Geek's Advice

SQPC ransomware seeks to take all your files hostage

SQPC ransomware is a file-encrypting virus which is the 224th version of STOP.DJVU. The virus aims to make victim’s personal files inaccessible and force him/her to pay a ransom to the cybercriminals. To make infected files recognizable, the ransomware marks each of them with additional .sqpc file extension. The malware creates and drops _readme.txt ransom note in every affected folder, and the note contains a threatening message from cybercriminals – pay a ransom ($490-$980 in Bitcoin) or lose your files for good. To contact the criminals, the victim is advised to write to helpmanager@mail.ch or reserve e-mail address restoremanager@firemail.cc.

The ransom note (“_readme.txt“) explains that all personal files such as images, photos, documents and videos have been encrypted. In order to decrypt .sqpc files, the victim is instructed to pay a ransom in Bitcoin. According to the criminals, the victim may pay a lower price with 50% discount if he/she contacts the attackers via provided emails within 3 days (72 hours). In such case, the ransom price is $490. However, if the victim delays contacting the attackers, the ransom price will be worth $980.

The note also instructs to check for criminals’ reply in Spam or Junk folders in case no answer is received within 6 hours after writing to helpdatarestore@firemail.cc or helpmanager@mail.ch. These two emails have been used in many previous DJVU versions, such as MPAL, QEWE, LEZP, MPAJ and others.

If you have been affected by SQPC file virus, we strongly advise you not to pay the ransom. Often times, ransomware victims pay the ransom in a rush, but criminals fail to provide working keys due to flaws in ransomware. Moreover, remember that cybercriminals are quick to vanish once they receive what they wanted – your money. In addition, another reason not to pay the ransom is that by paying, you would fund their malicious business and motivate them to create malware continuously.

Threat Summary

Name	SQPC ransomware virus
Type	Ransomware; file-encrypting malware
Version	224th version of STOP/DJVU
Ransom note	_readme.txt
Ransom price	$490 or $980
Extension	.SQPC file extension
Detection names	Win/malicious_confidence_100% (W), A Variant Of Win32/Kryptik.HCSI, Trojan-Ransom.Win32.Stop.mh and others (full list on VirusTotal)
Symptoms	Ransomware starts the attack by disabling Windows Task Manager and displaying a fake Windows update screen. It then encrypts and marks all files with .sqpc file extensions. Additionally, files named _readme.txt will be dropped in every affected folder. The ransom note tells that there is no way to restore files except of paying a ransom.
Contact emails	helpmanager@mail.ch or restoremanager@firemail.cc
Associated processes	F820.tmp.exe, D7CA.tmp.exe or similar; Winupdate.exe (fake Windows update prompt)
Distribution	Distribution is based on software cracks, KMSPico, keygens and similar illegal downloads
Removal	Use anti-malware to remove malicious remains from your computer. To identify and repair virus damage on Windows OS files, we recommend using RESTORO
Post-removal steps	Restore files using data backups, or, if you have been affected by the offline encryption, wait for STOP Decrypter update. Change all of your passwords.

Ransomware installs a password-stealer and modifies Windows HOSTS file

During the attack, SQPC virus displays a fake Windows update prompt and disables Windows Task Manager so that the victim could not end the malicious process rapidly.

Screenshot of the fake Windows update displayed by the ransomware:

Next thing it does is install AZORULT Trojan on the system. This additional malware piece is designed to steal login credentials (usernames, passwords) from victim’s computer and transmit them to cybercriminals. Therefore, the primary thing you need to do is eliminate malware from your computer before taking actions to recover your files.

In addition, you might discover a fact that you can no longer open certain Google search results or specific websites after SQPC ransomware attack. This happens due to the virus’ ability to modify Windows HOSTS file and restrain the victim from connecting to certain websites.

We strongly advise you to remove SQPC ransomware virus using a software that includes anti-malware tool. RESTORO has Avira AntiVirus engine installed on it, besides, it can repair damaged Windows OS files (such as modified HOSTS file), so you might want to try it. Please read the instructions provided below this post to understand how to remove malware safely.

Ransomware infects computers via illegal downloads – stay away from them

Ransomware type threats are typically distributed via email attachments, deceptive links, compromised websites pushing downloads or, in case of STOP/DJVU, malicious illegal downloads. To be precise, the ransomware operators tend to hide this virus in software cracks and keygens. Therefore, if you have suddenly decided to download a torrent for a paid software to have it activated for free, keep in mind that there’s a high chance it contains STOP/DJVU variant like SQPC virus. Therefore, we suggest you to think twice before taking such risky decisions.

Some of the downloads known to infect people with this virus are KMSPico, game cracks, Photoshop cracks, 3D modelling software cracks, and other restricted files. Please, consider purchasing legitimate software licenses instead of looking for their illegal copies online. Cyber criminals take advantage of saving users because such illegal downloads sadly are very popular.

Guide on preventing ransomware infections

In order to avoid ransomware attacks, we strongly advise you to refrain from opening suspicious email attachments (deceptive emails often have words “urgent”, “important” “your eyes only” and similar phrases in the subject field and claim to be delivering an imporant document to the victim. Moreover, avoid using dubious download managers and visiting shady-looking websites. In addition, downloading software cracks and keygens is a strong no-no. To avoid hidden malware attacks, you should only obtain software license keys from the developer or a trusted vendor only.

Best way to remove SQPC ransomware virus

The easiest way to remove SQPC ransomware virus is to delete it from Safe Mode with Networking. The point of booting your PC in this mode is to provide a safe and clean environment to eliminate malicious files and other components without being interrupted by ransomware processes. Please use the instructions provided below to learn how to boot your PC in this mode and remove the virus safely.

Once SQPC ransomware removal is complete, we strongly suggest you to repair damaged system using RESTORO. It can fix damage done to Windows OS system files.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

SQPC ransomware FAQ