LSSR ransomware aims to take your files hostage
Contents
LSSR ransomware is a file-encrypting computer virus that comes from the infamous STOP/DJVU malware family. Once launched on the target system, it encrypts all files using RSA Salsa20 algorithm, thus making them inaccessible. During the attack, the virus marks each encrypted file with additional .lssr extension. For example, file previously named 1.jpg will appear as 1.jpg.lssr after the cyber attack. The malware also saves a note from the cybercriminals into each folder and names it _readme.txt. It shortly explains what the virus has done to your computer and what the victim needs to do in order to decrypt .lssr files. According to the criminals, the only way to restore these files is pay a ransom ranging from $490 to $980 depending on how fast the victim writes to the attackers and settles an agreement with them (which is paying the ransom as soon as possible). The only way to contact the criminals is writing to either manager@mailtemp.ch or helpmanager@airmail.cc emails.
LSSR ransomware was made for only one purpose – extorting inattentive computer users. The virus does so by using military-grade encryption algorithms to make files inaccessible. It encrypts only the first 150 KB of each file, enough to corrupt it yet finish the whole computer data encryption quickly before the victim notices anything. This also allows restoring certain file formats with minimal data loss at the beginning of the file. For example, the victim might be still able to open audio files which will miss some seconds of the recording in the very beginning. For more information about file decryption and repair, please see this guide.

The note left by the virus, _readme.txt, explains that all files were encrypted using strongest encryption algorithms. It also suggests that the victim can get LSSR decryption tool and unique key if one manages to contact the criminals and pay the ransom with 72 hours (3 full days). In case the victim delays, the ransom price will be $980. The criminals will further clarify that the said amount must be paid in cryptocurrency (most likely Bitcoin). Using such payment method keeps the attackers untraceable. To convince the victim to pay up sooner, they even suggest testing the decryption by sending one small encrypted file for them which they promise to decrypt for free and send it back.
Our team experts do not recommend paying ransoms to cybercriminals. The same is advised by FBI. In fact, there are various reasons that should convince you to keep your money to yourself:
- There’s no way to get your money back if you transfer it to cybercriminals. Besides, it doesn’t guarantee that criminals will actually provide you with tools to decrypt files.
- Ransomware operators earn millions of US dollars each year. Not only this helps to fuel further malicious operations, but also lures other people to join this industry.
- Paying a ransom might be considered an illegal act in your country.
- Viruses that belong to STOP/DJVU ransomware family such as LSSR virus run AZORULT Trojan on the infected computer. This is a well-known information stealer which can be remotely controlled by the attacker to perform illegal actions on victim’s PC.
Ransomware damage in detail
LSSR ransomware arrives as a set of processes that are meant to perform different tasks on victim’s computer. One of the first ones being launched is winupdate.exe, a deceptive process that displays a fake Windows update prompt during the attack. This is meant to convince the victim that a sudden system slowdown is caused by a Windows update. However, at the same time the ransomware runs another process (usually named by 4 random characters) which starts scanning the system for target files and encrypting them. Next, the ransomware deletes Volume Shadow Copies from the system using the following CMD command:
vssadmin.exe Delete Shadows /All /Quiet
Once deleted, it becomes impossible to restore previous computer state using System Restore Points. The thing is, ransomware operators are getting rid of any Windows OS-based methods that could help the victim to restore files for free. In addition, the attackers modify Windows HOSTS file by adding a list of domains to it and mapping them to localhost IP. As a result, the victim will run into DNS_PROBE_FINISHED_NXDOMAIN error when trying to access one of the blocked websites. In fact, it has been noticed that the ransomware attempts to block websites that publish various how-to guides for computer users. It is obvious that by restricting specific domains, the crooks are trying to prevent the victim from reaching relevant and helpful ransomware-attack related information online. The virus also saves two text files on victim’s computer that provide attack-related details – victim’s public encryption key and personal ID. These two files are called bowsakkdestx.txt and PersonalID.txt.

After all these modifications, the malware doesn’t stop. Variants of STOP/DJVU have a tendency to drop AZORULT password-stealing Trojan on compromised systems. This threat has a lengthy list of capabilities, such as:
- Downloading malware to the computer and running it;
- Stealing Steam, Telegram login credentials;
- Viewing or deleting files on victim’s computer;
- Stealing cryptocurrency wallets;
- Stealing browser cookies, saved passwords, browsing history and more;
- Allowing the attacker to perform other tasks on victim’s computer remotely.
Consider the huge amount of damage done by the crypto-virus and the Trojan it brings alongside it, we recommend securing your system as soon as possible. Our team recommends a 2-step rescue plan: remove LSSR ransomware virus and related threats using professional antivirus software first. For this task, you should use an up-to-date software and our team recommends INTEGO Antivirus. Next, we suggest scanning with RESTORO to repair virus damage caused for Windows OS files.
Ransomware Summary
Name | LSSR Ransomware Virus |
Type | Ransomware; Crypto-malware; Virtual Extortion Virus |
Family | STOP/DJVU |
Encryption type | RSA Salsa20 |
Previous versions | DARJ DAZX, TYWD, TYCX, TYOS, TYPO, JYWD (find full list here) |
Version | 313rd |
Extension | .lssr |
Dropper | SmokeLoader (see VirusTotal details) |
Damage | The ransomware encrypts all files on victim’s PC using RSA Salsa20 algorithms. Consequently, locked files become impossible to open. The virus marks such files with an additional .pooe extension. The malware also deletes Volume Shadow Copies and adds a list of restricted domain names to Windows HOSTS file. |
Ransom note | _readme.txt |
Ransom demand | $490-$980 in Bitcoin |
Distribution | Hides in illegal torrent downloads, cracked software, key generators or tools like KMSPico. |
Detection names | Trojan:Win32/Glupteba (Microsoft), Glupteba.Backdoor.Bruteforce.DDS (Malwarebytes), TR/AD.InstaBot.bfsbw (Avira), HEUR:Exploit.Win32.Shellcode.gen (Kaspersky), Trojan.GenericKD.36669904 (B)(Emsisoft), Trojan.GenericKDZ.76128 (BitDefender), W32.Trojan.Gen (Webroot) see all detection name variations on VirusTotal |
Removal | Remove ransomware and related malware from your PC using professional software of your choice. We highly recommend using INTEGO Antivirus. To repair virus damage on Windows OS files, consider scanning with RESTORO. |
REPAIR VIRUS DAMAGE
Scan your system for FREE to detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically. Includes Avira spyware/malware detection & removal engine.

Ransomware distribution techniques
When it comes to ransomware distribution, it can be said that malevolent actors typically use malicious email spam, illegal online downloads or fake decryption tools as the payload delivery vectors. Speaking of STOP/DJVU variants such as LSSR virus, almost all of them can be found in torrent downloads, specifically software or game cracks or tools like KMSPico. According to victims’ reports, these are the names of programs that criminals use to create fake cracks and deliver file-encrypting virus variants in them:
- Adobe Photoshop;
- Corel Draw;
- Cubase;
- Adobe Illustrator.
Cybersecurity experts recommend avoiding suspicious websites that offer free ways to install paid software. It is always better to support legitimate software developers rather than paying hefty ransoms for criminals later. Therefore, if you’re looking for a real and fully working software version, head straight to its developers’ websites get it from there.
Another very common ransomware distribution technique is attaching a maliciously modified file to an email and distributing it to thousands of potential victims. The attackers usually get such email lists from various data leaks. Nowadays, the attackers can attach a malicious script into various popular file formats, including DOCX, XLS, PDF and others. The script can connect to an external resource (internet website that contains malicious file), download it from there and run it on victim’s computer.
Typical red flags in such emails are:
- Urgent message tone and suggestions to open attached contents immediately;
- Claims about an invoice or another important document that needs to be reviewed instantly;
- The sender pretends to be someone from a well-known company;
- Spoofed email address.
Our advice is to only open emails from people you know and communicate regularly, also only open emails that you expected to receive. Do not let your curiosity take over, because if you didn’t expect an invoice or a shipment from anyone lately, there is no reason to open such file at all. If you absolutely need to, please download the attachment first and scan it with an up-to-date antivirus before trying to open it.
Final ransomware distribution strategy that we must mention is fake decryption tools. Actors from other ransomware strains such as ZORAB were noticed uploading fake STOP/DJVU decryption tools to shady websites, luring victims to download them. Sadly, this would only result in a double file encryption. Believe us, if an official decryption tool would exist, you wouldn’t need to search for it on shady websites – all the well known and reputable ones would be writing news about it.
Remove LSSR ransomware and decrypt your files
Follow the instructions given below to remove LSSR ransomware virus and other malware from your PC professionally. We highly recommend securing your PC with INTEGO Antivirus, then scanning with RESTORO to repair virus damage on Windows OS files.
Now that you have completed LSSR ransomware virus removal, consider taking the following actions:
- Inform your local cybersecurity authority about a case of a STOP/DJVU ransomware attack.
- Use data backups to restore as many files as possible.
- Follow the given instructions to decrypt or repair files affected by STOP/DJVU versions.
- Change your passwords for websites you have accounts for and have login credentials saved in your browser. This is recommended due to the fact that Azorult Trojan is capable of stealing them. Do not forget to change Steam, Telegram and Skype passwords as well.
OUR GEEKS RECOMMEND
Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
LSSR ransomware virus Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove LSSR ransomware virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube.
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove LSSR ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.
Special Offer
Compatibility: Microsoft Windows
See Full Review
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Decrypt LSSR files
Fix and open large LSSR files easily:
It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.
- Create a copy of encrypted file to a separate folder using Copy > Paste commands.
- Now, right-click the created copy and choose Rename. Select the LSSR extension and delete it. Press Enter to save changes.
- In the prompt asking whether you want to make the changes as file might become unusable, click OK.
- Try opening the file.
STOP/DJVU decryption tool usage guide
STOP/DJVU ransomware versions are grouped into old and new variants. LSSR ransomware virus is considered the new STOP/DJVU variant, just like DARJ DAZX, TYWD, TYCX, TYOS, TYPO, JYWD (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.
Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.
In order to test the tool and see if it can decrypt LSSR files, follow the given tutorial.
- Download the decryption tool from Emsisoft.
- Click the little arrow next to your download and choose Show in Folder.
- Now, right-click the file and choose Run as Administrator. If asked, enter administrator's password.
- In UAC window, click Yes.
- Click Yes to agree to software terms in both windows.
- The tool will automatically include C:// disk as a location to decrypt. The file recovery tool will prepopulate the locations to scan, including connected data storage drives or network drives. Click Add folder if you wish to add additional locations.
In Options tab, you can choose to keep encrypted file copies. We recommend leaving this option selected, especially if you do not know if the decryption tool will work. - Click Decrypt to start restoring LSSR files. You will see the progress in the Results tab. Here, you can see messages from the tool, such as whether the decryption procedure is successful, or you need to wait for an update.
You might also be informed that online key was used to encrypt your files. In such case, the decryption tool won't work for you, and the only way to recover your files is to use a data backup.
Meanings of decryptor's messages
The LSSR decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:
Error: Unable to decrypt file with ID: [example ID]
This message typically means that there is no corresponding decryption key in the decryptor's database.
No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible
This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.
Result: No key for new variant offline ID: [example ID]
This ID appears to be an offline ID. Decryption may be possible in the future.
If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your LSSR extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.
Report Internet crime to legal departments
Victims of LSSR ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:
- In the United States, go to the On Guard Online website.
- In Australia, go to the SCAMwatch website.
- In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.
- In Ireland, go to the An Garda Síochána website.
- In New Zealand, go to the Consumer Affairs Scams website.
- In the United Kingdom, go to the Action Fraud website.
- In Canada, go to the Canadian Anti-Fraud Centre.
- In India, go to Indian National Cybercrime Reporting Portal.
- In France, go to the Agence nationale de la sécurité des systèmes d’information.
If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.
Another recommendation is to contact your country's or region’s federal police or communications authority.
Frequently Asked Questions
You can only open LSSR files if you have the decryption key, or if you were affected by offline encryption type.
To figure out whether you were affected by offline encryption, please go to C:/SystemID/PersonalID.txt and see if the string inside of it ends in t1. You can also try using Emsisoft Decryptor for STOP/DJVU.
Please follow the guidances provided by the official LSSR decryption tools and believe what they say. If they say it is impossible to decrypt, it really is so. There is no magic tool or human capable of decrypting your files hiding somewhere. Encryption is a technique created to be nearly impossible to decrypt without a special private key (held by the criminals).
We advise scanning with anti-virus, anti-malware, malware removal tools or software like RESTORO to eliminate virus damage on the system. If you do not trust using a single tool, try running one after another. However, we do not recommend keeping several security programs on a computer at once as they can interfere with each other's work.
Beware of fake LSSR decryption tools circulating around the web. Cyber criminals are uploading them to various shady websites, also might be promoting them via suspicious Youtube videos. These programs can infect your computer even more heavily (Trojans, miners, etc.). We suggest being extremely cautious around the web. If there will be an official STOP/DJVU decryption tool available, it will be widely discussed in public media.

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Leave a Reply