Geek's Advice

EYRV ransomware takes your computer files hostage, demands a ransom

EYRV ransomware is a destructive file-encrypting malware that just emerged from the notorious STOP/DJVU ransomware family. This latest variant operates by encrypting all files found in any computer it infects and also appending them with .eyrv extension to the files, respectively. E.g. a file that was previously known as 1.jpg will be renamed 1.jpg.eyrv and so on. While the attack is going on, the ransomware will drop ransom notes known as _readme.txt in all the folders. Contained within the _readme.txt notes are pieces of information sent by those behind the attack notifying the victim about the situation and the need for them to pay ransom fees in exchange for EYRV decryption tool.

They will emphasize that EYRV ransomware virus has successfully encrypted all the files contained in the infected computer, including documents, pictures, data etc. Therefore, they have no other choice than to comply with the ransom payment since they made use of very strong encryption key that can’t be breached. To open a channel of communication, they will equally drop two email addresses, namely: support@sysmail.ch and supportsys@airmail.cc, to enable the victim respond to them.

Other information contained in the _readme.txt file includes decryption prices as well as terms and conditions attached with the payment. They will point out that paying without delay will make it possible for the victim to pay only 50% of the ransom fee which amounts to $490. However, once the 3 days window period elapses, only the full ransom fee of $980 must be paid by the victim.

Peradventure the victim decides to respond to them using any of the emails they dropped; they will state that payment can only be made by purchasing cryptocurency that is worth the ransom fee and transferring it to a wallet address that would be made available for the purpose. They obviously use such anonymous payment method in order to protect their identity and avoid possible arrest by the authorities. To convince the victim of their ability to restore their files, they would suggest for excerpts of it to be sent to them for test decryption.

Whatever happens, the general advice by our team of experts is that victims should adhere to FBI’s guidelines regarding ransom issues and the bottom-line is that ransom must not be paid, no matter what. The reason is because paying ransom does not guarantee that decrypted files will be restored by the cybercriminals and moreover, doing so would only make more funds available to cybercriminals which would enable them to expand their criminal activities and victimize more people. Globally, cybercriminals extort millions from their victims annually and this situation can only be stopped or minimized to the barest minimum when victims stop paying ransom.

Also of concern is the fact that information-stealing Trojans like AZORULT and VIDAR are usually released as secondary virus to steal vital information such as banking details, software account details, cryptocurrency wallets, passwords, and browsing history among others which they could also use to perpetrate further criminal acts.

Victims of this STOP/DJVU malware variant are advised to remove EYRV ransomware from the PC as soon as possible to avoid further damage. This can be done setting up your computer in Safe Mode with Networking option before scanning a strong antivirus software on it. However, it is crucial to make use of only genuine antivirus software and if you’re not of which brand to use, then you can always avail yourself INTEGO Antivirus because it has been proven to be very reliable. Additionally, we recommend scanning with RESTORO (secure download link) to repair virus damage on Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques to be wary of

The most common way computer users infect their PC with STOP/DJVU variants including EYRV virus is when they download software contents from malicious online torrents. Cybercriminals often embed malware in pirated software contents; therefore trying to make use of fake key generators and so-called “cracks” downloaded from such platforms is dangerous and can lead to severe malware infection. Over the years, victims have reported of ransomware attack after downloading certain software copies and the common ones mostly used by cybercriminals in distributing ransomware through online torrent libraries are listed below:

• Internet Download Manager;
• Adobe Photoshop;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Fifa 20;
• KMSPico (illegal Windows activation tool).

For those that have a tendency of searching online torrents for software copies to download, you should know that such habit is dangerous and is putting you at serious risk of cyber-attack. The old phrase “penny wise, pound foolish” holds true here because in trying to avoid paying a token for your software needs, you may end up paying outrageous fees as ransom to cybercriminals when you eventually become a victim. Besides, when you download pirated software contents from malicious online torrents, you’re indulging in copyright infringement and such activity is a punishable offence by law.

On the contrary, we recommend that software contents should only be sourced from the official pages of the original content developers or their third-party affiliated partners. By so doing, you won’t be at risk of ransomware attack; losing your money, time and important files.

Another method of distributing ransomware used by cybercriminals is through malicious email attachments, whereby they would compose highly believable email messages alongside customized attachments, using formats such as DOCX, PDF and XLS among similar ones. They prefer these particular ones because they enable macro functions and JavaScript that are required for download of payload and also to trigger it in diverse random computers.

The problem faced by any computer a user is how to decipher which email is genuine or coming from cybercriminals because these crooks have mastered the act of deception. They often impersonate as relative or friend and in some other cases, they would assume the identity of popular corporate organizations, with brands such as Amazon, DHL, eBay, and UPS etc. often used. To make their messages irresistible, they would use compelling attachment names like Invoice, Tracking Details, and Order Summary among similar ones. Whatever is the case, if you sense that an email is odd, inappropriate or unexpected, then it should be a red flag and such email is better avoided. Lastly, look out for spoofed email address.

Lastly, for those that have become victims of STOP/DJVU ransomware already, it would be in your best interest to avoid certain dubious websites that claim to offer decryption services because they’re mostly crooks trying to spread other versions of ransomware. Downloading such fake tools could lead to double file encryption and loss of sensitive information.

More details concerning the virus

For those that may want to know more about what happens during EYRV ransomware attack and the extent to which their computer was affected, this section would come handy. The first action the malware takes is to launch build.exe or build2.exe executables as well as winupdate.exe (which displays fake Windows screen). Once that is done, it will connect to https[:]//api.2ip.ua/geo.json and save the response to geo.json file.

Afterwards, it will begin information gathering of every detail concerning your computer and would store them in its geolocation-related database and would contain the infected computer’s geolocation, time zone, zip code, as well as longitude and latitude details. The image below shows examples of the geo.json file.

It will also save names of active processes on the computer, installed software list and hardware details into information.txt file as shown below.

At this point, the virus will profile the computer’s country code against a list of countries they designated as encryption-exempted, namely: Russian Federation, Ukraine, Belarus, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, and Uzbekistan. If it confirms that the computer is located in any of the aforementioned countries, it will automatically stop any further action. However, if otherwise, the ransomware will extract online encryption key from their server and would merge it with the victim’s ID before saving it in bowsakkdestx.txt file and also save the ID separately to PersonalID.txt file. Shown below are examples of these files.

If on the other hand, the virus fails to extract an online encryption key, it will resort to the use a hardcoded offline key. The remarkable difference between both keys is that online version is unique to every victim while the offline version is uniform for all. You can detect if an offline key was used if you observe the appearance of t1 characters suffixed at the end of the personal ID. Also, the use of offline key offers an advantage to the victim because there is a high chance that .eyrv files could be decrypted going forward. For more information about this, please check below the article.

The ransomware will now commence with full data encryption procedure by scanning every folder and encrypting it with Salsa20 before locking it with RSA-2048 key. While the process is still going on, the virus will mark files with additional extension. Shown below is screenshot of compromised data folder.

Here is a screenshot of _readme.txt ransom note that is dropped by the cybercriminals.

Before concluding the attack, the virus will blacklist certain domains in the Windows HOSTS file as well as map them in localhost IP, thus effectively barring the victim from having access to them. Any attempt by the victim to browse them may bring up DNS_PROBE_FINISHED_NXDOMAIN error message. The cybercriminals go to this extent just to ensure that the victim does not get any support from online forums that offer help to victims of cyber-attack.

Remove EYRV Ransomware Virus and Also Recover Your Files

There are certain measures that should be taken by victims of cyber-attack to limit their losses, prevent further problems and preempt any attempt by the cybercriminals to exploit them. However, the first step should be to remove EYRV ransomware virus without delay.

For malware removal, we recommend relying on robust AV tools such as INTEGO Antivirus. Additionally, we recommend downloading RESTORO and running a full system scan to identify virus damage on Windows OS files. You can try to repair it manually or using full version of the software.

Once EYRV ransomware virus removal is complete, the victim should also do the following:

• Report the incident to relevant government agencies nearest to you.
• Restore all lost data using any available backup device.
• Change all passwords that were used on the compromised computer without delay.
• Learn possible ways certain types of STOP/DJVU encrypted files could be decrypted.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.