The _readme.txt notes also suggest that all of victim’s files, including photos, videos, archives, documents and databases have been encrypted with strongest encryption algorithm and unique key generated for the victim. Clearly, this is a huge damage since we all keep important files on our computers – study or work related as well as personal memories. The note goes on to explain that the only method to recover files is by paying up what the crooks demand, and leave two email addresses so that the victim could write a message to them – support@sysmail.ch and supportsys@airmail.cc. They suggest sending one encrypted file (preferably one without valuable data in it) to the attackers via email to receive a decrypted version of it. The note also includes decryption tool pricing, which varies depending on how fast the computer user decides to contact the criminals and pay up. As explained in the note, the ransom amount will be cut by 50% and set to $490 for those who manages to arrange an agreement with the criminals within 72 hours (3 days) from the infection timestamp. If delayed any longer, the decryption tool will cost $980. Victims who decide to contact the attackers will receive further instructions on how to pay the ransom. The criminals only accept cryptocurrency as a payment form, ideally, in Bitcoin. Such transactions cannot be traced down by law enforcement agencies and this is exactly what the attackers want. We must emphasize the importance of saying no to ransom payments. In general, you should follow the advisory of FBI when it comes to ransomware attacks. Here are some arguments why you should refuse to pay up:

Chances to recover files are slim even if you pay the ransom;Paying the ransom helps cybercriminals to continue their operations and motivates them;This ransomware tends to install information-stealing Trojans on the system, so the blackmail will continue;Paying a ransom might be considered illegal in your area of residence.

Speaking of additional damage caused for the infected system, this ransomware variant is known to drag VIDAR or AZORULT Trojans into the system. Both of these threats are capable of stealing browser-saved login credentials for various websites, in-app login credentials (such as Skype or Telegram), also browsing history, cookies, banking details and even more. Collection of such sensitive data can come in handy for cybercriminals who might be planning to blackmail you further. All things considered, it is best to remove PPHG ransomware virus and related malware from your computer – the sooner, the better. For this matter, you should follow instructions presented below this article to learn how to boot your PC in Safe Mode with Networking. For best results, we recommend using an up-to-date antivirus software. Our team trusts INTEGO Antivirus which we find excellent in removing malware. For repairing virus damage on Windows OS files, download RESTORO and run a full system scan.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware Distribution Techniques Commonly used by Cybercriminals

STOP/DJVU ransomware variants, including PPHG virus, are known to spread via illegal online downloads. Cybercriminals tend to prey for potential victims who are looking for ways to activate paid software versions for free, or, in other words, search for software cracks and 100% full working versions of popular programs. These typically can be downloaded via Peer-to-Peer (P2P) file sharing networks using a torrenting client. Another way these malicious downloads are promoted is via rogue websites offering password-secured archives containing a setup which is nothing else than a malware installer. Running such file compromises the system in seconds instead of installing the user-desired software. Victims of previous STOP/DJVU versions report downloading pirated versions of these popular programs only to end up with all of their computer files encrypted:

KMSPico (illegal Windows activation tool).Fifa 20;Microsoft Visio Pro;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;Cubase;Adobe Illustrator;League of Legends;VMware Workstation;Internet Download Manager;Adobe Photoshop.

It is a well-known fact that pirated software versions are packed with malware. Even if you do not notice anything suspicious at first, the malware included might be programmed to start after a specific time period. No matter what, we strongly recommend you to support legitimate software developers and obtain legitimate license keys. Otherwise, the damage caused by illegal downloads might result in much higher expenses and loss of data as well as personal information theft. If you’re in need for a specific computer application, make sure to visit its official developer’s website or look for deals on confirmed partners’ sites. Victims of STOP/DJVU ransomware should also be careful around suspicious websites offering miracle decryption tools as these can hide additional malware in them. You must understand that encryption is a complicated procedure and reversing it is extremely complex and time-consuming procedure. Therefore, rely on trustworthy resources only. At the moment, files encrypted by STOP/DJVU can only be decrypted in case you’re affected by an old version or offline encryption type (more on this later). You can also repair certain data formats with minimal data loss as explained in this guide. Watch out for scammers offering their services via Instagram or Whatsapp as these can steal your money and disappear into thin air.

More on the modus operandi of this ransomware

If you’re keen to find out how PPHG ransomware operates and what is the order of its activities on your computer, this section is for you. The malware itself arrives as a bunch of processes, but the most relevant of them are these:

1B6G.exe. The ransomware uses randomized 4-character names for its main executable. This file is responsible for data encryption.build.exe and build2.exe. These are considered helper processes.winupdate.exe. Certain variants of STOP/DJVU tend to run this process in order to display a fake Windows update prompt for the victim.

An interesting detail about this ransomware is that it doesn’t attack computers situated in specific countries. To find out whether the data on the computer can be encrypted, it first requests a response from https[:]//api.2ip.ua/geo.json, which results in geo.json file dropped on a computer. This file contains victim’s computer’s IP address, country, city, zip code, longitude, latitude and other details. You can see a screenshot of the said file examples below. The virus then compares if the victim’s country matches one from its exception list: Ukraine, Russian Federation, Syria, Armenia, Kyrgyzstan, Tajikistan, Kazachstan, Belarus, and Uzbekistan. If a match is detected, the ransomware stops itself and doesn’t proceed to data encryption phase. Otherwise, it proceeds. Another file created by the virus is called information.txt. It contains details concerning computer’s hardware, active processes and installed software list. You can see a screenshot of this file below. At this point, the ransomware requests a unique encryption key from its Command&Control server. If it succeeds to retrieve it, victim’s files will be encrypted with so-called “online encryption” or, in other words, the encryption key used will be unique for the victim. This decreases the chances to recover files to a minimum. If the connection with C&C server fails, the virus switches to so-called “offline encryption” mode and uses a hardcoded offline encryption key instead. This key is identical for all victims subject to offline encryption by the same virus variant. This encryption type has slightly greater chances to be cracked, since if someone pays the ransom and shares the decryption key with malware researchers, all offline encryption victims can decrypt .pphg files. However, retrieving the key in such manner takes a long time, so victims should be very patient and check for updates here. To save the encryption key and victim’s ID, the ransomware creates two files: bowsakkdestx.txt and PersonalID.txt. The latter is used to store the ID only, while the first one contains both the key and ID. You can see screenshot of these files below. The virus then begins encrypting all of computer-stored files with Salsa20 + RSA-2048. To make affected data distinguishable, the ransomware also appends additional extension to their filenames. To inform the victim about the cyberattack, the virus drops _readme.txt note in each folder. Contents of this file are shown below. Finally, the ransomware modifies Windows HOSTS file by uploading a set of domains to restrict victim’s access to. It is believed that ransomware operators do not want the victim to reach helpful information online. As a consequence, in attempt to visit any of the blocked URLs, the victim runs into DNS_PROBE_FINISHED_NXDOMAIN error in web browser.

Remove PPHG Ransomware Virus and Decrypt Your Files

The most important task to do after getting infected with such notorious malware is to remove PPHG ransomware virus and associated threats from the system. For this, we suggest booting the PC in Safe Mode with Networking (as explained below) and running your antivirus or anti-malware software. Our team recommends using INTEGO Antivirus as we find it highly effective. On top of that, you may want to go ahead and download RESTORO which is excellent for repairing virus damage on Windows OS files. There are some additional actions victims are advised to take after PPHG ransomware virus removal:

Report the ransomware attack incident to a local law enforcement agency.Use data backups to recover as many files as possible.Learn possible ways STOP/DJVU-encrypted files could be repaired or decrypted.Change all passwords used on the infected computer.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove PPHG Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove PPHG Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt PPHG files

Fix and open large PPHG files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. PPHG Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt PPHG files, follow the given tutorial.

Meanings of decryptor’s messages

The PPHG decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your PPHG extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of PPHG Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.