Geek's Advice

BORA ransomware damage can be reversed using free STOP DJVU Decryptor

Bora ransomware is the 171st and decryptable variant of the STOP/DJVU virus. The crypto-virus targets Windows computers to encrypt all files on them using asymmetric AES+RSA crypto ciphers, add .bora file extensions to their original names, then creates ransom-demanding notes called _readme.txt in every affected folder. The malware deletes Volume Shadow Copies to prevent easy data recovery for the victim.

STOP/DJVU ransomware version uses extremely strong encryption methods that are almost impossible to decipher. As it uses asymmetric encryption method, it locks all files (documents, photos, videos, audio files, databases, and other data) using a public key, but to decrypt .bora file extension files, the victim needs the private key, which is held by the cybercriminals.

The ransomware creators seek to extort the victim and suggest paying a ransom in exchange for the decryption key and software. The instructions on how to obtain these recovery tools are described in the ransom note called _readme.txt.

The ransom note states that the victim can recover data that was encrypted, but the only method to do so is to purchase a decryption tool from the attackers. As proof of STOP decrypter existence and functionality, the attackers suggest sending one .bora file to them for free decryption via provided emails – gorentos@bitmessage.ch, amundas@firemail.cc  or gerentoshelp@firemail.cc. 

The virus demands money in exchange for a decryption tool

To recover all data, the victim is advised to pay a large sum of money, which depends on how fast the victim manages to contact the attackers and happens to have that amount of money in the bank account.

The original ransom amount is $980, but if the victim rushes to contact the attackers and pay within 72 hours, the attackers slice the price tag in half and demand $490, which, needless to say, is still a hefty sum. In addition, the attackers want to receive it in Bitcoin cryptocurrency.

It is obvious that not everyone has so much money to spare for some cybercriminals. Besides, you still get no guarantee that the attackers will provide Bora decryption tools for you – all they want is to collect ransoms. In addition, victims who pay up simply prompts the attackers to continue their malevolent activities. Therefore, we do not suggest paying the ransom under any circumstances.

This ransomware variant is almost identical to the previous ones – the 170th version RECO ransomware, also KUUB, BOOT, NOOS and NESA variants. All of them are identical, the only thing that differs is the file extension used to mark the files.

If you have been infected with this STOP/DJVU malware variant, we strongly advise you to remove BORA ransomware immediately. Under other circumstances you can try to delete malware manually. However, in this case, we recommend using the guidelines provided below the article. Boot your PC in Safe Mode and then eliminate the threat and other malicious programs.

You can use an antivirus software of your choice. It is important to do it as soon as you can as this ransomware is known to install Azorult password-stealing virus on the system.

Threat Summary

Name	Bora file extension virus
Type	Ransomware; Crypto-virus; File locker
Encryption	AES+RSA cryptography
Other versions	BOOP, VARI, OONN, NILE
Ransom note	_readme.txt
Ransom demand	From $490 to $980
Decryption tools	Decrypt .bora files using Emsisoft decryptor
Distribution	Malicious email spam, untrustworthy downloads like cracks or keygens
Removal	Can be removed using antivirus software

Explanation on how do victims get infected with STOP/DJVU ransomware versions

Bora, Boot and other DJVU ransomware variants circulate around with the help of malicious spam. They can also lurk in online files that people download for illegal activation of paid software. For example, if you are looking for a paid game or program to download via peer-to-peer programs like Torrent or eMule, most likely you will be instructed to activate the software using crack or keygen, and these types of tools can carry ransomware payload.

We strongly advise you to stay away from such download sources and rather choose paid, but legal ways to get programs that you want. It is way better than end up with the .bora file virus on your computer.

To prevent a ransomware attack, stay attentive as you browse through online resources. Besides, if you do not want your computer to be infected, always keep antivirus with real-time protection on your computer.

Finally, to avoid getting yourself in the worst scenario possible, create data backups regularly. Keep them in an EXTERNAL storage device (unplugged from your PC). Certain ransomware variants can get access to your online clouds and encrypt files there. Therefore, such storage option is not the best idea when it comes to crypto-viruses.

Remove Bora ransomware virus

If you want to remove Bora ransomware virus, read the instructions provided below carefully. Once you complete them, use a robust antivirus to eliminate malicious software remains from your computer. Please note that Windows Defender might not be efficient enough to eliminate the virus, so you might have to download a stronger antivirus solution. There are both free and paid options available for your choice. 

Once the Bora ransomware removal is complete, you need to do several things:

1. First of all, create a backup of encrypted files. We do not advise removing corrupt files because there is still hope for .bora files decryption. Cryptography is a difficult subject and even experts can create a tool in one day. We understand, lost personal or work files is a disaster and we all need them NOW. However, that is why you should have created a data backup earlier. All you can do now is wait patiently.
2. Think of sources you can get some file copies from. For example, you may have shared some files with someone via email, Facebook or other applications. You can try to download them from there.
3. Change ALL your passwords, especially those you auto-saved in your browser. As mentioned earlier, Azorult Trojan can use them to hurt you financially.
4. Inform your friends and relatives about ransomware protection methods to prevent them from a similar cyber attack.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt .Bora extension files

Victims infected with this ransomware variant can restore files using STOP DJVU Decryptor created by Emsisoft and Michael Gillespie. Bora virus uses OFFLINE and ONLINE keys for decryption (or one of them). You might succeed to recover only part of them, but it is still an achievement.

To identify if some of your files were encrypted using OFFLINE key, open the _readme.txt file and check the Personal ID section. If you can see one of a few keys, look at their last symbols. You can also identify if you were infected with the OFFLINE key if your personal ID ends with t1.

If your files were encrypted by this ransomware variant, check this tutorial on how to use STOP/DJVU decryptor to recover .bora extension files.

When it comes to ransomware, typically the only way to restore some files for free is from your personal backups. However, in certain cases decryption keys get leaked or, if bigger institutions like FBI step in, chances to find out data required for data recovery emerges. In this case, you should thank Emsisoft & Michael for their hard work.