPS Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.