LQQW ransomware is designed to attack files stored on victim’s computer and connected drives and encrypt the first 150 KB of each file. In order to make affected files distinguishable, the virus also marks them with additional extension. The reason why the ransomware encrypts only part of each file is simple – it is enough to make file inaccessible yet not slow down the whole attack process. This kind of modification also allows reparation of certain file formats with minimal data loss as explained in this guide. The ransom demanded by cybercriminals or simply the price of LQQW decryption tool depends on how fast the computer user writes to the hackers. If this is done within 72 hours, the attackers promise a 50% discount on the decryption tool, which results in $490 in Bitcoin. However, if the victim fails to pay up within the same time period, the price bounces back to full amount which is $980 in Bitcoin. The reason why the attackers demand cryptocurrency rather than US Dollars is because the latter could be used to trace them down, while crypto-based transactions cannot be traced down. In addition, the ransomware operators suggest decrypting one small file for the victim for free, in order to prove that it is worth paying the ransom. Geek’s Advice team’s opinion generally matches with what other cybersecurity experts as well as the FBI has to say regarding ransom payments. Victims are not advised to pay the ransom, no matter what. Here are some reasons why it is not worth wasting your hard-earned money in such way:

The criminals might vanish into a thin air after receiving your money. There are no guarantees they will do their part of the deal after you pay the ransom.Cybercriminals earn millions of US dollars each year from ransomware attacks. The more victims pay, the more people want to join this illegal business and create more ransomware and distribute it more actively. Please, do not contribute to this! In some countries paying a ransom is considered illegal. Viruses that belong to STOP/DJVU ransomware family such as LQQW virus run AZORULT Trojan on compromised systems.

Ransomware’s algorithm explained 

LQQW ransomware virus begins the computer infection by launching a process called winupdate.exe, which displays a fake Windows update on screen. The sole aim of this procedure is to trick the victim into thinking that the computer is undergoing some important updates and needs to be left alone a couple of minutes. Unfortunately, this is the last thing a computer user would want to do – in case of a ransomware attack, it is highly recommended to turn off Internet connection (shut down router, unplug Internet cables) and shut down the computer. The virus then runs a four-character named process, such as 6H4V.exe which is designed to scan entire computer system and encrypt files stored on it. In addition, this process also executes a Command Line task which deletes Volume Shadow Copies from the computer: vssadmin.exe Delete Shadows /All /Quiet Without Shadow Copies, the victim won’t be able to restore some files using System Restore Points (if any were created prior to the ransomware attack). Additional damage that this ransomware does is adding a list of domains to  Windows HOSTS file to restrict access to them. The virus adds various computer-related sites, including microsoft.com and others and maps them to victim’s localhost IP. As a result, whenever the victim attempts to access one of them directly or via a search engine, DNS_PROBE_FINISHED_NXDOMAIN error will come up, stating about DNS resolution error. In order to be able to reach said websites, again, we strongly recommend you to reset HOSTS file back to default. Finally, the virus drops some attack-related files that hold information such as the encryption key (in bowsakkdestx.txt file) and victim’s personal ID string or several of them (in PersonalID.txt file). People who have their computers compromised with LQQW virus should remember that certain STOP/DJVU versions can drop AZORULT Trojan into such computers. It is a highly dangerous Remote Access Trojan (RAT) which can be used by cybercriminals to remotely connect to the computer and steal various information from it or performing other illegal actions such as:

Downloading and running malware to the victim’s computer.Stealing crypto wallets.Viewing or deleting personal files on the victim’s computer.Stealing Telegram, Steam login details.Stealing saved passwords, browser cookies, browsing history and more.

We strongly recommend that you remove LQQW ransomware virus from your computer as soon as you can. In our opinion, the best software to do it professionally is a VB100 certified INTEGO Antivirus. Furthermore, we recommend scanning with RESTORO to repair virus damage on Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques

Speaking of LQQW ransomware distribution techniques, we must mention that they are no different from techniques used to spread other STOP/DJVU virus versions. In fact, the majority of victims report allowing such kind of infection after they decided to download an illegal software crack to their computers using various torrent sharing agents. It seems that cybercriminals tend to disguise this ransomware strain in cracks allegedly meant for these popular programs:

Adobe Photoshop;Corel Draw;Cubase;Adobe Illustrator;Windows activation tools such as KMSPico.

Keep in mind that cybercriminals know that there are many computer users who are willing to try and risk to get a paid software for free, despite the potential risks that come along such downloads. What is even worse is that such computer users will often ignore their security software warnings, thinking that these are deceptive false positives and actually there is nothing to worry about. Sadly, such alerts should NEVER be ignored. If you’re looking for a specific software version, we must stress out that the only place to get it safely is the software developer’s website or a confirmed distributor’s site. You can always look for various discount codes rather than trying to get a program absolutely for free. We can assure you that cybercriminals will ask for a much larger sum of money and might potentially threaten to publish your data online if you decide not to pay up – so it is really not worth the risk. Make sure you only choose trustworthy online sources for your downloads! Email attachments are also a popular way to transmit ransomware payloads. The attackers compose infectious files in the following popular document formats: XLS, DOCX, PDF and name them somewhat official-looking, such as pending payment/invoice/parcel delivery tracking info. However, we strongly recommend that you ignore emails that you weren’t expecting to receive, or at least look for one of the red flags that signal about a potentially malicious/phishing email:

Urgent message tone suggesting that you open the attached files immediately.Claims about vital documents that need to be reviewed immediately.The sender pretends to be from a well-known and reputable company.Spoofed email address;Your email address provider marks the received email as spam.

Victims of STOP/DJVU ransomware variants such as LQQW should beware that ransomware operators might try to deliver a second payload to you, if you decide to search for file decryption tool a little too desperately. In other words, operators behind other ransomware strains such as ZORAB were noticed distributing fake STOP/DJVU decryption tools that were simply ransomware in disguise. We can assure you that once an official decryption tool appears, it will be mentioned by all legitimate news sites and you won’t have to search for such tools on various shady websites.

Remove LQQW ransomware and decrypt your files

Take actions to remove LQQW ransomware virus professionally. To remove the virus automatically, we strongly encourage you to use a robust antivirus software, ideally, a one that provides real-time protection. One of such programs is INTEGO Antivirus which is a VM100 certified software. Finally, you can download RESTORO and scan your computer to repair virus damage on Windows OS files. Once LQQW virus removal is complete, ensure to take the following actions:

Report this incident of cybercrime to your local authority responsible for handling such events.If you have created a data backup lately, use it to restore at least part of your important files.Follow all the given instructions to decrypt or repair files affected by STOP/DJVU versions.We also recommend that you change your passwords, especially for websites that you save login credentials for in your browser.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove LQQW Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove LQQW Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt LQQW files

Fix and open large LQQW files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. LQQW Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt LQQW files, follow the given tutorial.

Meanings of decryptor’s messages

The LQQW decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your LQQW extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of LQQW Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.