Contents
BPQD ransomware is a malicious virus that infects computers and encrypts files contained in them. This malware is the latest to emerge from the notorious STOP/DJVU ransomware family. After encrypting files, the virus will equally append .bpqd extension to all the filenames accordingly. E.g. a file formerly identified as 1.jpg will automatically be renamed 1.jpg.bpqd, document.docx will appear as document.docx.bpqd and so on. While the attack is still happening, the ransomware will also drop notes known as _readme.txt in every folder it can locate in the compromised computer. The notes will contain messages sent by the cybercriminals informing the victim about the situation and the need for them to contact them to pay certain fees as ransom in exchange for BPQD decryption tool they will promise to provide.
They will further expatiate that BPQD ransomware virus has succeeded in making all files unreadable inclusive of pictures, documents and various data that may be very important to the victim, and considering the fact they made use of very strong and unique encryption key, then it leaves the victim no other option than to pay the ransom fees they’re asking for to the cybercriminals. Also included will be two email addresses, namely; support@sysmail.ch and supportsys@airmail.cc which the victim would be expected to respond to them with.
Furthermore, they will equally list their decryption service prices as well as the terms and conditions involved with the payment of ransom. They will claim that paying within 72 hours or 3 days of being notified by the cybercriminals will afford the victim a 50% discount. Therefore, instead of paying the full amount of $980, half of it, i.e. $490 would be acceptable by them but once the 3 days grace period elapses, only 100% payment must be made to them.
However, suppose the victim decides to reach out to them. In that case, the cybercriminals will still reel out more conditions by stating that the victim can only make payment through purchase of cryptocurreny that is worth the ransom fee and transferring same to a wallet address of their choice. The reason why they use such method of payment is apparently to avoid being trailed and arrested by law enforcement agencies that may have been notified. In order to convince the victim and pressure them into making payment ASAP, they may request small encrypted file that doesn’t contain valuable information for test decryption. They may send you a decrypted version of it.
No matter the pressure, our cybersecurity experts advise that victims should follow FBI’s guidelines on issues relating to ransom payments and it clearly says NO TO RANSOM PAYMENT. There are various reasons given for this verdict and they include the following:
To broaden the damage scale on the computer, the malware equally installs information-stealing Trojans – VIDAR or AZORULT with hopes to use to steal sensitive personal information such as software login details, cryptocurrency wallets, and banking details, passwords saved on PC and browsing history. Once cybercriminals get hold of such information, they could use them to perpetrate further crimes like blackmails and robbery.
If your computer was compromised by the discussed malware and you can notice new extensions appended to their names, the most important step to take now is to remove BPQD ransomware virus from your PC without further delay. You can do this effectively by booting your computer through Safe Mode with Networking prior to scanning with an up-to-date antivirus. If you’re not sure of any reliable antivirus to use, we advise you make use of INTEGO Antivirus because it is strong and very effective. You can also download RESTORO to help you repair possible virus damages on your Windows OS files.
Name | BPQD Ransomware Virus |
Type | Ransomware; Crypto-malware; Virtual Extortion Virus |
Family | STOP/DJVU |
Encryption type | RSA 2048 + Salsa20 |
Previous versions | VYIA, QBAA, FOPA, VTYM, KQGS, XCBG, BPQD (find full list here) |
Version | 418th |
Extension | .bpqd |
Cybercriminal emails | support@sysmail.ch and supportsys@airmail.cc |
Additional malware dropped | Azorult or Vidar Trojan |
Damage | The ransomware encrypts all files on the computer and marks them with an additional .bpqd extension, then saves _readme.txt ransom note in every PC folder. This virus may additionally install VIDAR Stealer alongside it. The ransomware may also delete Volume Shadow Copies and modify Windows HOSTS file to restrict computer user’s access to cybersecurity-related websites online. |
Ransom note | _readme.txt |
Ransom demand | $490-$980 in Bitcoin |
Distribution | Victims often download this ransomware along illegal torrent downloads, cracked software, activators, key generators or tools like KMSPico. |
Known software cracks to contain this malware | Corel Draw, Tenorshare 4ukey, Adobe Photoshop, Cubase, Adobe Illustrator, Internet Download Manager, Tally, League of Legends. |
Detection names | Ransom:Win32/StopCrypt.PAL!MTB (Microsoft), Trojan.Crypt (A) (Emsisoft), HEUR:Trojan-Ransom.Win32.Stop.gen (Kaspersky), Trojan.GenericKD.47850419 (BitDefender), Trojan.MalPack.GS (Malwarebytes), ML.Attribute.HighConfidence (Symantec) see all detection name variations on VirusTotal |
Removal | Remove ransomware and related malware from your PC using professional software of your choice. We highly recommend using INTEGO Antivirus. To repair virus damage on Windows OS files, consider scanning with RESTORO. |
REMOVE MALWARE & REPAIR VIRUS DAMAGE
1 Step. Get robust antivirus to remove existing threats and enable real-time protection
INTEGO Antivirus for Windows provides robust real-time protection, Web Shield against phishing and deceptive websites, blocks malicious downloads and blocks Zero-Day threats. Use it to remove ransomware and other viruses from your computer professionally.
2 Step. Repair Virus Damage on Windows Operating System Files
Download RESTORO to scan your system for FREE and detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically.
Computer systems often become infected with STOP/DJVU ransomware such as BPQD virus after their user tries to download from malicious online torrents. Cybercriminals usually embed malware on pirated software copies which they use as bait to prey on unsuspecting users. Therefore, opening fake “cracks” or key generators can result in severe malware infection. In contemporary times, victims have continuously reported of malware attacks after downloading certain pirated software copies from online torrents platforms. Some of the most popular ones used by cybercriminals are listed below:
For those that usually visit online torrents platform to illegally download software contents, it is high time you stop it because you could become a victim of ransomware at any moment. Aside the risk of malware attack, downloading copyrighted software contents from such platforms is a copyright infringement and is punishable by law. Instead, it is better to encourage genuine software developers by patronizing their works and paying the requisite fees. Also remember that whatever amount you pay to obtain it legally will always be insignificant compared to the outrageous ransom fees often demanded by cybercriminals. In addition to that, you won’t be at risk of losing vital personal data.
Cybercriminals also distribute ransomware through malicious email attachments whereby they compose believable messages that would be accompanied with attachments crafted with the use of formats like XLS, DOCX and XLS among similar ones that allow JavaScript and other macro functions. They use such platforms to embed payload that would be triggered once they’re opened in any PC.
In recent times, it has become increasingly difficult to detect which email is genuine or scam ones embedded with malware. This is because they often impersonate as family or friends, or even popular corporate brands like Amazon, eBay, FedEx etc. with catchy tags like Invoice, Tracking Details, Order Summary among similar ones. Alternatively, they may decide to make use of email spoofing techniques to hide their originating address. However, the advice is that people should thread with caution when opening random emails. If an email appears odd, then you may as well avoid opening it or any attachment that comes with it.
Finally, it would be in the best interest of STOP/DJVU ransomware victims to avoid suspicious websites that make bogus claims of offering decryption solutions. Most of these sites are fraudulent and they often distribute other versions of ransomware groups such as ZORAB through fake STOP/DJVU decryptors.
For those that want to understand in full details what actually happened during BPQD ransomware attack, you can avail yourself the information contained in this section. The ransomware begins the attack by downloading and running build.exe or build2.exe executables as well as winupdate.exe. Afterwards, it will make a connection with https[:]//api.2ip.ua/geo.json and would save the response in geo.json file. Following that, the malware will gather every piece of information concerning your computer and would store them in the geolocation-related database, including data such as your computer’s geolocation, time zone, zip code, longitude and latitude. The screenshot below shows examples of how geo.json files appear to look like.
The ransomware will also create another file (information.txt) for storing computer’s hardware details, installed software list and other active processes.
At this point, the virus will make a comparison between the country code it extracted from the computer against their list of encryption-exempted countries listed as the Russian Federation, Syria, Ukraine, Armenia, Tajikistan, Uzbekistan, Kazachstan, Kyrgyzstan, and Belarus. If it detects that the computer under attack is domiciled in any of these countries, it will immediately abort its mission, but if it scales through, the ransomware will then extract online encryption key from their database and would merge it with the victim’s ID before saving the result in bowsakkdestx.txt file and to PersonalID.txt file. Here is an example of what these files look like.
If for any reason the virus couldn’t get any online encryption key as expected, it will opt for the use of hardcoded offline key as a replacement. The difference is that such key will be uniform for all victims and improves the victim’s chances of ever decrypting .bpqd files someday, unlike the online key that is unique to each victim and more difficult to breach.
The ransomware will now begin full data encryption process by scanning every folder and encrypting it with Salsa20 before locking it with RSA-2048 encryption key. While this is going on, original filenames will be given additional extension.
Shown below is a screenshot of _readme.txt ransom note which is usually left in all the folders.
At this stage, the virus will delete all Volume Shadow Copies using the help of Command Prompt task as displayed below:
vssadmin.exe Delete Shadows /All /Quiet
Lastly, the virus will add certain domains to the Windows HOSTS file and also map them to the local host IP, thus effectively preempting any possible attempt by the victim to seek help online. Any attempt to browse the blacklisted sites will bring up DNS_PROBE_FINISHED_NXDOMAIN error message.
The first thing you’re advised to do following a ransomware attack is to remove BPQD ransomware virus as soon as possible. Afterwards, you follow the steps outlined below. Meanwhile, always remember to make use of only genuine antivirus software such as INTEGO Antivirus and also set up your system in Safe Mode with Networking before running it.
Once BPQD ransomware virus removal is done, check these recommendations by our team:
OUR GEEKS RECOMMEND
Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
BPQD Ransomware Virus Removal Guidelines
Before you try to remove BPQD Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube.
Instructions for Windows XP/Vista/7 users
Instructions for Windows 8/8.1/10/11 users
Now, you can search for and remove BPQD Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus, which also includes data recovery software. For virus damage repair, consider using RESTORO.
Special Offer
Compatibility: Microsoft Windows
See Full Review
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Instructions for Windows XP/Vista/7 users
Instructions for Windows 8/8.1/10/11 users
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.
STOP/DJVU ransomware versions are grouped into old and new variants. BPQD Ransomware Virus is considered the new STOP/DJVU variant, just like VYIA, QBAA, FOPA, VTYM, KQGS, XCBG, BPQD (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.
Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.
In order to test the tool and see if it can decrypt BPQD files, follow the given tutorial.
The BPQD decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:
Error: Unable to decrypt file with ID: [example ID]
This message typically means that there is no corresponding decryption key in the decryptor's database.
No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible
This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.
Result: No key for new variant offline ID: [example ID]
This ID appears to be an offline ID. Decryption may be possible in the future.
If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your BPQD extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.
Victims of BPQD Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:
If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.
Another recommendation is to contact your country's or region’s federal police or communications authority.
You can only open BPQD files if you have the decryption key, or if you were affected by offline encryption type.
To figure out whether you were affected by offline encryption, please go to C:/SystemID/PersonalID.txt and see if the string inside of it ends in t1. You can also try using Emsisoft Decryptor for STOP/DJVU.
Please follow the guidances provided by the official BPQD decryption tools and believe what they say. If they say it is impossible to decrypt, it really is so. There is no magic tool or human capable of decrypting your files hiding somewhere. Encryption is a technique created to be nearly impossible to decrypt without a special private key (held by the criminals).
We advise scanning with anti-virus, anti-malware, malware removal tools or software like RESTORO to eliminate virus damage on the system. If you do not trust using a single tool, try running one after another. However, we do not recommend keeping several security programs on a computer at once as they can interfere with each other's work.
Beware of fake BPQD decryption tools circulating around the web. Cyber criminals are uploading them to various shady websites, also might be promoting them via suspicious Youtube videos. These programs can infect your computer even more heavily (Trojans, miners, etc.). We suggest being extremely cautious around the web. If there will be an official STOP/DJVU decryption tool available, it will be widely discussed in public media.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Private Internet Access (PIA) VPN maintains its long-term role as a leader Private Internet Access…
XCBG ransomware aims to lock your files and demand a ransom XCBG ransomware is a…
KQGS ransomware is a hostile computer virus designed to encrypt all of your files KQGS…
VTYM ransomware description: a virtual menace to your files stored on the computer VTYM ransomware…
FOPA ransomware is a new threatening computer virus that encrypts your files FOPA ransomware virus…
QBAA ransomware aims to lock your computer files for a ransom QBAA ransomware is a…
This website uses cookies.