Delete Loov ransomware

Loov ransomware is malware that encrypts files. It comes from the notorious Djvu/STOP ransomware family that has released hundreds of versions of the same ransomware in the past couple of years. They are more or less all identical to one another but you can differentiate them by the extensions they add to encrypted files. This ransomware adds .loov, which is why it’s known as Loov ransomware. Unfortunately, it’s currently not possible to recover files unless you have a backup.

 

 

Loov ransomware is from the same Djvu/STOP ransomware family as Nnqp, Hudf, Shgv, Yqjs, and many other versions. They are more or less the same infection, though they add different extensions to encrypted files. This ransomware adds .loov. The ransomware targets all personal files, including photos, videos, documents, images, etc. The files with the .loov extension will not be openable unless you first run them through a special decryptor. Unfortunately, the only working decryptor is in the hands of the criminals operating this ransomware. And the only way to get it is to buy it from them.

As soon as you initiate the ransomware, there will be a fake Windows update window on your screen to distract you from the fact that your files are being encrypted. As soon as the targeted files are encrypted, you will see a _readme.txt ransom note in folders that contain encrypted files. The note is pretty generic and explains how you can get the decryptor. Unfortunately, you would need to purchase it from the cybercriminals operating this ransomware. The price for the decryptor is $980 but the note mentions that those who make contact within the first 72 hours will get a 50% discount. Even if that were true, paying the ransom is not recommended because it does not guarantee that a decryptor will be sent. It’s very uncommon for cybercrooks to just take the money and not send anything in return. So while whether to pay or not is your decision, you need to be aware of the risks before sending criminals money.

If you have some kind of file backup system, you should be able to recover files with no issue provided you first remove Loov ransomware from your computer fully. If the ransomware is still present when you connect to your backup, your backed-up files would become encrypted as well.

If there is no backup, it may not be possible to recover files. Currently, the only option is a free decryptor that may be released in the future. It’s currently not available but that may change. The reason it’s difficult to develop a decryptor is that Loov ransomware uses online keys to encrypt files. The keys are unique to each user, and without those keys, developing a working decryptor may not be possible. However, it is possible that the keys will be released in the future, either by the cybercriminals themselves or by law enforcement. NoMoreRansom is a good place to check for decryptors.

Ransomware distribution methods

Malicious spam, also known as malspam, is a very common way cybercriminals try to distribute malware. They acquire victims’ email addresses from various hacker forums and then send them malicious files attached to emails. The text in the email is usually quite obvious because it’s full of grammar and spelling mistakes. Whether that is done purposely or not, it makes recognizing malspam quite easy. The text is often written in a way that encourages the user to open the attached file as soon as possible. Money-related topics are often used. Another sign that an email may be malicious is you being addressed in generic terms like “User”, “Member”, “Customer”, etc. If senders claim that you use their services, you should always be addressed by name. If you receive an email from a company whose services you use but you’re addressed in generic terms, you should be very cautious.

In some cases, when cybercriminals have at least some personal information about victims, the malicious emails may be more sophisticated. Even something as small as knowing a victim’s full name can make a malspam attempt much believable. Thus, it’s a good idea to scan all unsolicited email attachments with anti-virus software or VirusTotal before opening them.

Malicious actors also frequently use torrents to distribute their malware. It’s no secret that torrent websites are quite badly regulated, and cybercriminals take full advantage of that. They disguise their malware as torrents for popular movies, TV series, video games, software, etc., and wait for potential victims to download them. It’s especially common to find malware in torrents for recently-released content. For example, when a long-awaited movie comes out, torrents for it are more often than not full of malware. So pirating via torrents is dangerous, in addition to essentially being content theft.

Loov ransomware removal

Ransomware is one of the more complicated malware infections so it’s not recommended to try and remove Loov ransomware manually. You could miss something if you’re not careful and allow the ransomware to recover later on. And if you connect to your backup while ransomware is still present, your backed-up files would be encrypted as well. Thus, it’s best to use anti-virus software to delete Loov ransomware from your computer.

For users who do not have a backup, the chances of being able to recover files are not great. It is possible that a free decryptor will be released sometime in the future but you will not be able to find one at the moment. There is a free Djvu/STOP decryptor released by Emsisoft but it will not work on versions that use online keys to encrypt files. That, unfortunately, includes Loov ransomware. If you search for a decryptor, you will come across a lot of fake decryptors that could actually lead to even more infections. If there isn’t a decryptor available on a legitimate site like NoMoreRansom, the decryptor you find on a questionable forum is unlikely to work. But we still recommend backing up encrypted files and waiting for a free decryptor to become available sometime in the future.