Decryption costs $490 when you contact them within 72 hours;Decryption costs $980 when you contact them after 72 hours;The payment can only be made through cryptocurrency such as Bitcoin (this is apparently to protect their identity). 

A new contact email address (supporthelp@airmail.cc) will be provided and such is not available in previous STOP/DJVU versions as well as the regular one i.e. manager@mailtemp.ch.  Apparently, IRJG ransomware virus is basically aimed at extorting computer users by aggressively taking their files hostage with intent to earn ransom. The algorithm of this ransomware virus is programmed to encrypt just the initial 150 KB of every file (a factor that makes the process fast) yet powerful enough to shut out the genuine owner from having access to their file. The algorithm pattern used in the encryption process is reputed to be advanced and works by blocking access to information at both ends so that only those that have the decryption key would be able to view it. The helpless victims would be forced to pay for the key as well as the decryption software at a price that would be determined by the cybercriminals. However, for files that were hitherto encrypted, there are ways one can take that will help to restore the files, or at the very least restore a part of it. The first option will be to make use of data backup i.e. if one was created ab initio. Please note that it is mandatory to remove the ransomware from the computer before trying this.  You can equally leverage the guide provided below and follow the steps that will lead you to successfully decrypt or repair the files as the case may be. For file repair, you can make use of Media Repair by DiskTuna to restore particular file formats. Here is the link to it how to do it how to do it here. They also emphasize that complete decryption costs $980 but if the victim is fast enough to comply within 72 hours, they will be liable to a 50% discount thus effectively bringing the cost $490. If/when the victim contacts them through the email they provided, they will respond by forwarding details about how the victim could buy cryptocurrency that will correspond to the amount they are supposed to pay and of course the wallet address they should send it to. The obvious reason why they avoid bank transactions is simply to avoid being traced and arrested. High level cybersecurity experts from Geek strongly advices against paying ransom to cybercriminals. Other top law enforcement agencies like FBI also belong to this school of thought. Below are some of the basic reasons why you should refrain from paying ransom to cybercriminals: 

There is no guarantee you will either partially or completely recover all your data. Also, there is a high chance that the cybercriminals may disappear into thin air the moment they receive the ransom. Paying ransom to cybercriminals encourages them to continue attacking other victims and equally lures others to join the criminal activity even when they have limited technical knowledge. Reliable statistics shows that cybercriminals extort millions of US Dollars from victims annually. So, in essence, if people refrain from paying such ransom, those behind it would have no incentive to continue. Other STOP/DJVU virus variants like IRJG are known to release additional virus on the system, a good example is AZORULTTrojan. This malware could extract sensitive data from the system which the cybercriminals may exploit to do further damage.

REPAIR VIRUS DAMAGE How this ransomware operates on victim’s computer Basically, IRJG ransomware virus is able to invade a computer system when a user unwittingly downloads a malicious torrent file or more specifically, a software crack. It will then escalate by opening many build.exe executables such as build2.exe and build3.exe as it prepares for full scale takeover. In addition to that, the ransomware extracts certain data from the system such as computer name, user name, OS version, hardware details, keyboard language, processor and software etc and stores them in information.txt file. It also connects to “https[:]//api.2ip.ua/geo.json” which enables it to extract vital information such as IP address, country code, city, longitude, latitude, zip code and also the time zone where the victim is located. The virus traces the country code with others from a profiled list and once it corresponds, they will truncate its functions.  Next will be to figure out if there is internet connection, and if there is, it connects to the Command and Control server and extracts unique online encryption key that would be reserved for the victim in bowsakkdestx.txt file within the computer. Furthermore, it will allocate a peculiar ID to the victim and equally saves it in the bowsakkdestx.txt as well as PersonalID.txt file. Peradventure the virus fails to access its C&C server; it will make use of a hardcoded encryption key that works offline. The easiest way to decode if an offline encryption key was used is to look out for the t1 characters which will appear after the victim’s personal ID. The IRJG ransomware then saves the victim’s ID string as well as public encryption key within the computer for future use.  Now it has formulated the encryption key, it will begin the data encryption stage. Already, it has been programmed to target specific file extensions while ignoring some others in order to ensure the operating system continues to function. At this point, the ransomware blocks access to files, configures them with more extensions and then drops ransom notes on any directory the victim visits.  Simultaneously, the virus will display winupdate.exe, a fake prompt disguised as genuine Windows update, aimed at making the victim to assume that the sudden slowdown was as a result of the system updates.  Such malicious programs enable the Volume Shadow Copies to be evacuated from the computer through a process known as Command Line Task: vssadmin.exe Delete Shadows /All /Quiet The reason is to make it impossible for the victim to use System Restore points to salvage some of the data. Certain STOP/DJVU versions have the ability to modify Windows HOSTS database by inputting several domains to block the victim. The virus then aggregates them to a localhost IP which would lead to a DNS problem. As a result, whenever the victim makes attempt to access any of the blocked domains, whether directly or through search engine results, what they will see is a DNS PROBE FINISHED NXDOMAIN error message. It has been observed that the malware equally blocks other cybersecurity as well as the system’s help related pages such as microsoft.com among others. After considering what their motive could be, we arrived at the conclusion that the cybercriminals are intent on stopping their victims from getting help online or finding beneficial recommendations that will aid them in their approach to responding or reporting the situation.      The last but probably the worst thing the IRJG ransomware does is to drop the AZORULT, a notorious information extractor that will not only steal vital information from your system but also grants the cybercriminals continued remote access to your system, thus enabling them to engage in the following activities:    

Upload certain types of computer malware and also run themView or delete information on the victim’s computer Steal important details such as cryptocurrency wallets/passwords and carting away its contentsObtain login details of confidential files such as Telegram and Steam among others, and may either use them to exploit the victim or send them to other criminals 

To avoid colossal damage or losses, individuals are advised to immediately take steps and get rid of such malicious viruses as soon as they can. To effectively remove IRJG ransomware from your computer, we strongly advise that professional and reliable security software should be used. This is to ensure that such viruses are not only completely removed but to also prevent such cyber-attacks from reoccurring in the future. Based on this, we recommend the use of INTEGO Antivirus, a VB100 certified software. Similarly, you can also download RESTORO and use it repair any damage caused by virus on your operating system files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Distribution of ransomware-type viruses

In order to be proactive and prevent any form of ransomware attacks from occurring, it is crucial to understand the processes and how the cybercriminals operate. The most common methods they apply include exploit kits, malicious emails with links and attachments, malicious torrents downloads, as well as web attacks. The most common way through which they spread STOP/DJVU malwares like IRJG ransomware virus is when individuals try to access malicious torrent downloads. An overwhelming majority of victims that reached out to us all stated that they downloaded it alongside software cracks that were supposed to work on certain commonly used softwares as listed below: 

Adobe Photoshop;Corel Draw;Tenorshare 4ukey;League of Legends;Cubase;Adobe Illustrator;Windows activation tools such as KMSPico.

Oftentimes, those that fall victim to cybercriminals are individuals that try to obtain paid software versions at no cost, by making use of peer-to-peer file sharing formats. Unfortunately for them, such programs do not have the capacity to effectively scan and detect malwares. Worse still, this segment of software users usually ignore warnings from their cybersecurity during such downloads. Also, many users assume that any cracked file that is downloaded from the internet would always trigger a red flag regardless of their risk level. Even though this could be true sometimes, but it is still dangerous to ignore such alerts. On the other hand, there are still chances that your system could become infected during such downloads without triggering any alert. Such occurrence is commonplace when one is using Trojan, cryptocurrency mining software, or any other ransomware that has idle mode option.  We advise individuals that desire to make use of the premium software version to visit the official website page of the developer and obtain a genuine copy from them. Aside the risks inherent in bypassing legitimate process, it is equally wrong to encourage greedy criminals that feed off other people’s efforts. Also bear in mind that whatever you pay for a genuine software is insignificant relative to what it will cost you when you eventually become a victim to cybercriminals.   Cybercriminals generally send out malicious email messages with attachments and links to lots of potential victims. They extract random email addresses from diverse databases including those that leak in the dark web. Sometimes, they could appear as if they emanated from reputable companies, friends, family or acquaintances. However, they often nudge the potential victim to go through the documents and attachments, and reply ASAP. Also note that such attachments are usually given names that make them appear authentic such as invoice, parcel tracking details, order summary, payment details, waybills etc. They can even go as far as to spoof the sender’s email address to deceive their target victims.   Cybercriminals have become more sophisticated in recent times, and it is now even more difficult to decipher scam emails from genuine ones. However, we strongly advise individuals to refrain from opening such attachments or links if they weren’t expecting them in the first place. Don’t allow your curiosity to get you into trouble. Furthermore, if you have second thoughts that something is out of place with the email, like a strange style of writing, grammatical errors, poor looking/unprofessional logos, weird/ridiculous opening salutation, or if it tries to influence you to click on any attachments or links.  Before we wrap it up, the final malware we would like to bring to your notice is the fake STOP/DJVU decryption tools. It is really important for you to know about this notorious virus that disguises as a decryption tool. The good thing is that these rogue tools are already well known, at least popular cybersecurity news platforms, antivirus producers’ reports and similar legitimate sites often discuss about them and also create awareness on why they should be avoided. So we advise you stay away from any illegitimate website or platform that provide such downloadable links. It is interesting to note that cybersecurity experts have already warned that ZORAB ransomware agents are now spreading their own virus through fake STOP/DJVU decryption tools they make available to the unsuspecting public. Any attempt to use such tool could result in further encryption of your files, thereby jeopardising your chances of recovering them.

Remove IRJG Ransomware Virus and Decrypt Your Files

If unfortunately you fall victim to ransomware attack, the best thing you should do is to immediately eliminate it from your computer ASAP. Our in-house experts recommend the use of INTEGO Antivirus —a very reliable antivirus software that equally has real-time protection. Below is the easy DIY guide that would assist you in a step-by-step way, through Safe Mode with Networking, to safely remove IRJG ransomware virus. Also, you can download RESTORO and use it to repair any damage the virus may have caused on your files/operating system.  Once you complete the process of removing the IRJG ransomware virus, kindly follow the tips listed below. It is a guide that would help you to stay on course and also avoid any challenges going forward:

Brief the local authorities about the situation. You can leverage some of the references contained in this guide while reporting the cybercrime. Use any backup source to restore your files as much as you can.Here is a link that will help you to decrypt or repair files affected by STOP/DJVU versions.We advise that you change your passwords to avoid any future data breach.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove IRJG Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove IRJG Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt IRJG files

Fix and open large IRJG files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. IRJG Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt IRJG files, follow the given tutorial.

Meanings of decryptor’s messages

The IRJG decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your IRJG extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of IRJG Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.