How to remove Foop ransomware

Foop ransomware – the 213th version of the devastating Djvu virus

Foop ransomware is file locking malware that was first spotted attacking users in the first half of March 2020.^[1] It locks pictures, databases, music, videos, images, documents, and other data with the help of a sophisticated RSA encryption algorithm^[2] and appends .foop extension to each. Users are informed via the ransom note _readme.txt that they need to pay $490/$980 ransom in Bitcoin in order to unlock their data.

Foop ransomware belongs to one of the most prominent malware families that target home users – Djvu/STOP. The attackers continually use software cracks to distribute the threat and infect hundreds of victims daily around the world. Unfortunately, the malware uses a unique key per victim in most cases, so recovering data without paying crooks is almost impossible. Luckily, those victims whose data was encrypted with an offline ID, they can decrypt .foop virus files with the help of decryptor tool from Emsisoft. You should not rush contacting hackers via the provided emails (helpdatarestore@firemail.cc, helpmanager@mail.ch) before at least trying to recover the data by using other methods.

Unlike many other file locking viruses, for its distribution, Foop ransomware authors mainly use pirated program installers and software cracks/keygens that they populate on the torrent and similar unsafe sites. While this intrusion can be stopped by being careful, most of the up-to-date anti-malware solutions could save victims from getting infected in the first place. It is important to note that Foop ransomware removal will not return files to their pre-infection state – this is the trait that makes it so devastating.

Prior to August 2019, Foop virus authors used a different encryption method that was not as secure and could sometimes be deciphered with tools like STOPDecrypter. Nevertheless, to prevent victims from recovering their data for free, threat actors improved their encryption algorithm, making the decryption tool useless. Luckily, security experts from Emsisoft managed to create a new decryptor that worked on all first 148 variants.

All the Djvu/STOP versions that are encrypted with RSA keys can no longer be decrypted, although those that were lucky enough and malware used an offline ID (the C&C server^[3] was down, or the internet connection was unstable) still have a chance at free recovery with another tool form Emsisoft.

If nothing works, the only way is to copy the encrypted files over to an external drive of a cloud server, remove Foop ransomware from the infected machine, and then attempt alternative data recovery methods we provide below.

Foop ransomware can not only render your files useless but also infect you with other malware 

Foop virus targets computers running Windows explosively, and attacks both 32-bit and 64-bit operating systems, expanding the target audience even more. Typically, the main executable (which can be named as anything, .e.g., update.exe or 8d7c.tmp.exe) is placed into the %AppData% or %Temp% folder, where it starts the infection routine.

At this point, Foop ransomware will shut down Windows functions that would help users to recover their files – delete Shadow Volume Copies. Additionally, malware will also modify the registry to establish persistence, attempt to establish a connection via the HTTP requests, etc.

Foop ransomware can also include underlying traits that may not be that apparent for regular users straight away. Based on previous encounters, security researchers managed to find multiple different features of this malware:

• Foop file virus may insert modules into Google Chrome, Mozilla Firefox, or MS Edge to steal sensitive information typed by victims. This data can later be sold on the dark web for profit.
• The malware might deliver secondary payloads – previous various have been spotted delivering AZORult banking Trojan to the infected machine.^[4]
• It can modify Windows “hosts” file in order to prevent users from accessing security-related websites that could aid victims with recovery and Foop ransomware removal process.

After the necessary preparations are complete, Foop ransomware will begin the file encryption process during which users will be shown a fake Windows update pop-up. This method decreases the chances that victims would interrupt the encryption process after noticing that their computer resources are being used to their maximum capacity.

Finally, malware will drop the _readme.txt file that provides relevant information to victims. It reads:

ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-7m8Wr997Sf
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
helpdatarestore@firemail.cc

Reserve e-mail address to contact us:
helpmanager@mail.ch

Your personal ID:

Offering the “discount” and the “test decryption” is typical for malicious actors, as they are trying to make users believe that these guys can be trusted. Please be aware that Foop virus authors infected your machine without your permission and are perform cybercriminal activity, which is punishable by the law. Trusting these people is gambling your money – if you decide to pay, be aware that you can get scammed and be left without Foop ransomware decryptor, as well as your precious files.

If you had backups, you shouldn't worry too much – simply get rid of Foop ransomware by scanning your machine with anti-malware software, fix virus damage with tools like FortectIntego and then copy the data over.

Stay away from pirated software – it is not only illegal but can also cost you your files

Most of the Djvu ransomware victims tend not to talk about how they got infected with file-locking malware. Those users typically ignore cybersecurity experts' advice and rely on software cracks, pirated program installers, cheats, and similar unsafe executables to acquire paid applications for free. However, most know that this activity is illegal and even punishable by law.

It is also important to note that unsafe websites that store such content are often riddled with malware, including ransomware. Some infection methods might not be as evident, however, as downloading and double-clicking the .exe file is not the only way to bring ransomware to the computer. For example, compromised sites might also host malicious ads based on JavaScript, which is launched automatically. If the system holds a web browser or another application that is not fully patched (has software vulnerabilities), the malware is downloaded and installed in the background without user interaction.

Of course, it is worth mentioning that malicious actors are always looking for new methods in order to expand their campaigns, so straying away from software cracks is not enough – you should also employ powerful anti-malware software, prepare backups regularly, not open spam email attachments, use strong passwords, enable ad-block, patch software on time, and overall be more cautious when browsing online.

Eliminate Foop ransomware correctly

Most probably, there are hardly any users who get infected with this or another ransomware repeatedly – mostly because the first encounter shoes them how devastating this type of malware can be. As we previously mentioned, Foop ransomware removal will not bring your files back – these two processes are independent of one another and should not be treated as one.

Thus, before you eliminate the Foop file virus, you should backup all the encrypted files (this is necessary if you have no working backups), or otherwise, they might become permanently corrupted, and even a working decryptor will not be able to help you. Then, scan your machine with powerful anti-malware software to eliminate all the malicious files, as well as secondary payloads that may be located on your machine.

Note, after you remove Foop ransomware, you should also access the following location on your machine and delete the “hosts” file in order to access security-related websites without restrictions:

• C:\Windows\System32\drivers\etc\