How to delete Aeur ransomware

Aeur ransomware is file-encrypting malware that comes from the Djvu/STOP ransomware family. The gang of cybercriminals operating this ransomware has released hundreds of ransomware versions, which can be differentiated by the extensions they add to encrypted files. This one adds .aeur, which is why it’s known as Aeur ransomware. Encrypted files will not be openable unless they are first decrypted with a decryptor that is sold for $980 by the cybercriminals.

 

 

Aeur ransomware, along with file-encrypting malware like Nooa, Hhqa, Ufwj, and Moqs, comes from the same Djvu/STOP malware family. The gang releases ransomware on a regular basis, with hundreds of ransomware released already. They are all more or less identical and target the same files, mainly photos, images, videos, and documents. As soon as the ransomware is initiated, it will start encrypting files while trying to distract victims from what’s going with a fake Windows Update window. Once it’s done, encrypted files will have .aeur added to them. For example, image.jpg would become image.jpg.aeur. As you’ve probably already noticed, you will not be able to open these files. You first need to decrypt them, which, at this moment, can only be done using the decryption tool in the possessions of the cybercriminals operating this ransomware.

The ransomware will drop a ransom note _readme.txt in all folders containing encrypted files. The note explains how you can get the decryptor, and it involves paying a ransom. Two sums are given, $980 is the regular price, and $490 is the discounted one for those who make contact within the first 72 hours of infection. manager@mailtemp.ch and managerhelper@airmail.cc are given as the contact email addresses. However, paying the ransom or even contacting cybercriminals is not a good idea. You are not guaranteed a working decryptor because there’s nothing obligating the cybercrooks to send it. Many users in the past have paid the ransom but received nothing in return. Whether to pay or not is your decision but it’s important for you to be aware of the risks.

File recovery should be easy if you have made a backup. However, you need to make sure you remove Aeur ransomware fully before connecting to backup because otherwise, backed-up files would become encrypted as well. If you don’t have a backup, your options are quite limited. It is possible that a free decryptor will be released sometime in the future but that may be difficult because the ransomware uses online keys to encrypt files, meaning each victim gets a different key. Without those keys, developing a working universal decryptor is not possible. There is a free Djvu/STOP decryptor available but it will not work on Djvu/STOP versions released after 2019. Emsisoft, the developer behind the decryptor, explains that files can be successfully decrypted if they were encrypted by an offline key that Emsisoft has. However, it’s not impossible that the keys will eventually be released, either by the cyber crooks themselves when they eventually close shop, or by law enforcement. So if you don’t have any other options, back up encrypted files and wait for a decryptor to become available on NoMoreRansom.

Ransomware distribution methods

Users with good browsing habits are much less likely to encounter serious malware infections. Malware is mostly distributed via spam email attachments, torrents, malicious ads/updates/downloads, rootkits, etc. Developing good browsing habits, such as not opening unsolicited email attachments, will help avoid a lot of malware.

It’s very easy to pick up a malware infection if you use torrents to pirate entertainment content. Torrent sites are quite badly moderated, which allows malicious actors to disguise malware as torrents for popular content, such as movies, TV series, video games, software, etc. We strongly recommend you avoid using torrents to pirate if only to avoid infecting your computer with malware.

One of the most common ways ransomware is distributed is via malicious spam email attachments. If your email address has ever been leaked, you likely receive spam regularly. Email addresses for these malspam campaigns are bought from various hacking forums. The emails come with a malicious attachment, which if opened would initiate the malware. Fortunately, you can easily spot a malicious email. Malspam is usually more sophisticated only when a target is someone specific. But generally, the emails will be sent from random email addresses, contain loads of grammar/spelling mistakes, and put pressure on you to open the attachment by claiming it’s an important document that needs to be reviewed immediately. Senders usually claim to be from a company whose services you use to trick you into opening the attached file. Take note of how you are addressed in the email, whether your name is mentioned or if you’re addressed in User, Member, Customer, etc. If a company whose services you use emails you, they will address you by your name and not by generic terms. Lastly, we strongly recommend that you scan all unsolicited email attachments with anti-virus software or VirusTotal before opening them.

Aeur ransomware removal

Ransomware is a very serious infection, which is why it’s always recommended to use anti-malware software. If you try to remove Aeur ransomware manually, you may end up causing additional damage. It’s also possible that you will not fully delete Aeur ransomware, which will allow it to recover soon after. If the ransomware is still present when you access your backup, backed-up files would become encrypted as well. The safest and easiest way to remove Aeur ransomware is to use a reliable anti-virus program because it will do everything for you. Only when you are sure the ransomware has been fully removed should you connect to your backup and start recovering files.

Unfortunately, if you do not have a backup of your files, you don’t have many options. While not guaranteed, it’s not impossible that a free decryptor will be released sometime in the future. If it was released, it would be posted on NoMoreRansom. So keep the encrypted files safe by backing them up and wait for a free decryptor.