Foop ransomware: what it is and how to remove it
Foop ransomware is file locking malware that was first spotted attacking users in the first half of March 2020. It locks pictures, databases, music, videos, images, documents, and other data with the help of a sophisticated RSA encryption algorithm and appends .foop extension to each.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Make sure nothing will rename more files to .foop: an automatic scan checks the PC first.
Do it yourself · free Remove Foop ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Foop ransomware: summary
| Name | Foop ransomware |
|---|---|
| Type | File locking virus, cryptomalware |
| Family | Malware stems from the notorious Djvu/STOP ransomware family |
| Cipher | While older Djvu variants used AES, all versions released after August 2019 use a secure RSA cipher |
| File extension | All personal files located on the infected computer are appended with .foop extension; file example: picture.jpg.foop |
| Ransom note | _readme.txt is dropped into every folder where the locked files are located, as well as the desktop |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 15 more facts
| Contact | helpdatarestore@firemail.cc and helpmanager@mail.ch |
|---|---|
| Ransom size | Threat actors ask for $490 in BTC. If the ransom is not paid within first 72 hours after infection, the sum doubles to $980 |
| File recovery | If the data was encrypted with an online key, retrieving data without backups or paying criminals is almost impossible, although some users might be lucky when using alternative methods we provide below. In case malware used offline ID, there is a high chance that Emsisoft's decryptor can be successful in data recovery |
| Detection names | No Microsoft detection name is known |
| Encrypted file extension | .foop |
| Decryptor | No free decryptor is known for this variant; check No More Ransom (nomoreransom.org) for updates |
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Symptoms | Files renamed with a new extension and a ransom note left in folders |
| Evidence | 5 write-ups by security sites; no sample analysed yet |
| Encrypted files | .foop |
| Attacker contacts | helpdatarestore@firemail.cc |
| Free decryptor | No free decryptor is known (checked 6 October 2026) |
| First seen | 9 March 2020 |
| Facts checked | 6 October 2026 |
- File extension:
.foop - Note file:
_readme.txt - Contact:
helpdatarestore@firemail.cc
From our report of Mar 2020 · not reviewed since
More from our earlier report on Foop ransomware
- Ransomware can sometimes negatively affect Windows system files - it can cause program crashes, lag, random reboots, etc.
How Foop ransomware behaves
From our report of Mar 2020 · not reviewed since
Foop ransomware - the 213th version of the devastating Djvu virus
Foop ransomware is file locking malware that was first spotted attacking users in the first half of March 2020.
It locks pictures, databases, music, videos, images, documents, and other data with the help of a sophisticated RSA encryption algorithm and appends .foop extension to each. Users are informed via the ransom note _readme.txt that they need to pay $490/$980 ransom in Bitcoin in order to unlock their data.
Foop ransomware belongs to one of the most prominent malware families that target home users - Djvu/STOP. The attackers continually use software cracks to distribute the threat and infect hundreds of victims daily around the world. Unfortunately, the malware uses a unique key per victim in most cases, so recovering data without paying crooks is almost impossible.
Luckily, those victims whose data was encrypted with an offline ID, they can decrypt .foop virus files with the help of decryptor tool from Emsisoft. You should not rush contacting hackers via the provided emails (helpdatarestore@firemail.cc, helpmanager@mail.ch) before at least trying to recover the data by using other methods.
Unlike many other file locking viruses, for its distribution, Foop ransomware authors mainly use pirated program installers and software cracks/keygens that they populate on the torrent and similar unsafe sites.
While this intrusion can be stopped by being careful, most of the up-to-date anti-malware solutions could save victims from getting infected in the first place. It is important to note that Foop ransomware removal will not return files to their pre-infection state - this is the trait that makes it so devastating.
Prior to August 2019, Foop virus authors used a different encryption method that was not as secure and could sometimes be deciphered with tools like STOPDecrypter. Nevertheless, to prevent victims from recovering their data for free, threat actors improved their encryption algorithm, making the decryption tool useless. Luckily, security experts from Emsisoft managed to create a new decryptor that worked on all first 148 variants.
All the Djvu/STOP versions that are encrypted with RSA keys can no longer be decrypted, although those that were lucky enough and malware used an offline ID (the C&C server was down, or the internet connection was unstable) still have a chance at free recovery with another tool form Emsisoft.
If nothing works, the only way is to copy the encrypted files over to an external drive of a cloud server, remove Foop ransomware from the infected machine, and then attempt alternative data recovery methods we provide below.
From our report of Mar 2020 · not reviewed since
Foop ransomware can not only render your files useless but also infect you with other malware
Foop virus targets computers running Windows explosively, and attacks both 32-bit and 64-bit operating systems, expanding the target audience even more.
Typically, the main executable (which can be named as anything, .e.g., update.exe or 8d7c.tmp.exe) is placed into the %AppData% or %Temp% folder, where it starts the infection routine.
At this point, Foop ransomware will shut down Windows functions that would help users to recover their files - delete Shadow Volume Copies. Additionally, malware will also modify the registry to establish persistence, attempt to establish a connection via the HTTP requests, etc.
Foop ransomware can also include underlying traits that may not be that apparent for regular users straight away. Based on previous encounters, security researchers managed to find multiple different features of this malware:
After the necessary preparations are complete, Foop ransomware will begin the file encryption process during which users will be shown a fake Windows update pop-up. This method decreases the chances that victims would interrupt the encryption process after noticing that their computer resources are being used to their maximum capacity.
Finally, malware will drop the _readme.txt file that provides relevant information to victims. It reads:
Offering the "discount" and the "test decryption" is typical for malicious actors, as they are trying to make users believe that these guys can be trusted. Please be aware that Foop virus authors infected your machine without your permission and are perform cybercriminal activity, which is punishable by the law.
Trusting these people is gambling your money - if you decide to pay, be aware that you can get scammed and be left without Foop ransomware decryptor, as well as your precious files.
If you had backups, you shouldn't worry too much - simply get rid of Foop ransomware by scanning your machine with anti-malware software, fix virus damage with tools like and then copy the data over.
- Foop file virus may insert modules into Google Chrome, Mozilla Firefox, or MS Edge to steal sensitive information typed by victims. This data can later be sold on the dark web for profit.
- The malware might deliver secondary payloads - previous various have been spotted delivering AZORult banking Trojan to the infected machine.
- It can modify Windows "hosts" file in order to prevent users from accessing security-related websites that could aid victims with recovery and Foop ransomware removal process.
From our report of Mar 2020 · not reviewed since
Stay away from pirated software - it is not only illegal but can also cost you your files
Most of the Djvu ransomware victims tend not to talk about how they got infected with file-locking malware.
Those users typically ignore cybersecurity experts' advice and rely on software cracks, pirated program installers, cheats, and similar unsafe executables to acquire paid applications for free. However, most know that this activity is illegal and even punishable by law.
It is also important to note that unsafe websites that store such content are often riddled with malware, including ransomware. Some infection methods might not be as evident, however, as downloading and double-clicking the .exe file is not the only way to bring ransomware to the computer.
For example, compromised sites might also host malicious ads based on JavaScript, which is launched automatically. If the system holds a web browser or another application that is not fully patched (has software vulnerabilities), the malware is downloaded and installed in the background without user interaction.
Of course, it is worth mentioning that malicious actors are always looking for new methods in order to expand their campaigns, so straying away from software cracks is not enough - you should also employ powerful anti-malware software, prepare backups regularly, not open spam email attachments, use strong passwords, enable ad-block, patch software on time, and overall be more cautious when browsing online.
The Foop ransomware note
ATTENTION!
Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-7m8Wr997Sf
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
helpdatarestore@firemail.cc
Reserve e-mail address to contact us:
helpmanager@mail.ch
Your personal ID:
How to remove Foop ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove Foop ransomware and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Unplug the network cable or turn off Wi-Fi, and disconnect USB drives, external disks and network shares, so Foop ransomware cannot reach more files. Pause OneDrive, Google Drive or Dropbox sync, because synced folders upload the encrypted copies over the good ones.
Leave the PC on but offline while you read the next steps, since a restart can let the ransomware run again. This applies to Windows 11 and Windows 10 alike.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Your files now end in
.foopand the instructions are in_readme.txt. Save both to a USB stick, a copy of the note and two small encrypted files, before anything else.On another device, check them with ID Ransomware or Crypto Sheriff: the family name decides which decryptor, if any, can help. Keep the note's ID and contact line for your report.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
Our last check found that for Foop ransomware, no free decryptor is known (checked 6 October 2026). Look again yourself in the No More Ransom list and the free decryptor pages of Emsisoft, Avast and Kaspersky, which add new families every year.
A decryptor needs the ransomware gone first, or it encrypts the files again. Keep at least one copy of the encrypted files on an external drive, even if no tool works yet.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Removing Foop ransomware does not bring the files back, but it has to come first. Start with Defender's Full scan, then the offline scan from the same Scan options page, which checks the disk before Windows loads.
If the scan cannot start, use Safe Mode with Networking. Delete the ransom notes only after you have saved a copy, because removal tools sometimes leave them behind on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Windows keeps shadow copies for restore points and backups, and some ransomware fails to delete them.
vssadmin list shadowsin an administrator Command Prompt tells you at once whether any exist.If they do, right-click the folder that held your files, open Properties > Previous Versions, select a version from before the attack, and click Open to check it before you Restore or copy the files out. Windows 11 and Windows 10 both have the tab.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
A backup made before the attack is the surest way back. Connect it only once the PC is clean, then restore from File History, Windows Backup, OneDrive's Restore your OneDrive or your own external copies.
Without a backup, try file recovery: the originals that Foop ransomware deleted may still be on the disk until something overwrites them. Install nothing new on the drive you want to recover from on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Mar 2020 · not reviewed since
Eliminate Foop ransomware correctly
Most probably, there are hardly any users who get infected with this or another ransomware repeatedly - mostly because the first encounter shoes them how devastating this type of malware can be. As we previously mentioned, Foop ransomware removal will not bring your files back - these two processes are independent of one another and should not be treated as one.
Thus, before you eliminate the Foop file virus, you should backup all the encrypted files (this is necessary if you have no working backups), or otherwise, they might become permanently corrupted, and even a working decryptor will not be able to help you. Then, scan your machine with powerful anti-malware software to eliminate all the malicious files, as well as secondary payloads that may be located on your machine.
Note, after you remove Foop ransomware, you should also access the following location on your machine and delete the "hosts" file in order to access security-related websites without restrictions:
[GI=method-1]In case of Foop ransomware virus interrupts your security software from performing a scan, access Safe Mode with Networking:
[GI=method-2]System Restore may be useful when trying to get rid of the computer infection:
Make use of Windows Previous versions feature
This method can only be functional if the malware failed to get rid of Shadow Volume Copies from your system for some reason.
ShadowExplorer is another useful tool that may be able to help you decrypt files
Just as in the previous case, if Foop ransomware failed to delete automated backups, ShadowExplorer should have no troubles when recovering all your encrypted files.
Make use of Emsisoft's decryption tool
Djvu ransomware is known to fail to contact its remote server sometimes and encrypt data with an offline key. In case somebody from victims pays the ransom, this key can be used for all the victims affected by the same variant.
Thus, in cases Emsisoft's decryptor does not work, although an offline ID was used to lock your files, you will have to wait till security researchers add the key for the Foop variant.
Additionally, you may also ask Dr.Web for help - the vendor offers decryption service for some file types, although it is not free.
- C:\Windows\System32\drivers\etc\
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
Make the next attack harmless
Foop ransomware could only hurt the files that had no second copy, and the signs (files that end in .foop and no longer open) showed exactly which ones those were.
The 3-2-1 rule fixes that:
- three copies
- two media
- one disconnected
A practical version for a home PC: OneDrive or another cloud backup with version history, plus an external disk that you plug in once a week for File History and then unplug. Test a restore now and then by opening a few files from the backup on another device.
Details, schedules and what not to back up are in our 3-2-1 backup guide for Windows.
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
Questions about Foop ransomware
Is there a decryptor for .foop files?
That depends on the family behind the .foop extension, which this guide cannot confirm yet from the reports alone. Check No More Ransom and ID Ransomware with your ransom note and one encrypted file; they list families with free tools.
If none exists today, keep the encrypted files and a copy of the note on a separate drive, because decryptors are sometimes published months later after flaws are found or servers are seized. Never buy a decryptor from a website that is not the security company that made it.
How do I open .foop files?
You cannot open them by renaming or by choosing another program. The .foop ending shows that Foop ransomware encrypted the content, and only the matching key can reverse it. Renaming a file back to .docx or .jpg changes nothing except the icon, and it can confuse a future decryptor, so leave the names as they are.
To get the content back, use a backup, an unencrypted copy elsewhere, or a decryptor listed on No More Ransom if one exists for Foop ransomware. Store the encrypted files on an external disk until then.
Did Foop ransomware steal my files or passwords?
We do not know yet. Nothing published so far shows data theft by Foop ransomware, but the only confirmed sign is files that end in .foop and no longer open, which says nothing about what happened before. Many current ransomware attacks copy files or run a password stealer first, so it is wise to act as if they did.
From a clean device, change the passwords that were saved in the browsers on this PC, starting with e-mail and banking, sign out of all sessions and turn on two-step verification. Watch bank statements and account activity for the next few weeks.
Should I pay the ransom?
We advise against it, and so do the FBI, Europol and national cyber agencies. Payment does not guarantee a working tool: some attackers never reply, some tools damage files, and some variants have no decryptor at all. Paying also funds further attacks and can make you a target again.
Before considering payment, try every recovery option in this guide and report the attack. Companies must involve their legal adviser and insurer, because payments to sanctioned groups can be illegal. If files are truly irreplaceable, store the encrypted copies and wait; decryptors sometimes appear later.
Can a data-recovery company decrypt my files for a fee?
Only if a decryptor already exists or the company pays the attackers for you. Some "ransomware recovery" services advertise that they can decrypt families with no known flaw; in practice they negotiate with the attackers and add their own fee. Others use the same free tools listed on No More Ransom.
Before you hire anyone, ask in writing how they will recover the files, whether they will contact the attackers and what happens if they fail. A legitimate service answers clearly. If a free decryptor exists for your family, you can run it yourself.
How did Foop ransomware get on my computer?
The way Foop ransomware spreads has not been documented yet, so look at your own recent activity. On home PCs, ransomware most often comes with cracked programs, game cheats, key generators and fake updates, or with an e-mail attachment that was opened. On business networks, attackers usually log in through Remote Desktop with a stolen or guessed password.
Think back to what was downloaded or installed in the days before files that end in .foop and no longer open, and check the Downloads folder and Installed apps sorted by date. Keep anything suspicious for your report, but do not run it again.
Is Foop ransomware the same as other ransomware with a similar name?
Not necessarily. Ransomware names come from the file extension, the note or a word in the code, so unrelated families often end up with similar names, and one family can appear under several names. The difference matters: a decryptor or advice for one family does not fit another and can damage files.
Compare the ending added to your files and the exact name of the note with the summary table at the top of this guide, then upload the note and one encrypted file to ID Ransomware from a clean device. If the result names another family, follow the guide for that family instead.
Should I open _readme.txt?
Reading it is fine if you open it in Notepad. A plain text _readme.txt cannot harm the PC. Be careful with notes in HTA or HTML format: double-clicking those runs them in a window that can contain scripts, so right-click and choose Open with > Notepad instead.
The note tells you the contact addresses, the claimed amount and the deadline. Do not visit links or write to the addresses from this PC. Use the note to identify the family and check for a free decryptor first.
Should I reinstall Windows after the .foop attack?
Reinstalling removes the ransomware but not the encryption: your files ending in .foop stay encrypted afterwards. So first copy the encrypted files and the ransom note to a separate drive, in case a decryptor appears later. Then decide:
- a clean-up with an offline scan is often enough for home PCs
- while a full reset is safer if remote access was involved
- scans keep finding new items
Restore your backups only after the PC is clean, and change passwords from another device.
Will Fortect remove Foop ransomware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Foop ransomware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Twitter: #STOP #Djvu #Ransomware w/ extension ".foop" (v0213) (read October 6, 2026)
- Wikipedia: RSA (cryptosystem) (read October 6, 2026)
- Trend Micro: Command and Control [C&C] Server (read October 6, 2026)
- CISA: StopRansomware (read October 6, 2026)
- No More Ransom (read October 6, 2026)