How to delete Iisa ransomware

Iisa ransomware, or .iisa file-encrypting malware, is one of the more recent versions from the notorious Djvu/STOP ransomware family. It’s a dangerous piece of malware that will encrypt your files and demand payment for their decryption. This ransomware comes from the same family as Pqgs, Utjg, Futm, and Qmak. These ransomware versions are operated by a notorious cyber gang that releases malware versions on a regular basis. Unfortunately, files encrypted with this ransomware are not currently decryptable unless you have the specific decryptor, which is at the hands of the cyber crooks operating this ransomware. They will try to sell it to you for $980.

 

 

Iisa ransomware comes from the notorious Djvu/STOP ransomware family. Like all ransomware, Iisa ransomware and other versions encrypt personal files including photos, images, videos, documents, etc. This ransomware adds .iisa to encrypted files, making it obvious which files have been encrypted. For example, image.jpg would become image.jpg.iisa. You will not be able to open any of these files unless you first run them through a decryptor.

In order to distract users from what’s going on, the ransomware displays a fake Windows Update window. Once file encryption is complete, you will find a _readme.txt ransom note in all folders that contain encrypted files. The note is identical to the ones dropped by other Djvu versions. It explains that files have been encrypted and what you need to do to get the decryptor. Unfortunately, acquiring the decryptor involves paying the ransom. The cyber crooks want $980 for the decryptor, though they claim to give a 50% discount to those who make contact within the first 72 hours of infection. However, paying the ransom is never recommended. There are no guarantees that a decryptor will be sent to you after you make the payment because you are dealing with cybercriminals who are unlikely to feel any obligation to help. Many users have paid the ransom in the past only to not receive the decryptor.

If you have already looked for a decryptor, you may have come across a free Djvu/STOP decryptor developed by Emsisoft. Unfortunately, it will not work on Iisa ransomware or any other more recent Djvu version. This is because more recent versions use online keys to encrypt files. This means that the keys are unique to each user, and without those keys, it’s not possible to develop a working decryptor. This makes developing a decryptor that would actually help all victims very difficult. However, it’s not impossible that the keys will be released eventually, either by the cybercriminals themselves or by law enforcement. So if you do not have a backup, your only option may be to back up the encrypted files and wait for a free decryptor. However, bear in mind that there are a lot of fake decryptors promoted on questionable forums so you need to be careful. If a legitimate source like NoMoreRansom does not have a free Iisa ransomware decryptor, you will not find it anywhere else, certainly not on a questionable forum.

If you were regularly backing up files prior to the ransomware, you should have no issues with recovering files. However, before you can safely connect to your backup, you need to make sure to delete Iisa ransomware from the computer fully. If any components of ransomware remain when you access the backup, your backed-up files would become encrypted as well.

How does ransomware infect computers?

Users who have bad browsing habits are much more likely to encounter malware. So if you open unsolicited email attachments, download pirated content via torrents, click on ads while browsing high-risk websites, etc., you will end up infecting your computer sooner or later.

If there’s one way users end up infecting their computers with malware, it’s malicious email attachments. This method has been used for many years now and continues to be used because it remains effective and requires little effort from malicious actors. They purchase thousands of emails addresses from various hacker forums, write a somewhat convincing email, and attach a malicious file to it. Fortunately for users, malicious emails are more or less obvious. The most obvious sign of a malicious email is grammar/spelling mistakes. Whether this is done on purpose or not, malicious spam email campaigns always have grammar/spelling mistakes. This makes the emails very obvious particularly when senders claim to be from companies whose services users supposedly use. When companies send emails to their customers, they usually do not contain mistakes because they would make the email seem unprofessional. Another sign that an email could be malicious is the senders addressing users as “Customer”, “User”, “Member”. When you receive an email from a company whose services you use, you will always be addressed by your name. It should also be mentioned that some malicious campaigns can be more sophisticated, which is why it’s recommended to scan all unsolicited email attachments with either anti-virus software or VirusTotal.

Torrent users are also at a much higher risk of picking up malware infections because torrent sites are often very badly moderated. This allows malicious actors to upload malware disguised as popular movies, TV shows, video games, etc., without too much trouble. It’s especially common to find malware in torrents for popular, recently released movies. For example, when Marvel releases a new movie, its torrents always contain malware.

Iisa ransomware removal

Ransomware is a very complex malware infection and we do not recommend you try to remove Iisa ransomware manually. You could end up accidentally doing more damage or you may not delete Iisa ransomware fully. If the ransomware is still present when you connect to your backup, it’s likely that those files would become encrypted as well. You certainly do not want that, so use anti-virus software. Once the ransomware is fully gone, you can safely access your backup.