They will elaborate that YBER ransomware virus has compromised their entire files, including documents, pictures, and every other data contained in the computer and for them to be able to retrieve them, ransom would have to be paid. The cybercriminals would claim that very strong encryption key was used but once the victim pays ransom, they would decrypt the files for them. These two email addresses: support@sysmail.ch and helpsupportmanager@airmail.cc. would also be contained in the message and the victim would be expected to respond via them. Furthermore, prices of decryption services, as well as payment conditions, would also be attached alongside. It will state that victims would be afforded a 50% discount on the ransom fee if they can be able to pay within 3 days or 72 hours of being notified. Therefore, they would have to $490 instead of the normal $980 ransom fee but if they fail to pay within that period, only the full ransom would be acceptable to them. However, if the victim goes ahead to contact them, they will inform him payment can only be made with cryptocurrency of their choice. So, the victim would have to purchase the cryptocurrency equivalence of the ransom and pay into a wallet address they would send to him. They make use of this channel because of the anonymity it provides and thus avoid any chance of being traced and arrested. To show they have what it takes to restore the victim’s encrypted data, they may request for excerpts to be forwarded to them for test decryption. Our in-house cybersecurity experts recommend that victims SHOULD NOT PAY RANSOM and it’s interesting to note that FBI equally gave similar recommendation. Victims should understand that paying ransom does not mean the cybercriminals would honor their part of the bargain. Also, when you pay ransom, you’re encouraging them to continue earning from their criminal activity and they would have more funds to recruit additional hands and grow their capacity. Already, ransomware operators extort millions of dollars from victims across the globe but all hands must be on deck in order to stop them or at least reduce their activities to the barest minimum. Moreover, cybercriminals are known to drop deceptive Trojans like VIDAR and AZORULT that would infiltrate an already compromised computer and steal vital personal information such as cryptocurrency wallets, banking details, credentials for software account login, passwords etc. They could use these sensitive details to commit more fraudulent acts like theft or blackmail. Victims of any STOP/DJVU variant should endeavor to remove YBER ransomware from their computer without any delay. This can be done effectively with genuine and reliable antivirus while the computer is made to run on Safe Mode with Networking. One of the best antivirus for Windows is INTEGO Antivirus, which ensures 24/7 protection against malware. Additionally, the tool that we usually recommend using for repairing virus-affected Windows OS files can be downloaded here – RESTORO.

Ransomware Summary

REPAIR VIRUS DAMAGE

Methods used in distributing Ransomware

One of the most common ways computer users trigger variants of STOP/DJVU ransomware virus is when they download malicious torrents. The cybercriminals would hide the virus in “cracks” and fake key generators among other pirated software copies and they become activated when uploaded in any computer. Majority of victims over the years have reported using certain software copies downloaded illegally before realizing they were infected. Listed below are some of the software copies cybercriminals usually exploit in spreading ransomware:

Cubase;Adobe Photoshop;Fifa 20;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;VMware Workstation;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

Computer users that have formed habit of visiting online software torrents should desist from doing so because it’s quite risky. Such places are a haven for cybercriminals and they usually prey on unsuspecting visitors. Moreover, downloading copyright contents illegally can be subject to prosecution in law court. Instead of risking all these, it is much better to obtain software contents legitimately. Whatever price the content developers request for can’t be compared to the huge sums of money cybercriminals usually demand from their victims. Likewise, you won’t be endangering your important and sensitive personal data. Another distribution method commonly used by cybercriminals is through malicious email attachments. When it comes to this method, they have continuously upped their gimmicks in desperation to continue swindling more victims. They often disguise as genuine their messages as if they were sent for authentic purposes. Making use of platforms that allow JavaScript or Macro Functions such as DOCX, PDF or XLS, they will create believable emails alongside malware-carrying attachments. Such emails will be disguised to appear they coming from reputable brands or acquaintances with enticing names/headings such as Order Summary, Invoice or Tracking Details among others. Sometimes they make use of email spoofing techniques to obfuscate the actual originating email address. When faced with such suspicious emails, you’re advised to apply caution and not just open the message or the accompanying attachment because doing so can trigger the activation of ransomware on your computer. Victims of STOP/DJVU often assume that the worst has happened and they throw caution to the wind in their search for decryption solutions. Unfortunately, most of the websites claiming to provide decryption services are fraudulent. More often than not, the rogue operators behind them have ulterior objectives such as spreading of other versions of ransomware like ZORAB through the so-called STOP/DJVU decryptors.

More details about the ransomware

This section covers the technical aspect of what happens during YBER ransomware attack. The thing the ransomware does is to set up a build.exe or build2.exe and also winupdate.exe (the fake screen that displays Windows update). The ransomware then hooks up with https[:]//api.2ip.ua/geo.json before saving the outcome on geo.json file. The ransomware now begins information gathering whereby important details about the computer geolocation, including its zip code, geolocation, latitude and longitude, time zone etc. would be compiled and sent to central server. The image below is an example of geo.json files. The virus also gathers information about computer’s hardware/software details as well as active processes into information.txt file as shown below. The malware will then make use of country code to determine if the geolocation is within any of their encryption protected countries. The list includes Russia, Tajikistan, Kazachstan, Ukraine, Armenia, Uzbekistan, Belarus, Kyrgyzstan and Syria. Once it can determine that the location is within any of these countries, it will automatically stop any further action. However, if it indicates negative, the ransomware would collect online key from the central server which it now combines with the victim’s ID before forwarding them to bowsakkdestx.txt file and to PersonalID.txt file. Example of these files is shown in the image below. In situation whereby the ransomware couldn’t get hold of an online encryption ID, it will opt for offline encryption ID. Online ID’s are unique per victim while offline ID are uniform for all victims of the same variant. Victims can easily decipher between online and offline ID because the latter would contain t1 characters at the end of the personal ID. If offline ID is used, it means there is a possibility that one could decrypt .yber files going forward. More in this is provided in this guide. At this juncture, the ransomware will commence full data encryption process. It will scan every folder and encrypt the files with the Salsa20 algorithm before locking the encryption with the RSA-2048 key. While this is still going on, files contained in the computer will be marked with additional extensions. Shown in the screenshot below is an example of the _readme.txt ransom note the ransomware drops in every folder. The virus will start deleting Volume Shadow Copies using the Command Prompt task displayed below: vssadmin.exe Delete Shadows /All /Quiet Before concluding the process, the virus will add particular domains to the Windows HOSTS file and links them with the localhost IP. Once this is done, the victim will be effectively barred from accessing any of those websites. When they click on them, the DNS_PROBE_FINISHED_NXDOMAIN error message is what would appear on the screen. The reason why it does this is to preempt possible attempts by the victim to seek help from some websites. The ransomware would increase the malware load on the computer system, including Trojans like VIDAR and AZORULT as mentioned earlier.

Remove YBER Ransomware Virus and Restore Your Files

The two most important things victims of any variant of STOP/DJVU ransomware should do following a cyber-attack is to inform relevant local authorities about it and also to remove YBER ransomware virus as quickly as possible. To remove the virus, you can use a strong antivirus while your computer is set up on Safe Mode with Networking.Below are the recommended steps that should be taken by victims of ransomware attack: • You should remove the virus as quickly as possible.• Go to the nearest government agency that is mandated to oversee such issues and inform them about it.• Now is the time to put your backup devices to good use, but ensure that the virus is completely removed before plugging any external device to the computer.• Change all passwords that were directly or remotely used on the computer.• You may as well consider learning how to decrypt/repair files that were affected by STOP/DJVU variants. In conclusion, modern use of the cyberspace requires carefulness. Most of the problems associated with ransomware attack can be avoided if computer users apply a little more caution, decency and smartness. If everyone should take proactive measures as outlined in this article, cybercriminals won’t be able to prey on their victims, at least not on the current scale. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove YBER Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove YBER Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt YBER files

Fix and open large YBER files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. YBER Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt YBER files, follow the given tutorial.

Meanings of decryptor’s messages

The YBER decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your YBER extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of YBER Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.