They will point out that CCPS ransomware virus has succeeded in encrypted their entire database, including important documents, pictures, and all other files using a very strong encryption key that can’t be breached. Therefore, the victim has no other option than to respond to them to discuss the payment options. The cybercriminals will equally drop two email addresses with which they expect the victim to contact them. The emails are support@sysmail.ch and helprestoremanager@airmail.cc. They will further inform the victim about their decryption service prices and the conditions of payment attached to it. In order to influence the victim to pay ASAP, they will state that complying within a timeframe of 72 hours (3 days) would enable the victim to leverage a 50% ransom fee slash, which brings it down to $490. However, failure to pay within that period means they would have to pay the full amount which they put at $980. But if the victim contacts them through the email they provided, one will be informed that payments can only be done using cryptocurrency. Therefore, they would have to purchase cryptocurrency that is worth the ransom fee and transfer same to a wallet address they would make available for the purpose. They make use of this medium of payment to avoid being tracked by law enforcement agents who may be on their trail. To assure the victim that they have what it takes to restore their files, they may even request for a small portion of the encrypted files to be sent to them for test decryption. Whatever is the case, our in-house cybersecurity team of experts’ advice victims NEVER TO PAY RANSOM, and the same advice is advocated by the FBI in their guidelines about how to respond to ransom demands. The reason why we take this stand is because of the following factors:

Ransom costs a huge amount of money yet there is no guarantee you will recover your encrypted files.Paying ransom encourages cybercriminals to continue constituting nuisance in their desperation to extort victims of ransomware.More funds at their disposal help them recruit more hands, resulting in more victims.It is illegal to pay a ransom.

Unfortunately, cybercriminals have continued to extort millions from their victims. Therefore, more effort is needed to reduce their menace to the barest minimum. Moreover, these sort of malicious virus are known to release other Trojans that steal information such as VIDAR and AZORULT on the already infected computer aimed at stealing vital details like software login credentials, banking details, passwords saved on the computer, cryptocurrency wallets, browsing history etc. Such sensitive details in the wrong hands would most likely result in other scams or blackmails. Victims of this STOP/DJVU malware variant should remove CCPS ransomware as fast as possible to prevent further damage. To be able to remove it properly, it is recommended that you set up your computer on Safe Mode with Networking option before running a strong antivirus with proven efficacy on it. There is a good number of genuine antivirus software out there and there are equally unreliable ones, so you should be careful when choosing. If you’re not sure about which antivirus to go for, then you can make use of INTEGO Antivirus recommended by our experts. It is also recommended to download RESTORO to help repair Windows OS files affected by the virus.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

Downloading software contents from online malicious torrents platform is the most prolific way cybercriminals distribute CCPS virus and other variants of STOP/DJVU ransomware. They usually upload malware-carrying software contents such as fake key generators, “cracks”, pirated games and utility software etc. and when users download such contents on their computer system, they end up triggering ransomware attack. Information gathered from victims over the years has shown there are particular software names that were usually mentioned. The most popular ones are listed below:

Tenorshare 4ukey;VMware Workstation;Adobe Photoshop;AutoCad;Opera browser;Corel Draw;Fifa 20;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

Users that often visit such dangerous online torrents platform are hereby advised to desist from such acts in order to avoid becoming a victim of ransomware. When you try to activate paid software, utilities or even game versions without going through the right channels and paying the necessary fee requested by the original content developers, you may end up becoming a prey to cybercriminals and it’s not worth the risk. Therefore, it is better to obtain your software needs legitimately by visiting the official pages or third party affiliates endorsed by the original content producers. Another medium used by cybercriminals to distribute ransomware is through malicious email attachments. They compose genuine-looking messages that would be accompanied by certain types of documents that were crafted using formats like DOCX, PDF, and XLS. These particular ones are their favorites because they allow JavaScript and other macro functions that are required for payloads to be successfully uploaded and triggered in random computers. Alternatively, they may decide to make use of email spoofing techniques to hide the actual sender’s email address. In situations like this, it is best to apply caution and common sense; is such email expected or is there something fishy about it? If there is nothing out of place about the email, you may proceed to open it otherwise it should be discarded. Furthermore, those that are already victim to any of the STOP/DJVU ransomware variants, including CCPS ransomware should not seek for help from any of the suspicious websites that often advertise dubious decryption solutions because they are mostly fake and intended to be used for scam purposes. At the moment, only DiskTuna and Emsisoft have proven to have data decryption/repair solutions that actually works. Some cybercriminals spread other versions of ransomware disguised as fake STOP/DJVU decryptors and downloading such fake decryptors can lead to multiple file encryptions.

More information about the infection

If you want to understand how much your computer was affected during CCPS ransomware attack, then this section should come handy as it explains the technical aspect of it. First thing this ransomware does is to launch the build.exe or build2.exe executables as well as winupdate.exe (the prompt that opens fake Windows update display). The virus then makes a connection with https[:]//api.2ip.ua/geo.json before saving the response on geo.json file. The ransomware then commences information gathering about every detail concerning the computer such as geolocation related data, time zone, zip code, latitude and longitude while also creating another file for hardware details, software list, and active processes in information.txt. Displayed in the screenshot below is an example of geo.json file. Contents of information.txt file are shown below. The next thing it does is to profile the geolocation of the computer to determine if it falls within any of their encryption-exempted countries, namely; Russia, Uzbekistan, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan and Belarus. If peradventure it shows positive to any of the aforementioned countries, it will abort its mission, but if otherwise, it will then move to the next stage by extracting online encryption key from their server and will merge it with the victim’s ID and then forwards them to bowsakkdestx.txt file. The ID will be saved to PersonalID.txt file separately. Examples of these files are shown in the screenshot below. If for any reason the malware fails to extract any online encryption ID, it will resort to the use of offline encryption ID as a replacement. The striking difference between offline ID and online ID is that the former is uniform for all victims of the same ransomware variant while the latter is unique to every specific victim. It is advantageous for victims if offline ID was used because it will increase chances of decrypting their CCPS files unlike online ID. More details about this is provided below. At this point, the ransomware will commence full data encryption procedure whereby all the folders will be scanned and encrypted with Salsa20 before using RSA-2048 to lock the encryption key. While this is ongoing, the files will be marked will be marked with additional extensions. Shown below is a screenshot of _readme.txt ransom note the virus drops in every folder. Afterwards, the virus now deletes the Volume Shadow Copies while making use of the Command Prompt task as shown here: vssadmin.exe Delete Shadows /All /Quiet The virus then blacklists certain domains in other to prevent the victim from getting help online which prompts the DNS_PROBE_FINISHED_NXDOMAIN error message whenever they try to go to any of those sites.

Remove CCPS Ransomware and Recover Lost Files

Here are the steps to take following a ransomware attack as recommended by our team of experts:

Remove CCPS virus as quickly as possible.Report to the relevant authorities within your locality.Use any available backup device to restore lost files.Change all passwords that were used on the compromised computer.Learn if/how files encrypted by STOP/DJVU ransomware variants can be repaired.Consider downloading RESTORO to identify and repair virus-altered Windows OS files.

Before we wrap up, always remember it is very important to complete CCPS ransomware virus removal with the use of INTEGO Antivirus or any other reputable antivirus with proven efficacy. However, the computer should be set up through the Safe Mode with Networking option to ensure optimal result. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove CCPS Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove CCPS Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt CCPS files

Fix and open large CCPS files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. CCPS Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt CCPS files, follow the given tutorial.

Meanings of decryptor’s messages

The CCPS decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your CCPS extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of CCPS Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.