How to remove Moss ransomware

Moss ransomware – malicious program designed to make users pay ransom for a data recovery tool

Moss ransomware is a data-encrypting computer infection that steps from an extensive malware family known as Djvu. Once inside a Windows system, it encrypts all personal pictures, videos, databases, documents on local and networked drives with RSA cipher. During this process, users' files also receive a .moss extension, are stripped of their regular icons, and can no longer be accessed.

To make compromised data usable again, victims need to retrieve a unique key that is only accessible to Moss virus authors – and they are not willing to give it away for free. In the ransom note _readme.txt, which is dropped on several folders that contain locked files. In the note, malicious actors explain that users need to contact them via helpmanager@mail.ch or restoremanager@airmail.cc emails and pay a ransom in bitcoins worth $980 or $490.

Since the Moss files virus belongs to the most prominent data-locking family, a free decryption tool exists that might help some victims to recover their files whiteout paying the attackers. However, this program is only recovering files encoded using offline IDs, that are no longer used by developers. You can check if the Emsisofts Djvu decryption tool can help you by uploading some file samples. 

Moss ransomware is almost exclusively spread via software cracks or similar malicious installers downloaded on insecure websites, such as torrents. This method has proved extremely successful for the malware authors, as they are releasing new variants (e.g., Lyli, Copa, Kolz, Lalo, and others) every week, infecting thousands of users in the process. According to researchers, Djvu accounts for around 70% of global ransomware infections, although the real number is likely to be much higher.^[1]

As soon as the Moss virus breaks into a Windows computer, it begins to prepare it for the encryption process. These system modifications ensure that the malware can run uninterrupted and can be booted with each computer launch. Besides, it also deletes Shadow Copies from the machine, ensuring that users can not recover their files easily.

There are several other processes that are initiated during the infection phase, which include:

• Modifications to Windows “hosts” file, which prevents them from accessing security-related websites which provide Moss ransomware removal instructions (to revert this, visit C:\Windows\System32\drivers\etc\ location and delete the URL addresses within the file);
• Delivery of secondary payloads, such as AZORult data-stealing malware;
• Injection of data-stealing modules into Chrome, Firefox, or another web browser.

Moss ransomware then begins the data encryption sequence, during which a fake Windows update prompt is shown to victims. Just as other malware of such type, it targets the most popular file types, including MS Office documents, PDF, RAR, JPG, and similar, skipping most of the executables and system files in the process. This is done because the attackers do not want to corrupt the Windows system, but rather extort money for the decryption tool.

After the encryption is done, the following file, called _readme.txt, is dropped on the desktop and other locations within the system:

ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-sTWdbjk1AY
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
helpmanager@mail.ch

 

Reserve e-mail address to contact us:
restoremanager@airmail.cc

 

Your personal ID:

Unfortunately, it is true that only cybercriminals have access to the unique key that is required to restore .moss files. Nonetheless, there are other methods that could be effective – check for more details in the next paragraph. Remember to remove threats and all the related files before any file recovery. You should rely on AV detection rates for the virus^[2] and such engine-based tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.

.moss file recovery options

One of the biggest questions that the victims have is “how can I recover .moss files?” and, in many cases, they mistakenly believe that this can happen as soon as the ransomware infection is eliminated with security software. Unfortunately, this is not correct, as malware uses a secure encryption algorithm to encrypt data.

Essentially, this means that each Moss virus victim is assigned with a randomly-generated ID and a key, which is only accessible to the attackers. Think of it as a unique password that is only applied to your particular computer.

Therefore, even if you remove Moss ransomware, the files will remain encrypted. This can be especially devastating, as users tend to keep the most important work documents, school papers, and invaluable family pictures on their devices. Experts^[3] do not recommend paying cybercriminals, however, as they might not send the required decryption tool back, leaving you without your files and money in the process.

There are several other methods you could try when trying to remove .moss extension from your files. One of the most effective methods is a free decryption tool provided by Emisosft for Djvu ransomware victims. However, this decryptor only works under certain circumstances. For the tool to work, the following conditions must be met:

• Ransomware needs to use an offline ID (which is static) for your files. This happens when malware fails to contact its C&C server^[4] to retrieve a unique key from.
• Somebody with the same .moss extension needs to pay the ransom to criminals, retrieve an offline key, and share it with Emsisoft security researchers.

If the virus managed to contact the remote server and encrypt your data with an online ID, the decryption is currently not possible. Nonetheless, you can attempt to restore at least some. Moss files with the help of third party recovery tools or by using built-in Windows restore points.

Perform Moss ransomware removal using a reputable anti-malware

Before you remove Moss ransomware, you should keep in mind several things. Even if data decryption methods listed below did not help you currently, it does not mean that it will not be possible in the future. For example, security researchers can create a working decryption software for all variants, or cybercriminals' servers might be seized by the law enforcement agencies and all the keys retrieved, allowing victims to recover files for free.

Since Moss virus removal might permanently damage the encrypted data in a way that even a working tool would not help, you should make a copy of the important data – simply use an external storage device or use other data backup methods. Note that encrypted files do not hold any malicious code, so they are safe to keep.

Finally, you can delete the Moss ransomware virus from your system using robust security applications such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Security software can ensure that all the malware components, along with other potential infections, can be eliminated at once. You can also use FortectIntego to fix damage to Windows, which could have been sustained during the infection process. If the malware remains, it can continue encrypting the incoming files, so it is vital to scan your machine with anti-malware before attempting file recovery.