They will elaborate that OOII ransomware virus by virtue of the encryption, has rendered useless all documents, pictures, data and every other important information contained in the compromised computer. Therefore, the only way they would hope to ever recover the files would be by paying ransom to the cybercriminals so they could provide decryption solutions. Also included in the messages are two email addresses, namely support@sysmail.ch and helprestoremanager@airmail.cc. which the cybercriminals would hope to communicate further with. Decryption service prices, as well as terms of payment, would also be listed. For instance, they will state that the victim’s ransom amount depends on how fast they can meet up with payment. The default ransom fee is put at $980, but victims will be required to pay 50% or $490 within 72 hours/3 days of being notified, but once the grace period elapses, only the maximum ransom fee would be acceptable. However, more conditions would be given to the victim if they decide to contact the cyber criminals through any of the emails. They will state that payment can be only made by purchasing cryptocurrency that is worth the ransom fee and transferring same to a wallet address they will provide. They obviously use this option in order to avert possible attempts by law enforcement agents to track them down using the payment link. To assure the victim of their expertise to decrypt the files, they often suggest that excerpts of the encrypted files should be sent to them for test decryption but will also warn that such excerpt shouldn’t contain information that could be perceived as important to the victim. Our cybersecurity experts advise that victims should not pay ransom regardless of the pressure from cybercriminals and this view is similar to the FBI’s recommendation regarding ransomware incidents. The reasons why most reputable security agencies strongly advise against ransom payment are listed below:

There is no guarantee of data recovery even after paying huge sums of money as ransom.Ransom payments encourage cybercriminals to continue in their nefarious activities since they would find it lucrative.More funds at their disposal helps them to employ more rogue IT experts and expand their operations.By law, it might be illegal to pay ransom (according to your country’s regulations).

Moreover, this virus often drops information-stealing Trojans such as AZORULT or VIDAR on infected hosts, and these can silently steal your software account login credentials, banking details, cryptocurrency wallets, browsing history, browser-saved passwords and more. This can lead to even more scams and potentially further blackmailing. If you’ve fallen victim to a file-encrypting malware attack, we recommend you to remove OOII ransomware virus as quickly as possible. The best way to do that is to boot the infected computer using Safe Mode and Networking before running genuine antivirus software on it. You can find a guide on how to do it below. It is very important to make use of only genuine antivirus to ensure optimal results. If you’re not sure of what brand to use, then we recommend INTEGO Antivirus because it has top-notch malware detection rate and provides robust real-time protection. Also, it would be best if you considered downloading RESTORO to help restore virus-damaged Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

The most prolific method used by cybercriminals in distributing STOP/DJVU ransomware variants, including OOII virus, is through malicious online torrents. The cybercriminals would load malware on pirated software copies and they become triggered when unsuspecting users download them to their PC. Based on that, it is risky to open so-called key generators or fake cracks on a PC. A good number of victims at different times have reported certain pirated software contents as being used in spreading malware. Some of the most common ones are listed below:

Cubase;Adobe Photoshop;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;VMware Workstation;Various AV software;Fifa 20;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

Based on the explanations thus far, it can be deduced that going to online torrents platforms to download software is a dangerous habit and is not worth the trouble. Cybercriminals actually use them as bait in getting their victims. Moreover, downloading such pirated software contents is illegal and subject to criminal prosecution. Instead, it is a lot better to encourage genuine software content producers by patronizing them and paying the requisite fees attached. Remember that whatever amount you pay will be insignificant compared to what cybercriminals will demand as a ransom fee when you eventually become a victim. On top of that, you won’t be at risk of losing private data to cybercriminals. The problematic aspect is that trying to tell a genuine email apart from the fake malware carrying ones has become difficult in recent times. This is because cyber criminals now mirror their own emails to appear similar to genuine ones. They would also be accompanied with attachments that bear compelling tags such as Tracking details, Order Summary, Invoice or similar ones. They may even leverage email spoofing techniques to hide the actual sender’s email address to throw the recipient off balance. Whatever gimmick they use, it is best to threat with caution. If an email is not being expected or something seems out of place about it, then it could as well be a red flag and shouldn’t be opened. Lastly, those that have become victims of STOP/DJVU ransomware already should ignore certain suspicious websites that claim to offer decryption services. More often than not, such websites were established by cybercriminals hoping to exploit victims who are desperate to find solutions. Their motive is to further spread other variants of ransomware. At the moment, only Emsisoft and DiskTuna have proven to offer decryption solutions that actually work.

Further details about the virus

For those that are wondering about the extent of damage that could have been done on their computer during OOII ransomware attack, this section will explain in detail the technical aspect of what happened. The first thing the virus does following an infiltration is to set up build.exe and build2.exe executables as well as winupdate.exe (the prompt that brings up fake Windows update screen). It then connects to https[:]//api.2ip.ua/geo.json before saving the result in the geo.json file. Afterward, it will commence information gathering of every detail concerning the computer, such as the computer’s time zone, geolocation, zip code, longitude and latitude, and would save it in its geolocation-related database. A screenshot of geo.json file is shown below. It will equally create another file that would contain hardware details, installed software list, active processes and would be stored in information.txt. Making use of the computer’s geolocation detail, the malware will profile it against a list of countries the cybercriminals designated as encryption exempted, namely: Russia, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Uzbekistan and Belarus. If peradventure the malware detects that the computer about to be compromised is domiciled in any of the listed countries, it will instantly close its processes. However, if that’s not the case, the ransomware would then extract online encryption key from their central database and would combine it with the victim’s ID before saving them in the bowsakkdestx.txt file and to the PersonalID.txt file. Displayed below are examples of these files. If for any reason it fails to extract an online encryption key from their server, the ransomware will resort to the use of a hardcoded offline key as an alternative. The offline key is a one-size-fits-all in the sense that it is uniform for every victim of the same virus variant. The appearance of t1 characters at the end of a victim’s ID is an indication that an offline key was used and it offers a higher chance of decrypting .ooii files someday. You can check the details below for more information about this. At this stage, the ransomware will commence the full data encryption process by scanning every folder while encrypting all files with Salsa20 before locking the encryption key using the RSA-2048 key. While this process is still ongoing, it will also mark the files with .ooii extension. Displayed in the screenshot below is _readme.txt ransom note that is usually dropped in each folder. Afterward, the virus will delete the Volume Shadow Copies using the command prompt as shown here: vssadmin.exe Delete Shadows /All /Quiet Before completing the attack, the malware will blacklist certain domains by adding them Windows HOSTS file and also mapping them to the localhost IP. This would effectively prevent the victim from getting any form of help that may be offered in those sites and instead would encounter DNS_PROBE_FINISHED_NXDOMAIN error messages each time they try.

Remove OOII Ransomware Virus and Restore Your Files

Like we always advise, the first thing that should be done once it is ascertained that a PC has been compromised during a ransomware attack is to remove OOII ransomware virus ASAP by making use of ONLY GENUINE antivirus software while the PC is set up on Safe Mode with Networking. This is highly recommended because it will enable the virus removal process to be effective and efficient. If you’re not sure of any antivirus that would be good enough, then you should go for INTEGO Antivirus because in our opinion, it’s one of the best antivirus software available in the market. As an additional step following a OOII ransomware removal, we recommend you to download this tool – RESTORO and scan your computer to identify virus-damaged Windows OS files and repair them (using full version). Once the virus is removed, the following steps should be taken:

Report to local authorities that handle such issues.Make use of any backup device to restore lost files.Learn possible ways STOP/DJVU-infected files could be decrypted.Change all passwords associated with the compromised computer without further delay.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove OOII Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove OOII Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt OOII files

Fix and open large OOII files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. OOII Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt OOII files, follow the given tutorial.

Meanings of decryptor’s messages

The OOII decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your OOII extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of OOII Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.