The sole aim of QQQW ransomware is to put encryption algorithms for bad use and extortion of the computer user – therefore, it uses a combination of Salsa20 and RSA-2048 to encrypt all victim’s files. Locked with such secure technology, these files can no longer be accessed. In order to open them, a private decryption key is required, however, it is held by the ransomware operators in their servers. As explained in the ransom note, the victim can purchase it for a specified price. For further instructions, the _readme.txt file suggests writing to the criminals via support@sysmail.ch or helpsupportmanager@airmail.cc email. The ransom note also briefly mentions that the virus has modified all data formats, including pictures, databases, documents, videos, archives and other files stored on the computer. The note also insists that the victim must contact the criminals as soon as possible as this fates whether the victim gets a 50% discount on the decryption tool or not. As the ransom note suggests, the victim is eligible for the discount if one writes to the provided emails within 72 hours (3 days) after the initial infection timestamp. This would set the decryption price to $490; otherwise, the victim is asked to pay full price, which is $980. Of course, the attackers won’t accept any form of direct payment and demand paying the ransom via cryptocurrency to avoid getting tracked down. The ransom note also suggests attaching one small encrypted file to the email. They promise to reply with a decrypted file version to encourage the computer user to pay up. However, this should not incite you to pay – according to cybersecurity experts and FBI, paying a ransom to cybercriminals doesn’t guarantee data recovery. Moreover, the whole idea of sending your money to scammers is wrongful because doing so simply helps the attackers to initiate more attacks, more malware development and recruit more team members. Worse still, this ransomware is known to compromise already-infected systems with information-stealing Trojans such as VIDAR or AZORULT. These Trojans are capable of stealing your cryptocurrency wallets, account login credentials, browser-saved passwords and other sensitive information associated with your computer. Such information can be later used to blackmail you and swindle even more money from you. Cybersecurity experts strongly recommend you to REFUSE TO PAY THE RANSOM. If you have unknowingly downloaded this malware to your computer, the best thing to do now is take action to cleanse your computer system from all threats. To remove QQQW ransomware virus, we recommend booting your PC in Safe Mode with Networking as explained below the article. Then, run a full system scan with an up-to-date antivirus software. If you do not have one yet, or in case you’re dissatisfied with the one you have, our team recommend using INTEGO Antivirus. You can read its review here. Additionally, you may want to download RESTORO and check if any virus damage can be repaired.

Ransomware Summary

REPAIR VIRUS DAMAGE

How ransomware-type viruses are distributed

Ransomware operators who are responsible for distribution of STOP/DJVU variants such as QQQW virus tend to hide the payload in fake pirated software versions. These can be downloaded directly from scam websites in a form of RAR or ZIP archives, or via torrents. Cybercriminals prey on computer users who are willing to install illegal software copies in order to bypass license fees; these computer users are easy targets as they often choose to ignore their security software warnings as well. Some of computer users infected with the said ransomware strain versions report downloading fake software activation tools (such as cracks or keygens) for these popular programs and as a result, got all of their files encrypted:

VMware Workstation;Tenorshare 4ukey;Adobe Photoshop;Cubase;Opera browser;Corel Draw;Fifa 20;AutoCad;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

Remember that illegal software versions provided by various rogue sites online often do not even contain the software you’re looking for – they are used as a bait to trick you into downloading malicious files. Moreover, by searching and downloading such copyright-protected content via unofficial sources, you infringe copyrights of legitimate software vendors, which is illegal by law. Remember that a legitimate software license almost always costs less than large ransom amounts demanded by the criminals. Make the right choice and look for software versions provided by their official developers or confirmed partner websites. Moreover, ransomware operators have a tendency to spread their creations via malicious email attachments. For this reason, they craft up convincing email messages, often pretending to be someone they’re not – such as representatives of well-known companies, victim’s colleagues, or even government agencies. The email typically insists that the target must open attached file (which may be named as invoice, order summary, or another casual document). Unfortunately, after opening such file, the victim gets infected with the ransomware. Therefore, you should inspect every email you receive carefully and ask yourself questions such as “Was I expecting this message?,” “Does this email looks trustworthy?,” “Did I actually order anything from the said company?” or “Did I have any business with this sender lately?”. Even if the sender’s address seems legitimate, you should check whether it was spoofed. In general, we advise avoiding interactions with email attachments or included links if you feel at least slightly suspicious about it, or believe that you weren’t supposed to receive it at the given time at all. Finally, we want to warn computer users turned into ransomware victims not to search for decryption tools with hassle – only rely on legitimate and reputable cybersecurity-related websites or blogs of official antivirus vendors, because if you start browsing rogue online sites offering 100% working decryption tools, you might end up with additional malware on your computer. For example, ransomware strain known as ZORAB used to be distributed in a form of fake STOP/DJVU decryption tool.

Ransomware modus operandi – what happened during the computer attack

QQQW ransomware virus was for sure created by advanced malware developers, and so its modus operandi shows it. In this section, we will explain the basic functionalities of it, and what it does during the attack. This variant of STOP/DJVU malware and its algorithm is consistent with the previous versions originating from the same ransomware strain. It begins the attack in a form of executable that is typically named with 4 random characters, for instance, 5B7N.exe. The ransomware then downloads several additional executables, usually named as build.exe and build2.exe or build3.exe and equally displays a fake Windows update prompt for the victim (winupdate.exe process). The ransomware connects to https[:]//api.2ip.ua/geo.json and saves fetched response into geo.json file. This file contains information about the compromised computer’s location, including its country code, country name, region, time zone, longitude and latitude and more. You can see an example of this file in the image below. At the same time, the ransomware creates information.txt file (depicted below). This file summarises victim’s computer’s details, such as user name, computer name, operating system, screen resolution, timestamp, and other data such as hardware specifics, installed software names and the list of active processes. An example of this file is provided below. The virus also takes a screenshot of victim’s desktop and sends collected data to its Command&Control server. What is interesting is that this ransomware ceases its operations if it detects that the compromised computer is based in one of the following countries: Russia, Tajikistan, Syria, Belarus, Ukraine, Uzbekistan, Armenia, Kazachstan, and Kyrgyzstan. Otherwise, it continues its operations and begins preparation for data encryption. The ransomware attempts to connect to its Command&Control server with request for a unique encryption key and victim’s ID. If it fails to obtain an online encryption key, it decodes one hidden in itself (also known as offline encryption key) and uses it instead. An indicator of offline encryption type is t1 characters at the end of PersonalID.txt file; this file is used to store victim’s unique ID, while the encryption key along with Personal ID will be stored into bowsakkdestx.txt file. You can see examples of these files in the screenshot provided below. You must also know that victim’s of offline encryption can hope to decrypt .qqqw files in the future; for more details, see the explanation below this article or in this guide. The ransomware then begins scanning the infected computer, visiting each folder and encrypting files found in them. The virus encrypts files with Salsa20 algorithm before additionally securing the procedure with RSA-2048 key. During this procedure, the virus marks each file with additional extension. You can see a screenshot of affected data folder below. The virus also equally drops _readme.txt note in every visited data folder. The virus also demonstrates common ransomware behaviour as it deletes Volume Shadow Copies using Command Prompt task as shown below: vssadmin.exe Delete Shadows /All /Quiet The ransomware also modifies Windows HOSTS File by adding a list of restricted websites that will be mapped to localhost IP. Once this is finished, the victim won’t be able to access any of the deny-listed domains. When trying to visit one of these domains, web browser will likely display DNS_PROBE_FINISHED_NXDOMAIN error notification.

Remove QQQW Ransomware Virus and Recover Your Files

Computer users who have fallen victims to this malware variant must not delay its removal any longer. To remove QQQW ransomware virus, we recommend booting your Windows PC in Safe Mode with Networking (see the guide provided below) and running your antivirus solution from there. In case you do not have AV protection, consider using one recommended by our team – INTEGO Antivirus. This AV has excellent malware detection rate and provides real-time protection against computer threats. For additional computer cleanse and repairing virus-damaged Windows OS files, consider an option to download RESTORO. Additional recommendations following QQQW ransomware removal are listed below.

Contact the nearest law enforcement agency mandated to handle cybersecurity-related incidents;Use data backups to restore encrypted files. Make sure you only connect your external data storage device AFTER ransomware removal;Read about possible ways to repair/decrypt files damaged by STOP/DJVU variants.Replace all your passwords that were used on the compromised computer.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove QQQW Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove QQQW Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt QQQW files

Fix and open large QQQW files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. QQQW Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt QQQW files, follow the given tutorial.

Meanings of decryptor’s messages

The QQQW decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your QQQW extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of QQQW Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.