Ekvf Ransomware - How to remove

If your files suddenly refuse to open and had their names changed to end with “ekvf”, that’s the work of the Ekvf ransomware.

It can be devastating: Ekvf breaks files (possibly irreversibly) and it installs additional malware. To recover, you need to delete all infections, secure your login credentials for online accounts, and that doesn’t even address the encrypted data. It’s best to remove Ekvf quickly or to stop the infected computer from connecting to the internet.

In short about Ekvf:

Malware classification	Ransomware, trojan.
How Ekvf encrypts files	It deletes backups and tries to disable security programs, it renames files and encrypts them.
Can you get your files back?	There is little hope of decrypting the Ekvf-encrypted files, backups, data recovery, and file repair might bring back some of the lost data.
How to delete Ekvf and other malware	Find and delete all malware with antivirus tools (Spyhunter, Malwarebytes, etc.), protect your accounts with 2FA and reset your passwords.

How Ekvf ransomware works

Ekvf encrypts data

Ekvf is one example of file-encrypting ransomware. It gets installed (likely with a few other malicious programs), deletes volume copies and restore points, and then encrypts all the user files it can. These files include pictures, videos, music, documents, code, databases, archives, and other files.

Locked files also have their names changed by Ekvf. They have a new extension added (to show file extensions in Windows 10, open File Explorer, click View at the top, then check the “File name extensions” box). For example:

Document.docx.ekvf

Extensions don’t matter to the encryption, though. Removing them won’t fix the files.

The encryption that Ekvf uses is a lot like what apps like WhatsApp, Signal, and Telegram use to keep your messages private. With one difference: Ekvf deletes the key required to read the data, making you unable to read your own files. This is what makes this ransomware so dangerous: it can essentially wipe out your data.

The good news is that Ekvf probably doesn’t steal your files or leak them. It’s a type of Djvu ransomware (together with Enfp, Ribd, and other variants) and they haven’t been known to publish stolen files, so that’s what we can expect from Ekvf, too.

The ransom demand

You may have heard news about ransomware attacking big businesses and organizations and cybercriminals demanding multimillion-dollar ransoms. Ekvf is not like that – it targets individual PC users and small businesses. It spreads on crack sites and it infects pirated programs and fake installers. And it asks for a comparatively small ransom of $490 (or $980 if you delay).

The people behind Ekvf want to make money and seem to consider that ransom demand appropriate, even though it is probably out of the reach of many of Ekvf’s victims.

How to recover from Ekvf ransomware

Recover your data

If you have backups of your data and they’re still intact, then you can ignore this section. Once you remove Ekvf and related malware, you can just delete the encrypted files and restore your data from the backups.

Other than that, things don’t look good. Ekvf ransomware has been turned inside out by researchers and there’s no way to decrypt the files locked by Ekvf – not without paying the ransom, which is not advised.

There’s the rare exception where multiple victims’ decryption keys happen to be the same (the offline key). Read this post on Emsisoft.com for more information.

You could take the drives encrypted by Ekvf and use a data recovery tool like EaseUS.

You could also try and repair your files by removing the corrupted (encrypted) parts – for now, put your Ekvf-locked data on a backup somewhere.

Remove Ekvf and other malware

• Remove all malware.
• Reset your password.

Find and remove Ekvf, AZORult, and whatever other malware might have been installed on your device. You can use any reliable antivirus program, such as Spyhunter or Malwarebytes, to detect the infections.

Below are instructions for how to remove malware manually, including how to fix your hosts file and how to enter safe mode.

Some people choose to just reinstall Windows. That is definitely an option if you don’t mind losing some of your settings and applications. Although it’s advisable to scan your computer even after that. Don’t underestimate how persistent some parasites can be.

After your computer is clean and free of malware, reset your passwords. Since it’s very likely that spyware was installed together with Ekvf, it is possible that some of your login credentials were stolen from your apps (browsers, chat apps, email clients, etc.) and they could be in the hands of cybercriminals. Reset your passwords and use multi-factor authentication where possible.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Ekvf Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Ekvf Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Ekvf Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Ekvf Ransomware. You can check other tools here.  

Step 3. Restore Ekvf Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Ekvf Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Ekvf Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.