The cybercriminals would claim that RGUY ransom-demanding virus has successfully encrypted all the files contained in the computer, inclusive of pictures, documents and every other data. Furthermore, since they made use of a very strong and unique encryption key, therefore the victim has no other choice than to comply with their ransom demand. Also included in the ransom notes would be two email addresses, namely: support@sysmail.ch and supportsys@airmail.cc which the victim is expected to reply them with, as well as the decryption service prices. They will state that the amount payable by the victim will depend on how soon they are able to comply. For instance, if the victim is able to pay within 3 days of being notified, he would be mandated to pay 50% of the ransom fee or $490 but once it exceeds the stipulated timeframe, only the full amount must be paid i.e. $980. However, if the victim decides to contact the cybercriminals, they would make it clear that payment can only be made through cyptocurrency, whereby they would buy the equivalent amount of the ransom fee in cryptocurrency and also make a transaction to a wallet address provided by them. The apparent reason why they use this payment platform is to remain elusive to law enforcement agencies. To show their expertise and also influence the victim, they may request that a small part of the encrypted files be sent to be them for test decryption, but will add a caveat that such part must contain any information that could be perceived as important to the victim. Nevertheless, our in-house cybersecurity decision-makers warn that victims should always follow the recommendations outlined by the FBI on matters relating to ransom payment, and it states that ransom SHOULD NOT BE PAID, no matter the pressure. Some of the reasons for such stand is listed below for your consideration:

There is no guarantee you will recover your files even after paying the ransom.By paying the ransom, you’re encouraging them to continue in their nefarious activities since they would find it profitable.More funds in their hands will only enable them to increase their capacity and continue being a threat to more people.

It is important to note that information-stealing Trojans like VIDAR and AZORULT are equally spread by the virus, and can be used in stealing vital personal information such as banking details, passwords, crypocurrency wallets, software account credentials etc. and these could lead to further problems like blackmailing. For those whose computers were infected with any of the STOP/DJVU variants, the first important step to take will be to remove RGUY ransomware virus without any delay. This can be done effectively by setting up the infected system in Safe Mode with Networking before running any reputable antivirus software on it. However, it is very important to make use of only antivirus brands that have been certified to be genuine and effective if you want to achieve optimal result. Based on that, we recommend INTEGO Antivirus. You can also download RESTORO which can be used to repair affected Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution methods to be wary of

The most common methods used by cybercriminals in spreading STOP/DJVU ransomware variants including RGUY virus is when unsuspecting users try to download software copies from online malicious torrent platforms. Cybercriminals usually embed malware on pirated software copies such as key generators and “cracks,” which they upload to such platforms in order to catch their victims. Several victims over the years became aware of virus infection on their computers after downloading particular pirated software contents, and the most common ones are listed below:

Adobe Photoshop;Internet Download Manager;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;VMware Workstation;Cubase;MatLab;Adobe Illustrator;League of Legends;Fifa 20;KMSPico (illegal Windows activation tool).

For those that usually visit such online torrents platforms, it would be in your best interest to stop doing so immediately. Aside from the fact that such download is illegal and a copyright infringement that is punishable by law, you’re also putting your computer and the files contained in it at serious risk. On the contrary, we recommend going to the official pages/platforms of the original software producers to obtain your software needs and also pay the requisite fees. Always have it in mind that whatever token you pay legitimately can never be compared to the outrageous ransom fees often demanded by cybercriminals. Another advantage is that you won’t be at risk of losing your important personal files. Another method used by cybercriminals in spreading malware is through malicious email attachments. In this method, cybercriminals would compose believable and ordinary looking messages that would be accompanied with attachments crafted on formats such as XLS, PDF or DOCX. They prefer using these particular ones because they enable macro functions and JavaScript which can be used in transporting and triggering payload in diverse computers. Finally, victims of STOP/DJVU ransomware are better off staying away from dubious websites that claim to offer decryption solutions. Such claims are largely false because only DiskTuna and Emsisoft have proven to be capable of decrypting STOP/DJVU encrypted files. Here is a link to where you can learn more about them.

Further details concerning the infection

For those that may want to know what exactly happened to their computer during RGUY ransomware attack, this section will explain more. The first thing the virus does is to fetch build.exe or build2.exe as well as winupdate.exe (the prompt that shows fake update screen) from rogue online domains. The virus then connects to https[:]//api.2ip.ua/geo.json and also saves the response in geo.json file. This file typically contains geolocation-related data such as location details (IP address, country, city and zip code), time zone, latitude and longitude, and more. The image below shows samples of some geo.json files. It will also drop another file that will contain installed software list, hardware details and active processes in information.txt. Furthermore, the virus will make a comparison using the extracted country code against a list of encryption-exempted countries formed by them. The countries are Russia, Ukraine, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Uzbekistan and Belarus. In situations whereby the computer is located in any of the aforementioned countries, they would immediately abort their mission.However, if it scales the geolocation test, the ransomware would fetch online encryption key from their server and would merge it with the victim’s ID before saving it in the bowsakkdestx.txt file and to the PersonalID.txt file. Shown below is example of these files. However, if the virus fails to extract any online encryption key from their server, it will make use of a hardcoded offline key as an alternative. The difference between the two is that online ID is unique per victim and extremely difficult to decrypt while offline ID is uniform for all victims of the same variant and there is a high chance it can be decrypted. The presence of t1 characters appearing at the end of a personal ID is an indication that offline ID was used and thus improves the likelihood of decrypting .rguy files. More information about it is provided below. At this point, the ransomware will commence full data encryption procedure by scanning every folder and encrypting them with Salsa20 before using RSA-2048 key to lock the encryption key. While this is still ongoing, more files will be marked with additional extensions. You can check below for image of _readme.txt note that is usually left in all the folders. To round up the entire process, the virus will add a number of domains to the Windows HOSTS file and also map them to the localhost IP which effectively prevents the victim from having access to them. Any attempt to browse them will bring up DNS_PROBE_FINISHED_NXDOMAIN error message. The reason for blacklisting them is to ensure the victim doesn’t get any help online.

Remove RGUY Ransomware Virus and Restore Your Files

Victims are supposed to remove RGUY ransomware virus without delay once they’re sure of their presence. Like we stated earlier, the recommended way to do so is by setting up the infected system in Safe Mode with Networking before applying a good antivirus such as INTEGO Antivirus. You should also consider downloading RESTORO to help in identifying and repairing Windows system files. Now that RGUY ransomware virus removal is complete, the following steps should be taken:

It is very important to report to relevant government agencies responsible for handling such issues.Make use of any available data backup drives to restore lost files.Learn possible ways files locked by STOP/DJVU ransomware variants could be repaired or decrypted.Immediately change all passwords that were used in the compromised computer.

In conclusion, always remember that taking proactive measures in order to avoid getting your computer system infected is always the best course of action to take. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove RGUY Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove RGUY Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt RGUY files

Fix and open large RGUY files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. RGUY Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt RGUY files, follow the given tutorial.

Meanings of decryptor’s messages

The RGUY decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your RGUY extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of RGUY Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.