The message will notify the victim that STAX ransomware virus has encrypted all vital data inclusive of pictures, documents, and databases etc. Therefore, since they used very strong encryption key, there is no way the victim can have access to them again unless they pay ransom. The cybercriminals also drops two email addresses for the victim to contact them with: manager@mailtemp.ch and helprestoremanager@airmail.cc. Furthermore, the cybercriminals also specifies the ransom fee and the conditions attached to it. If the victim can pay within 72 hours i.e. 3 days, they will slash the ransom by 50%, which brings it down to $490 but once 72 hours elapses, the victim would have to pay the full ransom fee of $980.    If the victim reaches out to them, the cybercriminals will impress it on the victim that they will never be able to retrieve their vital data unless they pay the equivalent of the ransom fee in cryptocurrency. They would also make available a wallet address for the payment. The basic reason for using cryptocurrency channel is to cover their tracks and protect their identity so that law enforcement agencies won’t be able to trace them. In order to convince the victim of their capability to restore the encrypted files, they may ask the victim to send any random file from the encrypted ones so they could provide a decryption sample. But they will also emphasize that the encrypted file portion must not contain vital information. Our in-house cybersecurity experts generally advice victims to follow FBI’s guidelines as pertains to ransom payment and based on that, WE STRONGLY DISCOURAGE THE PAYMENT OF RANSOM in any kind. Aside various other reasons, it should be noted that there is no guarantee that the encrypted will be recovered, and worse still, paying ransom to cybercriminals can only motivate them to continue in their nefarious activities of creating more malware and also to have more funds to pay software developers and platforms for malware distribution. These cybercriminals extort millions of dollars through ransom annually from victims of malware attacks. It is also important to note that this virus is known to release other data stealing viruses such as VIDAR or AZORULT on the system, and they are capable of stealing your vital information such as banking details, software account login details, cryptocurrency wallets, passwords saved on your browser and browsing history information among others. Once such vital details get into the wrong hands, it can lead to even more problems like blackmails and stealing of money or other important resources.  Once any computer user discovers that their system has become compromised due to infiltration of this STOP/DJVU virus variant, it is advised that they remove STAX ransomware virus from their system as soon as possible.  Having reliable and up-to-date antivirus software activated in Safe Mode with Networking can be proactively effective in detecting and ridding your computer system of any malware infections. If you can get any strong and reliable antivirus, then go ahead and activate it on your system, otherwise it would be in your best interest to go for INTEGO Antivirus as recommended by our experts. In addition, it is advisable to download RESTORO to help in repairing damages done on your Windows operating system files due to virus infection. 

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution channels and techniques you need to be wary of

On a general perspective, computer systems mostly become infected with variants of STOP/DJVU ransomware like STAX virus due to exposure during downloading of malicious torrents. These dangerous malwares are known to hide in unwholesome or pirated software. Therefore, such contents should be avoided at all costs because opening any of such like a fake key generator or crack can automatically trigger a malware attack.  Virtually all victims that suffered a malware attack from this variant reported that the cybercriminals either made use of pirated license activation tools or composed deceptive cracks to deceive unsuspecting users.  Such downloadable software contents are then uploaded to as many torrent platforms online as possible, they include; 

Adobe Photoshop;Corel Draw;KMSPico (illegal Windows activation tool);AutoCad;Opera browser;Fifa 20;VMware Workstation;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;Tenorshare 4ukey.

If you are among those that expose themselves to such avoidable risks by trying to access software torrents online, it will be in your best interest to immediately desist from such dangerous acts. The developers of these malicious malwares are already lurking by, waiting to take advantage of free loaders and greedy people that would fall for their bait by trying to obtain copyrighted contents illegally and at no cost. It may interest you know that getting involved in such can potentially lead to criminal prosecution. Considering the ills associated with all these, we advise users to ensure they obtain their software products legitimately through the recommended official channels. Always remember that the fee you pay to buy software from the copyright owners is negligible relative to the humongous ransom you will eventually pay when you become a victim of ransomware, as well as the risk of having your sensitive data get into the wrong hands.  Since ransomware is equally spread through email attachments, those behind it may figure out how to send more believable messages and attachments to fool their potential victims. PDF, XLS and DOCX are the documents they use most because they enable macro functions or JavaScript and other enhancements.  Considering that the cybercriminals are desperate, they often try to front their emails as genuine messages being delivered to you from a company, business associates or transactions such as tracking details, invoice, order summary etc. Sometimes, they even go as far as using email spoofing techniques in manipulate their actual sender’s email address. In all these, you may have to rely on your intuition to decipher if it makes sense for a particular email to be sent to you but if you’re not expecting such email and it triggers a red flag in your brain, then you may as well desist from opening it.     When people fall victim to STOP/DJVU ransomware, they often become rattled and would seek for any available solution but it’s advisable not to patronise any website that claims to have the capability/tools to retrieve your encrypted files because such does not exist. At the moment, the only effective STOP/DJVU tools available out there are the ones created by Emisisoft and DiskTuna. We also explained how victims can successfully make use of it here. Also note that cybercriminals often spread other variants of ransomware such as ZORAB by passing them off as STOP/DJVU decryptor, but don’t fall for it because they’re fake and any attempt to download it would only lead to further encryption of your file.

What happened to your computer while ransomware was there

For victims that are still searching for more details or the extent their computer were compromised following the STAX ransomware infection, this section may prove vital to your quest because it captures all the in-depth explanations about the virus. The initial thing the malware does is to set up series of build.exe or build2.exe, as well as winupdate.exe that opens to a fake Windows update screen. The ransomware would then make a connection with https[:]//api.2ip.ua/geo.json and then transmit the response to a file called geo.json. Furthermore, it will extract information such as zip code, time zone, and the computer’s geolocation which it will forward to their server. Below is an image of how geo.json looks like. Additionally, the malware collects information about compromised computer’s name, software installed, and hardware details and save them to information.txt file as shown below. This information will also be sent to offender’s server. Also, the malware would analyse the extracted country code against a list of malware attack exception countries that, they are: Russian Federation, Uzbekistan, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, and Belarus. If it happens that the victim is from any of the listed countries, it will immediately abort the mission.  However, if it scales the geolocation phase, the malware will commence the extraction of online encryption key from their server and would compile it with victim’s ID, and stores them in bowsakkdestx.txt file as well as the PersonalID.txt file. Examples are shown below. The ransomware always makes use of offline encryption ID whenever it can’t get the online version and they are uniform to all victims of that particular virus variant. You can detect if an offline was used if t1 characters appear at the end of the victim’s personal ID. The good news is that you can hope to decrypt .stax files in the future. Check this tutorial for more details. It will now commence data encryption by scanning every folder using Salsa20, then marks each file with unique extensions before using RSA-2048 to lock the encryption key. Afterwards, it will delete Volume Shadow Copies using vssadmin.exe Delete Shadows /All /Quiet. While scanning through victim’s computer folders, the virus also drops _readme.txt ransom note that explains cybercriminals’ intentions. You can see a screenshot of this note below. Lastly, the virus inputs certain domains to HOSTS file before classifying them to a localhost IP which effectively bars the victim from having access to some sites. DNS_PROBE-_FINISHED_NXDOMAIN error message may appear on the screen whenever attempt is made to browse the blocked websites. The aim is to ensure that victims do not get help online. And the last step that this virus takes to cause even more damage to the victim is dropping additional malware, such as aforementioned VIDAR or AZORULT Trojans.

Remove STAX Ransomware Virus and Recover Your Files

Once again, it is very important to remove STAX ransomware virus ASAP once you discover it. To begin the process, you have to restart your computer through Safe Mode with Networking (please make use of the guide below). These steps, along with a strong antivirus will enable you to remove ransomware completely.  INTEGO Antivirus is recommendable because we can vouch for its effectiveness, and you can also download RESTORO to repair damaged Windows OS files. Once you’ve successfully completed STAX ransomware virus removal, please endeavour to do the following: 

Get in touch with the relevant law enforcement agency in your vicinity and inform them. Now you’re sure your computer is 100% malware free, you can make use of data backup to restore your files. Change all passwords associated with the computer system. Learn how to repair/decrypt files that were infected with STOP/DJVU variants.

The use of recommended antivirus can’t be overemphasized because it is crucial if you must get the entire process right. Based on that, you can follow the instructions below for optimal result! OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove STAX ransomware virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove STAX ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt STAX files

Fix and open large STAX files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. STAX ransomware virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt STAX files, follow the given tutorial.

Meanings of decryptor’s messages

The STAX decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your STAX extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of STAX ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.