Remove KODC Ransomware Virus (2023 Guide)

KODC ransomware virus comes back in 2020

KODC ransomware is a malicious computer virus that can encrypt all personal files both on computer and connected devices. The virus is the 198th version of STOP/DJVU file-encrypting malware. The virus uses asymmetric encryption to prevent victim from accessing files, marks them with .kodc extension and creates ransom notes in _readme.txt files all over the computer. The ransom notes suggest contacting the cybercriminals via provided emails (helpmanager@firemail.cc or helpmanager@iran.ir) and paying the specified ransom. The price of it ranges between $490-$980 in Bitcoin.

KODC ransomware is the first STOP/DJVU virus version of 2020. Since the last version of the virus in 2019, PINY, the malware creators have stopped their operations during the festive season. However, they’re back again, distributing the new ransomware in full speed again.

The virus is set to disable security software on the computer, delete Volume Shadow Copies, encrypt files stored on the computer system and saving ransom-demanding notes in affected data folders. The ransom notes _readme.txt contain a simple note that says all files, including documents, videos, databases and other important files were encrypted. The only way to decrypt them is purchase a KODC decryption tool and a private key which is required for data recovery. However, the victim is asked to pay a ransom, which equals to $490 if paid within 72 hours.

Otherwise, if the victim fails to obtain the required sum of money and pays later, the ransom price goes up to $980. Although this is not stated in the ransom note as the criminals suggest contacting them via email ( latest used emails: helpmanager@firemail.cc, helpmanager@iran.ir, but might be using new ones shortly) for more information, the ransom needs to be paid in Bitcoin, as this ensures the attackers’ privacy.

Threat Summary

Name	KODC ransomware virus
Type	File-encrypting ransomware
Origins	STOP/DJVU (198th version)
Behavior	Encrypts files on the computer and connected devices, installs AZORULT Trojan
Extension	Appends .kodc file extension to files
Ransom note	_readme.txt
Ransom demand	$490-$980
Emails	helpmanager@firemail.cc or helpmanager@iran.ir, but might be using new ones
Distribution	Hides in illegal online downloads such as software cracks or keygens
Decryption tools	STOP Decryptor doesn’t support this extension at the moment
Removal	Remove using antivirus while in Safe Mode (see instructions below)

Victims can also test if the criminals are lying or not by sending them a couple of files for decryption. The attackers then would send the decrypted versions back. However, we strongly suggest you not to waste your money. If no one paid such ransoms, cyber-extortion wouldn’t be a thing.

It is essential to point out the fact that KODC ransomware might install Azorult password-stealing Trojan on your computer. Therefore, it is a must to take actions to protect your privacy as soon as possible. Otherwise, ignoring such fact might lead to further private data or financial loss, as the Trojan is capable of stealing all of your login details to various websites that you access (including shopping sites, banking sites and similar).

We suggest you to remove KODC ransomware virus along with Azorult malware using instructions provided below. These instructions will guide you through preparation of secure environment for malware removal. Next, we suggest using an antivirus software of your choice. You might be interested in some reviews we have published recently.

KODC decryption is what interests victims the most. Is it possible?

KODC decryption is a top-priority matter for every victim who has its computer infected with the described piece of malware. Sadly, STOP/DJVU malware is known to be professionally crafted and currently has no significant flaws that would allow easy data recovery.

The one thing that matters is that victims whose files were encrypted with offline key can expect to recover at least part of the data in the future. However, the majority of victims are subject to the online encryption, which is impossible to break, at least at the moment.

To check whether your files are locked with online or offline key, do the following:

1. Go to C:/SystemID/PersonalID.txt.
2. Look at the string saved in this file. If one or at least one of them ends in t1, it means that files were corrupted with offline key.

In ALL OTHER SCENARIOS, online key was used and decryption isn’t possible.

However, we must mention that STOP Decryptor by Emsisoft isn’t currently capable of recovering data corrupted by .kodc file virus. We will update this article, as well as this decryptor guide as soon as the extension becomes supported by the recovery tool.

We also want to stress out one more thing. Reports show there are scammers who claim they can decrypt KODC extension files for you. They ask for a large sum of money and they typically simply pay the criminals instead of you. Avoid these scammers at all costs as they simply want to rip you off!

As always, the most trustworthy way to recover lost data is use data backups. Unfortunately, our experience shows that computer users do not have the habit of creating data backups on a regular basis.

STOP/DJVU malware hides in shady online downloads

KODC ransomware virus hides in deceptive online downloads. To be precise, the developers of the virus tend to hide it in various software cracks, illegal activation tools such as key generators, and other archives you can download online. In other words, if you are looking to get a premium software version without actually paying for it, you are in great danger of becoming a victim to STOP/DJVU ransomware attacks.

We want to remind you that paying for a legal software licence is actually cheaper than paying a ransom to cybercriminals. Therefore, we encourage you to avoid such illegal downloads at all costs. If you risk doing so, you could lose YEARS of work in a couple of minutes, and there is no hope in restoring it easily.

Remove KODC ransomware virus version from your PC

You can remove KODC ransomware virus easily if you use the guidelines provided by our experts below. However, we want to remind you that you will need to use an antivirus software to trace down and remove malicious files, programs, and other traces from the computer system safely.

You can complete KODC ransomware removal easily, but it is not the end to the nightmare that the virus caused to you. What we strongly recommend doing next is:

• Change ALL of your passwords immediately, including ones you have saved in your browser, and your email account passwords as well.
• Next, we suggest searching for data copies in all places to gather as many important files as possible – you can check your email, files sent in messages, and other places.
• Finally, we suggest tracking updates on this guide how to use STOP Decryptor. Once the .kodc virus version becomes supported by the said tool, it will be capable of decrypting files locked by the offline key.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.