MPPQ ransomware creators aim to take victim’s files hostage by encrypting them with RSA + Salsa20, then try to extort the victim. They demand transferring a specified sum of money to their cryptocurrency wallet. The reason why the attackers demand money in cryptocurrency is because this keeps them anonymous. The further details and the virtual wallet address isn’t given in the ransom note as the attackers provide such information only to victims who write to them via email. The ransom note dropped by the virus is named _readme.txt. It begins with a reassurance line “ATTENTION! Don’t worry, you can return all your files!” followed by explanation that all files have been encrypted with strongest encryption and unique key. The note then goes on to explain that the victim needs to purchase special QSCX decryption software from the criminals for $490 in 3 days or $980 later. In order to persuade the victim to transfer the money, the crooks suggest decrypting one file for free. In other words, they suggest something called ‘test decryption’ to prove the victim that such tool for data decryption actually exists and is capable of restoring victim’s files back to normal. However, there are certain conditions that must be met – the victim can only send one file for decryption, it must be small in size and contain no valuable information. It is obvious why the attackers dictate such conditions – they clearly do not want victim to lose interest in paying the full ransom. Speaking of ransoms, we do not recommend paying them to cybercriminals. Same is said by cybersecurity experts worldwide and confirmed by FBI to be a bad practice. There are numerous reasons why it isn’t worth paying up:

Paying the required sum of money to criminals does not automatically guarantee you will recover your files. The attackers might provide you with faulty decryption tool or vanish into the thin air.Paying the ransom, just like asking for it, can be illegal in your country.Do not support the cybercrime industry by paying more money to criminals. The amount of ransoms collected each year is believed to be one of the factors that lures other people to join ransomware gangs and expand the malevolent operations and their reach.STOP/DJVU ransomware variants such as QSCX virus, are known to run AZORULT Trojan on the compromised hosts. This Trojan is designed to silently steal sensitive information from your computer and transfer it to cybercriminals. Therefore, we do not recommend following such sneaky attackers’ commands as they might use collected information to extort you later.

Ransomware damage: what has been done to your computer?

QSCX ransomware runs a fake winupdate.exe process (launches a fake Windows update prompt) to trick the victim into thinking that a sudden system slowdown is due to an ongoing OS update and not some kind of a problem. The second thing this virus does is it runs some CMD commands to delete Volume Shadow Copies from the computer. This will prevent the victim from restoring encrypted files using System Restore points. Next, the virus starts system scan during which it searches for files with extensions that match ones from its target list. Once found, the virus encrypts the first 150KB of a file using RSA+Salsa20 algorithms. Consequently, such file becomes impossible to open, read, edit. The virus does the same thing for all files in folders and before leaving for another directory, it drops _readme.txt file with a pre-composed text. As mentioned, the virus modifies only the first 150 KB of file, therefore some file formats can be easily restored with minimal file loss. More on that in this guide. Final modification to system files that this ransomware does is altering Windows HOSTS file. The virus adds a list of domains to restrict on the compromised host. As a consequence, the victim won’t be able to connect to these websites and will run into DNS_PROBE_FINISHED_NXDOMAIN error when trying to connect to specific website directly or, for example, via search engine results. The list of domains added seem to have one trait of similarity – tehy all publish articles about computers, cybersecurity and how-to guides. Therefore, it seems that ransomware authors try to prevent the victim from finding relevant ransomware-attack related information online as well as confuse the victim even more. As mentioned previously, variants from STOP/DJVU ransomware strain tend to drop AZORULT malware on the system. To explain, it is a well-known Remote Access Trojan (RAT) that can be used by criminals to remotely view or delete files in victim’s PC, drop malware on it or download files from victim’s computer to criminals’ servers and more. The malware has other functionalities, such as stealing private information: saved browser passwords, browsing history, cookies, Steam and Telegram login credentials, cryptocurrency wallets and more. Chance to get their hands on such information allows attackers to carry out various phishing and blackmailing attacks, say, via email spam. We strongly recommend you to remove QSCX ransomware virus and additional malware using free guide provided below. Our team recommends using a robust anti-malware of your choice as well as downloading RESTORO to repair virus damage caused by this computer menace.

Ransomware Summary

How ransomware-type threats are distributed online

Computer viruses that fall into ransomware category are mostly distributed via illegal online downloads, injected into malicious ad networks, await on compromised websites or travel in a form of email attachment. STOP/DJVU ransomware variants, including QSCX ransomware are known to await in illegal online downloads, mostly torrent-type software or game cracks. Some victims have also reported finding variants of this ransomware in KMSPico virus variants. Therefore, it is apparent that the developers of this ransomware target people who are trying to download paid software products for free. What makes this distribution technique even more successful is that people who are looking for illegal software cracks also tend to ignore their security software warnings about potential malware inside of them, thinking that these alerts are simply false positives. We recommend you to avoid going to shady online websites looking for software cracks or 100% free downloads of software that is known to be a paid product. The only way to get such software legally and safely is going to its official developer’s website or one that is confirmed to be a trusted partner/distributor of the said software. In case you have recently downloaded such torrents via peer-to-peer download agents, you should scan your PC immediately, even if it seems that nothing happened. Files like this are often used to drop silent malware on victim’s computer, such as cryptocurrency miners, remote access Trojans or password-stealers. Such computer threats can do various illegal tasks without even catching your attention. Cybercriminals’ choice for virus’ distribution often involves usage of malicious email spam. The crooks compose convincing messages claiming to be from well-known company, colleague or someone you possibly know. Such messages urge to open attached document to review missing payment information, invoice or parcel delivery details. The number of topics and ideas that criminals use to deceive the victim is endless. Therefore, we strongly recommend you to avoid opening such attachments and inspect the email very carefully. To be on the safe side, we do not recommend opening such attachments if you did not expect to receive such email. Secondly, if you got an email from someone claiming to work at a well-known company, you can find its contact details on any search engine and call them to get reassurance whether the email was legit or not. More importantly, do not believe that the sender is someone who he/she claims to be – the attackers actively use email spoofing techniques to conceal the actual sender’s email. You can read more about email spoofing here. Quick tip: avoid opening email attachments if the email’s images are blocked, the letter is marked as a possible spam, or if a sender specifically asks to be informed when you read the message. These methods are frequently used to signal the attacker’s servers about your interaction with the email so that more spam would be sent towards your email inbox. To avoid opening a potentially malicious email, we recommend only interacting with emails that you expected to receive. Ransomware victims often get desperate trying to search the world wide web for data decryption tools, hoping to find it on a random website online. However, we can assure you that if an official decryption tool appears, it will be covered by largest news sites worldwide. There is no need to start checking shady websites on 6th search engine results’ page as this most likely will lead you to dangerous websites. The point we’re trying to make is that due to popularity of STOP/DJVU variants, other ransomware strains decided to upload fake STOP/DJVU decryption tools that hide additional ransomware inside of them. One of threats known to be distributed in such way is ZORAB ransomware.

Remove QSCX ransomware virus and decrypt/repair your data

Remove QSCX ransomware virus from your PC by following expert-prepared guidelines. We provide these guidelines down below. Make sure you read given instructions carefully and ensure that you do not miss any of the steps provided. Do not hesitate to drop your questions in the comments section. Finally, we advise downloading RESTORO to scan for malware damage and repair it on your operating system files. After thorough QSCX virus removal, we strongly suggest completing the following tasks:

Inform a local authority about a case of a ransomware attack. You can find some references below this article.Try to search for data backups and recover at least part of your files using them.Learn how to decrypt or repair files affected by STOP/DJVU versions.Change your login credentials for websites saved in your browser’s memory.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove QSCX ransomware virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove QSCX ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt QSCX files

Fix and open large QSCX files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. QSCX ransomware virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt QSCX files, follow the given tutorial.

Meanings of decryptor’s messages

The QSCX decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your QSCX extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of QSCX ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.