Remove IQLL Ransomware Virus (DECRYPT .iqll FILES)
IQLL ransomware is the 305th variant of STOP/DJVU virus
Contents
IQLL ransomware is a new file-encrypting virus from STOP/DJVU malware family. This threat falls into a category of virtual extortion tools that lock user’s files RSA Salsa20 algorithms and append .iqll extension after the original one. For example, user’s file previously called 1.jpg will appear as 1.jpg.iqll after the attck. While scanning computer’s folders, the ransomware also drops _readme.txt notes in every affected directory. This note is also known as a ‘ransom note’ from cybercriminals. It provides a message from cybercriminals operating this ransomware who state that the only way to recover all files is paying the specified ransom. The price that victim is asked to pay for .iqll file decryption equals to $490 if the victim writes to the attackers within 3 days and transfers the sum in cryptocurrency. If the victim delays fullfillment of criminals’ demands, the price rises to $980. The note contains two email addresses to contact the criminals: manager@mailtemp.ch or helpmanager@airmail.cc.
Ransomware-type viruses are made to take victim’s files hostage by applying military-grade encryption algorithms on them. The attackers hope that the victim will be willing to do anything to take these files back. Therefore, the criminals ask to pay a ransom or, according to them, purchase file decryption tool and unique key from them. The probability that the victim will start considering paying the ransom is high, since many people keep extremely important files on their computers – either work or study-related ones, or simply personal memories such as images or videos. For those who hesitate, the criminals suggest the test decryption service. In order to use it, the victim can send one small encrypted file to criminals via email. The attackers promise to respond with a decrypted version of it. However, they warn not to send files that contain valuable information, or the attackers might refuse to decrypt such files for free.
IQLL file decryption software price ranges from $490 to $980, depending on how fast the victim reaches out to the criminals and pays. Victims might get the criminals’ virtual wallet address after sending an email to the attackers. Needless to say, they want to remain anonymous, and using cryptocurrency helps to make their transactions untraceable.
Geek’s Advice team experts do not advise paying the ransom. In fact, FBI recommends the same. There are many reasons why it is simply not worth doing so:
- Internet criminals are not trustworthy, and there is no way to trace them down. That said, they might take your money and fail to provide you with functional tools to decrypt your files. In other words, paying the ransom absolutely does not guarantee data recovery.
- In some countries and states, paying the ransom might be illegal.
- Ransomware operators already collect millions in ransoms each year. This directly contributes to the expansion of criminal operations as well as lures other people to join them.
- Variants of STOP/DJVU ransomware, including IQLL virus, are known to drop AZORULT Trojan on compromised hosts or networks. It is a threat that can be controlled remotely to extract and steal login credentials, saved passwords, and even download malware on the victim’s computer.
Damage caused by ransomware attack
IQLL ransomware begins the infection by bypassing security software on the computer and launches winupdate.exe process, which is a fake program that displays a prompt mimicking Windows update process. The idea behind this is to deceive the victim and convince one that the sudden system slowdown is caused by harmless operating system updates. In the meantime, the ransomware runs subprocesses to carry out the actual attack and encrypt all files on the target system.
During the attack, the ransomware encrypts first 150KB of each file and appends a new file extension to the original filename. Despite the fact that the ransomware doesn’t modify the entire file, it still cannot be opened except images or videos that can be restored with minimal data loss. Once encrypted, these files become useless as they cannot be viewed, modified, or used in any way. Additionally, the ransomware drops ransom notes in every computer folder.
The next thing that this malware does is eliminate Volume Shadow Copies from a computer. These can be used when recovering the previous computer state using System Restore Points. This way, the malware operators are trying to stop victim’s access to free file recovery means. Finally, the malware adds a list of domains to the Windows HOSTS file. Domains added to this file become impossible to reach no matter the browser used. It has been noticed that ransomware operators are trying to block websites that publish how-to tutorials, computer help articles, and similar content. Attempts to visit one of the restricted domains will trigger DNS_PROBE_FINISHED_NXDOMAIN error in web browser.
IQLL ransomware virus also drops AZORULT Trojan on the system. This threat falls into Remote Access Trojans’ category, meaning that it can be used to perform various malevolent tasks on victim’s computer remotely. Some of its functionalities are listed below:
- View or delete files on victim’s computer;
- Download malware to victim’s computer;
- Steal Steam, Telegram login credentials;
- Steal cryptocurrency wallets;
- Steal browser cookies, saved passwords, browsing history and more.
The first and foremost thing that you need to do is to remove IQLL ransomware virus and any other malware from your computer as quickly as you can. To ease the removal procedure, we have provided free instructions below the article. Additionally we recommend scanning your computer with trustworthy antivirus program such as INTEGO Antivirus. Once the system is cleaned, we strongly recommend using RESTORO to repair virus damage on the system.
Scan your system for FREE to detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically. Includes Avira spyware/malware detection & removal engine.
Ransomware Summary
| Name | IQLL Ransomware Virus |
| Type | Ransomware; Crypto-malware; Virtual Extortion Virus |
| Family | STOP/DJVU |
| Encryption type | RSA Salsa20 |
| Previous versions | VYIA, QBAA, FOPA, VTYM, KQGS, XCBG, BPQD (find full list here) |
| Version | 305th |
| Extension | .iqll |
| Dropper | SmokeLoader (see VirusTotal details) |
| Damage | The ransomware encrypts all files on the target system using RSA Salsa20. Modified files become useless as the victim can no longer open them. The virus also appends additional file extensions to encrypted files to make them stand out more. To prevent the victim from restoring files for free, the ransomware deletes Volume Shadow Copies and adds a list of domains to restrict to Windows HOSTS file. Additionally, the virus drops _readme.txt notes in every computer folder. |
| Ransom note | _readme.txt |
| Ransom demand | $490-$980 in Bitcoin |
| Distribution | The ransomware dropper awaits in illegal torrent downloads, cracked software, key generators or tools like KMSPico. |
| Detection names | Trojan:Win32/Glupteba (Microsoft), Glupteba.Backdoor.Bruteforce.DDS (Malwarebytes), TR/AD.InstaBot.bfsbw (Avira), HEUR:Exploit.Win32.Shellcode.gen (Kaspersky), Trojan.GenericKD.36669904 (B)(Emsisoft), W32.Trojan.Gen (Webroot) see all detection name variations on VirusTotal |
| Removal | Remove ransomware and associated threats from your PC using robust malware removal software such as INTEGO Antivirus. Next, we strongly advise scanning with RESTORO to repair virus damage on Windows OS files. |
_readme.txt ransom note threatens to keep files locked if the victim won’t pay the ransom to cybercriminals.
Typical ransomware distribution techniques
When it comes to computer threats disribution, it doesn’t really matter what their type is because they all are distributed in similar ways. That said, ransomware distribution techniques we will describe here will help you avoid various kinds of computer infections as well.
IQLL ransomware was noticed in online downloads that are considered illegal, such as software or game cracks, keygens or tools like KMSPICO. In fact, it has been noticed that STOP/DJVU ransomware operators stay loyal to this technique which they have used to successfully distribute over 300 variants already. We want to warn you that although getting paid software for free might seem tempting, such downloads almost always carry a hidden payload. Illegal online downloads can be downloaded via peer-to-peer file-sharing programs such as uTorrent, BitTorrent or others. While not malicious themselves, these programs do not check whether files transmitted over the P2P network are secure.
What is even worse is that many computer users willingly ignore their antivirus’ warnings about potentially malicious downloads, thinking that these are simply false positives. However, we must say that even if everything appears normal and you don’t notice any strange signs telling you about the installation of malware, it is still too early to decide that everything went fine. There are many variants of silent malware such as RATs or cryptocurrency miners that can remain unnoticed in your computer system for weeks or months.
Our general recommendation is to choose legitimate and trustworthy sources to download desired programs. Make sure you visit the official developer’s or confirmed distributor’s website for secure download links.
Ransomware distribution also strongly relies on email spam campaigns. The criminals leverage leaked email databases to send malicious spam to thousands of people with attached files that contain one or another payload. The crooks tend to impersonate people from well-known companies such as Amazon, eBay or lately, parcel delivery companies such as DHL, DPD, UPS and claim to be sending extremely important documents for the victim. In most cases, they suggest opening attached document with missing/pending payment details.
It is essential to remember that cybercriminals get more and more creative and the same can be said about the level of sophistication used to design the attack patterns. For example, while EXE file format used to be the most popular malware transmission vector, nowadays criminals can inject malware-dropping scripts in almost any file format, including DOC, PDF, XLS and others.
The deceptive techniques are used in many ways. Not only the attackers craft up convincing email messages and trustworthy-looking attachments or company logos to include in the email, but they also use email spoofing techniques to display a fake sender’s email address for the victim. We strongly recommend reading about these techniques and how to identify a spoofed email here.
Lately, operators of other ransomware strains such as ZORAB started actively distributing fake STOP/DJVU file decryption tools that ensure double file encryption. In other words, they upload fake decryption tools to shady websites, and victims who download it get their already encrypted files maliciously modified again. Stay away from such shady websites because once a legitimate decryption tool appears, it will be mentioned in the largest news sites for sure.
Remove IQLL ransomware virus and decrypt or repair your files
We have prepared a free guide on how to remove IQLL ransomware virus safely. For your convenience, we also recommend using a trusted antivirus software to automatically detect malware remains on the system. We suggest choosing INTEGO Antivirus for this matter. Finally, to repair virus damage on Windows OS files, download and scan with RESTORO.
Once IQLL virus removal is complete, we recommend you to take the following actions:
- Let your local authority responsible for handling cybercrime incidents in your country know about the ransomware attack you just experienced. We have provided some references below this guide.
- Use data backups if you have them. Please ensure that the malware is completely gone before you plug the storage drive to your computer.
- Use these instructions to decrypt or repair files affected by STOP/DJVU versions.
- We suggest changing all of your passwords (especially for accounts saved in browser) due to the Azorult Trojan’s activity.
OUR GEEKS RECOMMEND
Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:
STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS
STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
IQLL ransomware virus Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove IQLL ransomware virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube.
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove IQLL ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus, which also includes data recovery software. For virus damage repair, consider using RESTORO.
Special Offer
Compatibility: Microsoft Windows
See Full Review
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Decrypt IQLL files
Fix and open large IQLL files easily:
It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.
- Create a copy of encrypted file to a separate folder using Copy > Paste commands.
- Now, right-click the created copy and choose Rename. Select the IQLL extension and delete it. Press Enter to save changes.
- In the prompt asking whether you want to make the changes as file might become unusable, click OK.
- Try opening the file.
STOP/DJVU decryption tool usage guide
STOP/DJVU ransomware versions are grouped into old and new variants. IQLL ransomware virus is considered the new STOP/DJVU variant, just like VYIA, QBAA, FOPA, VTYM, KQGS, XCBG, BPQD (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.
Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.
In order to test the tool and see if it can decrypt IQLL files, follow the given tutorial.
- Download the decryption tool from Emsisoft.
- Click the little arrow next to your download and choose Show in Folder.
- Now, right-click the file and choose Run as Administrator. If asked, enter administrator's password.
- In UAC window, click Yes.
- Click Yes to agree to software terms in both windows.
- The tool will automatically include C:// disk as a location to decrypt. The file recovery tool will prepopulate the locations to scan, including connected data storage drives or network drives. Click Add folder if you wish to add additional locations.
In Options tab, you can choose to keep encrypted file copies. We recommend leaving this option selected, especially if you do not know if the decryption tool will work. - Click Decrypt to start restoring IQLL files. You will see the progress in the Results tab. Here, you can see messages from the tool, such as whether the decryption procedure is successful, or you need to wait for an update.
You might also be informed that online key was used to encrypt your files. In such case, the decryption tool won't work for you, and the only way to recover your files is to use a data backup.
Meanings of decryptor's messages
The IQLL decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:
Error: Unable to decrypt file with ID: [example ID]
This message typically means that there is no corresponding decryption key in the decryptor's database.
No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible
This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.
Result: No key for new variant offline ID: [example ID]
This ID appears to be an offline ID. Decryption may be possible in the future.
If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your IQLL extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.
Report Internet crime to legal departments
Victims of IQLL ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:
- In the United States, go to the On Guard Online website.
- In Australia, go to the SCAMwatch website.
- In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.
- In Ireland, go to the An Garda Síochána website.
- In New Zealand, go to the Consumer Affairs Scams website.
- In the United Kingdom, go to the Action Fraud website.
- In Canada, go to the Canadian Anti-Fraud Centre.
- In India, go to Indian National Cybercrime Reporting Portal.
- In France, go to the Agence nationale de la sécurité des systèmes d’information.
If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.
Another recommendation is to contact your country's or region’s federal police or communications authority.
Frequently Asked Questions
You can only open IQLL files if you have the decryption key, or if you were affected by offline encryption type.
To figure out whether you were affected by offline encryption, please go to C:/SystemID/PersonalID.txt and see if the string inside of it ends in t1. You can also try using Emsisoft Decryptor for STOP/DJVU.
Please follow the guidances provided by the official IQLL decryption tools and believe what they say. If they say it is impossible to decrypt, it really is so. There is no magic tool or human capable of decrypting your files hiding somewhere. Encryption is a technique created to be nearly impossible to decrypt without a special private key (held by the criminals).
We advise scanning with anti-virus, anti-malware, malware removal tools or software like RESTORO to eliminate virus damage on the system. If you do not trust using a single tool, try running one after another. However, we do not recommend keeping several security programs on a computer at once as they can interfere with each other's work.
Beware of fake IQLL decryption tools circulating around the web. Cyber criminals are uploading them to various shady websites, also might be promoting them via suspicious Youtube videos. These programs can infect your computer even more heavily (Trojans, miners, etc.). We suggest being extremely cautious around the web. If there will be an official STOP/DJVU decryption tool available, it will be widely discussed in public media.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Recent Posts
Private Internet Access Review 2022: Fast, Secure & Cheap VPN
Private Internet Access (PIA) VPN maintains its long-term role as a leader Private Internet Access…
Remove XCBG Ransomware Virus (DECRYPT .xcbg FILES)
XCBG ransomware aims to lock your files and demand a ransom XCBG ransomware is a…
Remove BPQD Ransomware Virus (DECRYPT .bpqd FILES)
BPQD ransomware encrypts all computer files, demands a ransom from the user BPQD ransomware is…
Remove KQGS Ransomware Virus (DECRYPT .kqgs FILES)
KQGS ransomware is a hostile computer virus designed to encrypt all of your files KQGS…
Remove VTYM Ransomware Virus (DECRYPT .vtym FILES)
VTYM ransomware description: a virtual menace to your files stored on the computer VTYM ransomware…
Remove FOPA Ransomware Virus (DECRYPT .fopa FILES)
FOPA ransomware is a new threatening computer virus that encrypts your files FOPA ransomware virus…
View Comments
My computer recently is infected by .iqll virus. It created .iqll with my all computer files, which is not opening. I run EmisiSoft for decryption the files but it show:
Notice: this ID appears be an offline ID, decryption MAY be possible in the future.
Guide me how i can recover my all drive files again?
Thanks,