BORA ransomware damage can be reversed using free STOP DJVU DecryptorThe virus demands money in exchange for a decryption toolThreat SummaryExplanation on how do victims get infected with STOP/DJVU ransomware versionsRemove Bora ransomware virusDecrypt .Bora extension files
STOP/DJVU ransomware version uses extremely strong encryption methods that are almost impossible to decipher. As it uses asymmetric encryption method, it locks all files (documents, photos, videos, audio files, databases, and other data) using a public key, but to decrypt .bora file extension files, the victim needs the private key, which is held by the cybercriminals. The ransomware creators seek to extort the victim and suggest paying a ransom in exchange for the decryption key and software. The instructions on how to obtain these recovery tools are described in the ransom note called _readme.txt. The ransom note states that the victim can recover data that was encrypted, but the only method to do so is to purchase a decryption tool from the attackers. As proof of STOP decrypter existence and functionality, the attackers suggest sending one .bora file to them for free decryption via provided emails – gorentos@bitmessage.ch, amundas@firemail.cc or gerentoshelp@firemail.cc.
The virus demands money in exchange for a decryption tool
To recover all data, the victim is advised to pay a large sum of money, which depends on how fast the victim manages to contact the attackers and happens to have that amount of money in the bank account. The original ransom amount is $980, but if the victim rushes to contact the attackers and pay within 72 hours, the attackers slice the price tag in half and demand $490, which, needless to say, is still a hefty sum. In addition, the attackers want to receive it in Bitcoin cryptocurrency. It is obvious that not everyone has so much money to spare for some cybercriminals. Besides, you still get no guarantee that the attackers will provide Bora decryption tools for you – all they want is to collect ransoms. In addition, victims who pay up simply prompts the attackers to continue their malevolent activities. Therefore, we do not suggest paying the ransom under any circumstances. This ransomware variant is almost identical to the previous ones – the 170th version RECO ransomware, also KUUB, BOOT, NOOS and NESA variants. All of them are identical, the only thing that differs is the file extension used to mark the files. If you have been infected with this STOP/DJVU malware variant, we strongly advise you to remove BORA ransomware immediately. Under other circumstances you can try to delete malware manually. However, in this case, we recommend using the guidelines provided below the article. Boot your PC in Safe Mode and then eliminate the threat and other malicious programs. You can use an antivirus software of your choice. It is important to do it as soon as you can as this ransomware is known to install Azorult password-stealing virus on the system.
Threat Summary
Explanation on how do victims get infected with STOP/DJVU ransomware versions
Bora, Boot and other DJVU ransomware variants circulate around with the help of malicious spam. They can also lurk in online files that people download for illegal activation of paid software. For example, if you are looking for a paid game or program to download via peer-to-peer programs like Torrent or eMule, most likely you will be instructed to activate the software using crack or keygen, and these types of tools can carry ransomware payload. We strongly advise you to stay away from such download sources and rather choose paid, but legal ways to get programs that you want. It is way better than end up with the .bora file virus on your computer. To prevent a ransomware attack, stay attentive as you browse through online resources. Besides, if you do not want your computer to be infected, always keep antivirus with real-time protection on your computer. Finally, to avoid getting yourself in the worst scenario possible, create data backups regularly. Keep them in an EXTERNAL storage device (unplugged from your PC). Certain ransomware variants can get access to your online clouds and encrypt files there. Therefore, such storage option is not the best idea when it comes to crypto-viruses.
Remove Bora ransomware virus
If you want to remove Bora ransomware virus, read the instructions provided below carefully. Once you complete them, use a robust antivirus to eliminate malicious software remains from your computer. Please note that Windows Defender might not be efficient enough to eliminate the virus, so you might have to download a stronger antivirus solution. There are both free and paid options available for your choice. Once the Bora ransomware removal is complete, you need to do several things: OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.
Alternative software recommendations
Malwarebytes Anti-Malware
Method 1. Enter Safe Mode with Networking
Before you try to remove the virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it: Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10 users Now, you can search for and remove BORA ransomware files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable malware removal program. In addition, we suggest trying a combination of INTEGO Antivirus (removes malware and protects your PC in real-time) and RESTORO (repairs virus damage to Windows OS files).
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future. Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Decrypt .Bora extension files
Victims infected with this ransomware variant can restore files using STOP DJVU Decryptor created by Emsisoft and Michael Gillespie. Bora virus uses OFFLINE and ONLINE keys for decryption (or one of them). You might succeed to recover only part of them, but it is still an achievement. To identify if some of your files were encrypted using OFFLINE key, open the _readme.txt file and check the Personal ID section. If you can see one of a few keys, look at their last symbols. You can also identify if you were infected with the OFFLINE key if your personal ID ends with t1. If your files were encrypted by this ransomware variant, check this tutorial on how to use STOP/DJVU decryptor to recover .bora extension files. When it comes to ransomware, typically the only way to restore some files for free is from your personal backups. However, in certain cases decryption keys get leaked or, if bigger institutions like FBI step in, chances to find out data required for data recovery emerges. In this case, you should thank Emsisoft & Michael for their hard work.
