They will go further to explain that QBAA ransomware virus was able to encrypt all files contained in the infected computer such as documents, pictures and every other data and since they made use of a very strong and complex key, there won’t be any possibility of reversing it by the victim excerpt they pay a ransom fee to them. To facilitate further discussions between them, the cybercriminals will also include two email addresses (support@mailtemp.ch and supportsys@airmail.cc) in the ransom notes so the victim would be able to respond to them. In addition to that, decryption service prices will also be included as well as information about terms of payment. Due to their desperation to receive ransom payment ASAP, they will claim that victims would be able to leverage a 50% discount if they can pay within 3 days or 72 hours of being notified, which brings the ransom fee down to $490. However, failure to meet up within that deadline means only the full ransom fee of $980 would be acceptable. However, if the victim contacts them, the cybercriminals will give further directives that cash payment is not allowed, instead payment can only be made by purchasing cryptocurrency valued at the same amount with the ransom fee and would be transferred to a wallet address of their choice. The apparent reason why they make use of such an anonymous payment system is to preempt any chance of being trailed by law enforcement agents who may come after them. To assure the victim of their capability to decrypt their encrypted files, they may suggest for parts of the files to be forwarded to them for test decryption. Nevertheless, they will add that such parts must not contain information they may deem as vital to the victim. Whatever be the case, our cybersecurity experts recommend that victims should follow FBI guidelines when dealing with issues bordering on ransom payment, and the policy is that ransom must not be paid. You should bear in mind that paying ransom does not guarantee that victims will ultimately recover their lost data. Another reason is that paying ransom will only encourage cyber criminals to continue victimizing others so they could also extort them. Worse still, this virus is known for dropping other Trojans such as VIDAR and AZORULT that steal vital information from the already compromised computer, like software account login details, cryptocurrency wallets, banking details, browsing history and passwords etc. Loss of such sensitive data can lead to more fraudulent acts such as blackmail and theft. For those that are already victims of STOP/DJVU ransomware, it would be in your best interest to remove QBAA ransomware as fast as you can. The best way to go about it is by setting up the infected PC in Safe Mode with Networking before running a reliable antivirus on it. It is important to make use of only genuine antivirus, but if you’re not convinced about any particular one then we strongly recommend INTEGO Antivirus. In addition, many computer users swear by this PC repair software which helps to repair damaged Windows OS files after virus attack without the need to reinstall the OS. You can download it here – RESTORO.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

Computer users usually get their PC infected with different variants of STOP/DJVU ransomware virus including QBAA virus following downloads from online malicious torrents. It should be noted that cybercriminals often hibernate malware in pirated software contents including the so-called key generators and “cracks” which they use as baits in luring their victims. Therefore, downloading from online malicious torrents or trying to make use of such content is highly discouraged. Over the years, certain popular but pirated versions of software are mostly used by cybercriminals as listed below:

Adobe Photoshop;Adobe Illustrator;AutoCad;Tenorshare 4ukey;Opera browser;Corel Draw;VMware Workstation;Cubase;Fifa 20;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

For those that have already formed the habit of indulging in such risky activities such as visiting software torrents online, it is high time you desist from doing so forthwith to avoid becoming a prey to cybercriminals. It is not a good idea to try activate copyright software contents or to gain access to game versions without paying the necessary fees requested by their legitimate developers. On the contrary, it is better to support such genuine software content developers by patronizing them or their third-party affiliates. Also, remember that whatever fee you are charged will always be little in comparison to outrageous amounts usually demanded by cybercriminals as ransom fee, and neither will there be any threat to your vital/sensitive documents. Another way used in distributing ransomware is through malicious email attachments in which cybercriminals often create extremely convincing messages that would be accompanied by attachments crafted on platforms like PDF, XLS, or DOCX. These particular ones are often used because they enable macro functions and JavaScript, both of which can be used in attaching, transporting and triggering payloads from external sources to random computers. Lastly, victims of STOP/DJVU virus should abstain from certain dubious websites that claim to offer amazing decryption solutions because they’re mostly fraudulent and have bad motives. Only a couple of brands known as Emsisoft and DiskTuna have proven track record of providing such services effectively.

More technical details about the malware

This section explains more about the technical aspects of this ransomware and what actually happens during QBAA ransomware attack. The first thing the malware does is to launch build.exe or build2.exe executables as well as winupdate.exe (the window that displays fake ongoing Windows update progress). The virus then makes a connection with https[:]//api.2ip.ua/geo.json and would save the outcome in geo.json file. The malware then commences information gathering of details such as the computer’s geolocation, time zone, zip code, longitude and latitude, and would store them in its geolocation database. Here are two screenshots of geo.json file to demonstrate how examples of this file appear. The malware then creates another file for storing computer’s name, infection timestamp, hardware details, installed software list and active processes at the time of the attack. This file will be named as information.txt and forwarded to cybercriminals’ server. Furthermore, the malware will profile the country code of the computer against their own list of encryption-exempted countries namely; Russian Federation, Syria, Ukraine, Armenia, Tajikistan, Kyrgyzstan, Kazachstan, Uzbekistan and Belarus. If it detects that the location of the computer is within any of these countries, it will immediately cease its actions but if it scales through the geolocation test, it will then extract online encryption key from their server and would combine it with the victim’s ID before saving them in bowsakkdestx.txt file and also to PersonalID.txt file. Shown below is an example of how these files appear. In cases whereby the malware could not extract any online encryption key, it will then opt for the use of a hardcoded offline key which would be uniform for all victims of the same virus variant. You can easily decipher if an offline key was used if it contains t1 characters suffixed to the victim’s personal ID. The use of offline key is advantageous to the victim since it raises hope of decrypting .qbaa files going forward. You can check below for more information pertaining to this. Now it has gotten to this stage, the ransomware will commence full data encryption procedure by scanning every folder and encrypting them with Salsa20 before using RSA-2048 to lock the encryption key. Also, while this is going on, it will mark all other files with extra extensions. Displayed in the image below is a screenshot of _readme.txt ransom note that is often left in all the folders. Next in line will be the deleting of Volume Shadow Copies by making use of the command prompt task as written below: vssadmin.exe Delete Shadows /All /Quiet Lastly, will compile a list of certain domains and will add them to the Windows HOSTS file as well as the localhost IP. This is done to prevent any attempt by the victim to seek help from any of the blacklisted sites that are known to offer support to victims of cyber-attack. The error message DNS_PROBE_FINISHED_NXDOMAIN may appear whenever they try to access any of them.

Remove QBAA Ransomware Virus and Recover Lost Files

Victims of this ransomware and indeed all others should as a matter of urgency remove QBAA ransomware virus from the infected computer by setting up their computer in Safe Mode with Networking as stated earlier and also make use of any genuine antivirus such as INTEGO Antivirus to ensure the computer has become safe again. Moreover, we recommend downloading RESTORO to inspect the computer for malware remains and repair virus damage to Windows OS files. Please go through these steps once QBAA ransomware virus removal is completed as recommended by our team:

Inform local authorities assigned to handle such issues about the cyber-attack.Search for existing data backup drives to restore lost data.This is the time to learn possible ways of repairing files damaged by STOP/DJVU ransomware variants.Change all login credentials that were used on the malware-infected computer.

Nevertheless, it is always best to be proactive by avoiding online activities that could put your PC at danger of being infected with a virus, as outlined in this article. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove QBAA Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove QBAA Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt QBAA files

Fix and open large QBAA files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. QBAA Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt QBAA files, follow the given tutorial.

Meanings of decryptor’s messages

The QBAA decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your QBAA extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of QBAA Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.