Geek's Advice

VAWE file virus is dangerous ransomware generating money for the attackers

VAWE ransomware is another file-encrypting virus released by the STOP/DJVU family. It is currently the 236th variant available in the cyberspace and attaches .vawe extension after completing file encryption. Afterward, encoded data is unusable. Victims are asked to pay up for the decryption key in _readme.txt ransom note and contact the attackers via helpmanager@mail.ch and restoreadmin@firemail.cc e-mail addresses to get instructions on how to transfer the ransom to them.

Usually, people infect their computers with ransomware-type viruses while downloading applications illegally or continuously clicking on misleading pop-ups. The encryption process starts right after the installation of the main executable file and users see a fake Windows update screen. Additionally, this cyber threat infiltrates AZORULT, an infamous password-stealing software on the side.

VAWE ransomware virus aims to encrypt as many files as possible, if not all data on the computer. For example, before the attack files look like document.doc. After the encryption, all files receive an extension and the name looks like document.doc.vawe. People cannot open or use any documents that are encoded by this virus.

Cybercriminals leave a ransom note to introduce its victims to this file-encrypting virus and demand to pay up for the decryption key. The attackers also try to create a sense of pressure by offering a 50% discount on the ransom within the first 72 hours of the infection and ask to transfer $490. Many people fall for this trick and agree to the demands without reconsidering other options.

Unfortunately, victims from previous versions of the STOP/DJVU family (USAM, TABE, NYPD, NLAH) report that even after the payment, they never received a valid decryption key and were fooled by the attackers. Therefore, we highly recommend not to contact the criminals and never transferring any sums of money. Otherwise, you might also be tricked and lose your savings.

The transcript of VAWE virus ransom note:

ATTENTION!
 
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-N6DOVp7lAY
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
helpmanager@mail.ch

Your personal ID:
–

Instead, the smartest decision would be to remove VAWE ransomware virus right away. We suggest installing and running a full system scan with chosen anti-malware to help you get rid of the file-encrypting virus along with the components of the password stealer, AZORULT. That would be the safest option available for a regular computer user. After virus removal, we recommend running a scan with RESTORO.

However, VAWE ransomware removal will not get back the encrypted files to the primary state. Users would still be unable to open or use any of the documents. Although, our security experts suggest uploading the latest copy of your backup to restore encrypted information. If you do not store backups, learn about alternative methods in STOP/DJVU decryption article.

Ability to block access to security websites

Apart from encrypting the most valuable files on the affected computer, this ransomware is capable to edit Windows hosts file. In fact, it performs certain modifications to prevent their victims from accessing the security websites. Likewise, people cannot open sites that suggest how to get rid of file-encrypting viruses or present ways to restore corrupted files.

Vawe ransomware inserts a long list of security pages to the Windows hosts file. This way, the connection is damaged and victims cannot open pages to get help. If you are also blocked from visiting the malware removal websites, you can learn how to reset Windows hosts file. After you restore the hosts file to the primary state, you should be able to access all sites.

Beware that running a full scan with an antivirus will only get rid of the ransomware but will not reset Windows hosts file to help you access security tools online. Therefore, we strongly suggest you to perform this action yourself and follow the instructions given in the article mentioned above.

Summary: all you need to know

Name	VAWE ransomware
Type	File-encrypting virus
Family	STOP/DJVU
Variant	236th
Versions	USAM, TABE, NYPD, NLAH, ZIPE, PEZI, NILE, OONN
Extension used	.vawe
Ransom note	_ReadMe.txt
Amount demanded	From $490 to $980 depending on the payment time
Contact addresses	helpmanager@mail.ch and restoreadmin@firemail.cc
Damage	This cyber threat not only encrypts information and corrupts it but also installs a well-known password-stealing Trojan, Azorult; Additionally, bans victims from accessing security tools
Decryption	Might be decryptable with Emsisoft Decryptor for STOP/DJVU (future)
Elimination	Regular computer users should opt for an automatic removal process with a reputable antivirus. We recommend RESTORO

VAWE ransomware attack shown on our test system:

Ransomware spread: software cracks and malicious ads

For the past few years, cybercriminals have managed to employ deceptive ransomware distribution techniques and trick regular computer users into installing them on their own. The most popular ransomware distribution methods are to upload the virus under disguise as a legitimate application or trick the user to click on a malicious advertisement.

Security experts warn that it is not only illegal to try to download legitimate software for free but also exceptionally dangerous. The majority of attackers upload ransomware executables looking just like well-known applications. Therefore, those who aim to get software cracks on peer-to-peer (P2P) pages get tricked to install file-encrypting viruses instead.

Furthermore, those who tend to browse on unknown websites might encounter ads with malicious codes. Those advertisements are designed to look like invitations to update well-known software, like Adobe Flash Player. If the user gets lured into clicking on the update button, he starts an automatic installation of ransomware.

Geek’s Advice team wants to protect computer users from malware infections and have prepared a simple list to help you avoid file-encrypting viruses:

• Browse only on verified and secured websites;
• Try blocking pop-up ads on your browser and never click on them;
• Install applications only from legitimate pages or authorized distributors;
• Avoid pressing on all types of ads, including banners and etc;
• Get a robust antivirus running on your PC at all times;
• Schedule regular scans to maintain system security.

Decryption options: new and old STOP/DJVU virus versions

All ransomware victims wonder are there any other VAWE decryption options apart from restoring files from the backup. In fact, it depends on which version, old or new, was used to encrypt data on your computer. Older variants are designed to employ an offline key in situations where the computer had no Internet connection. Thus, people could be able to try decrypt files using a specific tool by Michael Gillespie.

All virus versions released before August 2019, have a strong chance to be decrypted with the decryptor from Emsisoft. It supports around 148 variants of the STOP/DJVU ransomware family. Unfortunately, all other file-encrypting viruses that appeared after August 2019 use a different encryption method. Thus, a suitable tool is currently under development.

Additionally, people now have a chance to use a unique STOP/DJVU decryption option on the Emsisoft website. The security experts offer to help people restore their data if they have an example of an original and encrypted file. They can upload them here and get a suitable decryption key.

Start VAWE ransomware removal right now

Experts categorize ransomware infections as the most dangerous ones since they can not only encrypt the most valuable data but also stop people from accessing security tools. In other words, people cannot open and run system scans with their antivirus as well as download new security software. Our team warns that you must first boot your computer into Safe Mode to start VAWE file virus removal.

Regular computer users who are not experienced in the tech field are advised to carefully follow the instructions provided below. It is essential not to miss any steps and ransomware has many components that need to be removed for successful virus elimination. Thus, we kindly ask to be attentive while following the guide at the end of this article.

Furthermore, it is impossible for a regular user to remove VAWE ransomware virus manually. The only way to get rid of this cyber threat is to run a full system check with professional security software. If you already have one and it is robust enough to deal with ransomware, head straight to the instructions below.

Those who are not sure if their antivirus will be capable to eliminate ransomware should consider installing a robust one. In addition, our security team can recommend the RESTORO tool for after-care. It is an expert-tested application that is not only useful for the harmful components removal but can also fix virus damage afterward.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.