The cybercriminals will emphasize that HFGD ransomware virus has been able to infect and encrypt all files contained in the victim’s computer, including important documents and pictures, as well as every other data. Also, considering that very strong and unique key was used, they would then suggest that the victim has no way out except to pay ransom to the cybercriminals so their files could be decrypted. The note will equally include two email addresses the victim would be expected to respond with, namely: support@sysmail.ch and supportsys@airmail.cc. Additionally, decryption service prices would also be listed as well as terms of payment. The cybercriminals will state that the amount payable by the victim would depend on how soon they’re able to do so. For instance, they would claim that a 50% discount is available provided the victim can pay within 72 hours i.e. 3 days. Therefore, instead of paying $980, they would now be required to pay $490, but once it exceeds 72 hours, only the full amount would be acceptable. Should the victim decide to contact the cybercriminals using any of the email provided, more conditions will be reeled out by them. They will insist that payment can only be made through cryptocurrency whereby the victim is expected to purchase cryptocurrency that is worth the ransom fee and also transfer same to the cybercriminal’s wallet address. The apparent reason why they prefer such a discreet medium of payment is to ensure they remain anonymous and avert any possibility of being traced. To assure the victim of their capability to restore the encrypted files and coerce them to make payment, they may suggest that excerpts of the encrypted files should be sent to them for test decryption but will add that such excerpt must not contain any information that could be deemed as vital to the victim. When faced with such a challenge, our in-house cybersecurity experts advise those at the receiving end to always follow the FBI’s guidelines concerning ransom payments, and it categorically states that RANSOM SHOULD NOT BE PAID. Several reasons have been given on why ransom must not be paid, but the most important ones are listed below:

Paying ransom makes it profitable for cybercriminals, thus encouraging them to continue being a menace to computer users.More funds in their hands will enable them to increase their capacity thereby putting an increased number of people at risk.It does not guarantee you will recover your encrypted files.By law, paying the ransom might be illegal in your area.

Worse still, the virus is capable of dropping Trojans like VIDAR and AZORULT on the already infected computer, which can discreetly steal important personal information such as cryptocurrency wallets, banking details, software account credentials, passwords and browsing history etc. Such vital details in the hands of cybercriminals can lead to more fraudulent acts like blackmailing, theft etc. For those whose computers were infected with this version of STOP/DJVU ransomware, it would be in your best interest to remove HFGD ransomware virus as quickly as possible. The recommended way to go about it is to boot the infected computer through Safe Mode with Networking option before installing/running a reliable antivirus on it. It is crucial to make use of only genuine antivirus brands like INTEGO Antivirus among others. It is also a good idea to download RESTORO, which can be very helpful in repairing damaged Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

The most common way through which computer users inadvertently infect their PC’s with variants of STOP/DJVU ransomware, including HFGD virus is when they try to download software contents from malicious online torrents. It is important to note that cybercriminals often embed malware on pirated software copies which they upload to such illegal platforms and use them as a bait to prey on unsuspecting users. Therefore, the use of fake “cracks” and key generators is highly discouraged because they can lead to severe malware attack. Reports from victims so far has shown that certain pirated software copies are often used by cybercriminals as indicated in the list below:

VMware Workstation;Adobe Photoshop;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;Fifa 20;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

For those that often indulge in such risky acts by visiting malicious online torrents, you’re hereby advised to desist from doing so henceforth because you’re endangering your computer and the files contained in it. There is nothing smart about using software torrents online, on the contrary, it is a naïve act because cybercriminals usually exploit their greed and they end up losing either their files or money, or even both. Also remember that such act is illegal and punishable by law. Instead, it is safer and more rewarding in the long run, to patronize only genuine and legitimate software producers by obtaining your software needs through official pages or recognized third-party agents only. Always note that whatever token they may require as fees can never be compared to the heartbreaking ransom fees usually requested by cybercriminals from their victims. Another prolific distribution method used by cybercriminals in spreading malware is through malicious email attachments. In this option, they usually compose ordinary looking but highly convincing messages that would be accompanied with attachments crafted on XLS, DOCX or PDF among similar ones. They prefer using these ones because they enable JavaScript and macro functions, which can be used to transport payload and also trigger them in diverse computers. Nevertheless, victims of STOP/DJVU ransomware shouldn’t throw caution to the wind and start experimenting with suspicious websites that claim to provide decryption services. Most of these sites are fraudulent in nature and they have dubious intents. At the moment, only DiskTuna and Emsisoft have proven capable of decrypting files and for more details about them, you can follow this link.

More details concerning the virus

This section throws more light about what actually happens during HFGD ransomware attack. First of all, what the malware does is to launch a build.exe or build2.exe as well as winupdate.exe i.e. the prompt that displays a fake update screen. Afterwards, it will make a connection with https[:]//api.2ip.ua/geo.json and save the response on geo.json file. The malware uses this method to gather every important detail concerning the computer, such as its geolocation, zip code, time zone, latitude and longitude, and other details. Here is a screenshot of some geo.json file examples. The virus also gathers data describing infected computer’s hardware, active processes and installed software into a file named information.txt (shown below). The virus will now make use of the country code obtained earlier in profiling against a list of Middle East and Eastern European countries they designated as encryption-exempted, namely: Ukraine, Russian Federation, Uzbekistan, Syria, Armenia, Tajikistan, Belarus, Kazachstan and Kyrgyzstan. If it detects that the computer is domiciled in any of these countries, it will instantly abort its mission. However, if it otherwise, it will move to the next stage by extracting online encryption key from their server and would merge it with the victim’s ID before saving it in the bowsakkdestx.txt file and to the PersonalID.txt file. You can see screenshot containing these files below. In situations whereby it fails to extract online encryption key from their local server, it will opt for a hardcoded offline key as a replacement. Unlike the online key that is unique per victim, this offline key would be uniform to all victims of the same variant. The appearance of t1 characters suffixed to the victim’s ID is an indication that offline key was used and it raises hopes that .hfgd files could be decrypted going forward. At this juncture, the ransomware will commence full data encryption by scanning every folder and encrypting them with Salsa20 and afterwards, it will use the RSA-2048 key to lock the encryption key. Shown below is a screenshot of _readme.txt ransom note dropped by the cybercriminals in every folder. In concluding the entire process, the virus will blacklist certain domains in the Windows HOSTS file thereby effectively preventing the victim from getting any help from online forums or websites that offer support to victims. Any attempt by the victim to access the websites will likely yield the DNS_PROBE_FINISHED_NXDOMAIN error message.

Remove HFGD Ransomware Virus and Recover Encrypted Files

For those whose files were encrypted by the malware variant under discussion, you’re advised to remove HFGD ransomware without further delay and also follow the recommended steps as outlined below:

Get in touch with the nearest relevant government agency and report the incident.Make use of any backup device available to you in restoring lost files.Now is time to learn possible ways of repairing files affected by STOP/DJVU ransomware versions.Change all passwords that were used in the compromised computer as soon as you can.

In conclusion, it is best to always take proactive measures in avoiding activities that could expose your computer to infection. Also, remember to make use of INTEGO Antivirus and to set up your computer in Safe Mode with Networking prior to using it when attempting to remove malware. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove HFGD Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove HFGD Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt HFGD files

Fix and open large HFGD files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. HFGD Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt HFGD files, follow the given tutorial.

Meanings of decryptor’s messages

The HFGD decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your HFGD extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of HFGD Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.