Geek's Advice

LQQW ransomware takes your personal files hostage, demands a ransom for decryption

LQQW ransomware is a computer virus coming from the infamous STOP/DJVU file-encrypting malware family. This malware employs RSA Salsa20 algorithm to lock all files on victim’s computer (photos, videos, documents, other files). After encrypting them, the ransomware marks each of them with an additional .lqqw extension. For example, a file originally named 1.jpg will appear as 1.jpg.lqqw after malicious modification. Following that, it drops _readme.txt notes from hackers in every containing folder. This note provides a brief message from virus’ developers who suggest that the only way to get LQQW decryption tool is to pay a ransom for them. The amount of money they demand depends on how quickly the victim writes to them via provided emails. If the victim reaches out within 72 hours, the ransom amount asked will be $490, otherwise – $980. The sole way of contacting the crooks is by sending them an email via one of provided emails: helpmanager@airmail.cc or manager@mailtemp.ch.

LQQW ransomware is designed to attack files stored on victim’s computer and connected drives and encrypt the first 150 KB of each file. In order to make affected files distinguishable, the virus also marks them with additional extension. The reason why the ransomware encrypts only part of each file is simple – it is enough to make file inaccessible yet not slow down the whole attack process. This kind of modification also allows reparation of certain file formats with minimal data loss as explained in this guide.

The ransom demanded by cybercriminals or simply the price of LQQW decryption tool depends on how fast the computer user writes to the hackers. If this is done within 72 hours, the attackers promise a 50% discount on the decryption tool, which results in $490 in Bitcoin. However, if the victim fails to pay up within the same time period, the price bounces back to full amount which is $980 in Bitcoin. The reason why the attackers demand cryptocurrency rather than US Dollars is because the latter could be used to trace them down, while crypto-based transactions cannot be traced down. In addition, the ransomware operators suggest decrypting one small file for the victim for free, in order to prove that it is worth paying the ransom.

Geek’s Advice team’s opinion generally matches with what other cybersecurity experts as well as the FBI has to say regarding ransom payments. Victims are not advised to pay the ransom, no matter what. Here are some reasons why it is not worth wasting your hard-earned money in such way:

• The criminals might vanish into a thin air after receiving your money. There are no guarantees they will do their part of the deal after you pay the ransom.
• Cybercriminals earn millions of US dollars each year from ransomware attacks. The more victims pay, the more people want to join this illegal business and create more ransomware and distribute it more actively. Please, do not contribute to this!
• In some countries paying a ransom is considered illegal.
• Viruses that belong to STOP/DJVU ransomware family such as LQQW virus run AZORULT Trojan on compromised systems.

Ransomware’s algorithm explained

LQQW ransomware virus begins the computer infection by launching a process called winupdate.exe, which displays a fake Windows update on screen. The sole aim of this procedure is to trick the victim into thinking that the computer is undergoing some important updates and needs to be left alone a couple of minutes. Unfortunately, this is the last thing a computer user would want to do – in case of a ransomware attack, it is highly recommended to turn off Internet connection (shut down router, unplug Internet cables) and shut down the computer.

The virus then runs a four-character named process, such as 6H4V.exe which is designed to scan entire computer system and encrypt files stored on it. In addition, this process also executes a Command Line task which deletes Volume Shadow Copies from the computer:

^{vssadmin.exe Delete Shadows /All /Quiet}

Without Shadow Copies, the victim won’t be able to restore some files using System Restore Points (if any were created prior to the ransomware attack). Additional damage that this ransomware does is adding a list of domains to  Windows HOSTS file to restrict access to them. The virus adds various computer-related sites, including microsoft.com and others and maps them to victim’s localhost IP. As a result, whenever the victim attempts to access one of them directly or via a search engine, DNS_PROBE_FINISHED_NXDOMAIN error will come up, stating about DNS resolution error. In order to be able to reach said websites, again, we strongly recommend you to reset HOSTS file back to default.

Finally, the virus drops some attack-related files that hold information such as the encryption key (in bowsakkdestx.txt file) and victim’s personal ID string or several of them (in PersonalID.txt file).

People who have their computers compromised with LQQW virus should remember that certain STOP/DJVU versions can drop AZORULT Trojan into such computers. It is a highly dangerous Remote Access Trojan (RAT) which can be used by cybercriminals to remotely connect to the computer and steal various information from it or performing other illegal actions such as:

• Downloading and running malware to the victim’s computer.
• Stealing crypto wallets.
• Viewing or deleting personal files on the victim’s computer.
• Stealing Telegram, Steam login details.
• Stealing saved passwords, browser cookies, browsing history and more.

We strongly recommend that you remove LQQW ransomware virus from your computer as soon as you can. In our opinion, the best software to do it professionally is a VB100 certified INTEGO Antivirus. Furthermore, we recommend scanning with RESTORO to repair virus damage on Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques

Speaking of LQQW ransomware distribution techniques, we must mention that they are no different from techniques used to spread other STOP/DJVU virus versions. In fact, the majority of victims report allowing such kind of infection after they decided to download an illegal software crack to their computers using various torrent sharing agents. It seems that cybercriminals tend to disguise this ransomware strain in cracks allegedly meant for these popular programs:

• Adobe Photoshop;
• Corel Draw;
• Cubase;
• Adobe Illustrator;
• Windows activation tools such as KMSPico.

Keep in mind that cybercriminals know that there are many computer users who are willing to try and risk to get a paid software for free, despite the potential risks that come along such downloads. What is even worse is that such computer users will often ignore their security software warnings, thinking that these are deceptive false positives and actually there is nothing to worry about. Sadly, such alerts should NEVER be ignored.

If you’re looking for a specific software version, we must stress out that the only place to get it safely is the software developer’s website or a confirmed distributor’s site. You can always look for various discount codes rather than trying to get a program absolutely for free. We can assure you that cybercriminals will ask for a much larger sum of money and might potentially threaten to publish your data online if you decide not to pay up – so it is really not worth the risk. Make sure you only choose trustworthy online sources for your downloads!

Email attachments are also a popular way to transmit ransomware payloads. The attackers compose infectious files in the following popular document formats: XLS, DOCX, PDF and name them somewhat official-looking, such as pending payment/invoice/parcel delivery tracking info. However, we strongly recommend that you ignore emails that you weren’t expecting to receive, or at least look for one of the red flags that signal about a potentially malicious/phishing email:

• Urgent message tone suggesting that you open the attached files immediately.
• Claims about vital documents that need to be reviewed immediately.
• The sender pretends to be from a well-known and reputable company.
• Spoofed email address;
• Your email address provider marks the received email as spam.

Victims of STOP/DJVU ransomware variants such as LQQW should beware that ransomware operators might try to deliver a second payload to you, if you decide to search for file decryption tool a little too desperately. In other words, operators behind other ransomware strains such as ZORAB were noticed distributing fake STOP/DJVU decryption tools that were simply ransomware in disguise. We can assure you that once an official decryption tool appears, it will be mentioned by all legitimate news sites and you won’t have to search for such tools on various shady websites.

Remove LQQW ransomware and decrypt your files

Take actions to remove LQQW ransomware virus professionally. To remove the virus automatically, we strongly encourage you to use a robust antivirus software, ideally, a one that provides real-time protection. One of such programs is INTEGO Antivirus which is a VM100 certified software. Finally, you can download RESTORO and scan your computer to repair virus damage on Windows OS files.

Once LQQW virus removal is complete, ensure to take the following actions:

• Report this incident of cybercrime to your local authority responsible for handling such events.
• If you have created a data backup lately, use it to restore at least part of your important files.
• Follow all the given instructions to decrypt or repair files affected by STOP/DJVU versions.
• We also recommend that you change your passwords, especially for websites that you save login credentials for in your browser.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.