[email protected] Q1G Cryptovirus - How to remove

Q1G is a new variant of Dharma ransomware. Ransomware is one of the most destructive types of malware. Generally, a cryptovirus corrupts nearly all the files on the system it infected using cryptography and so far, no free decrypter has been developed for this variant. Based on Dharma, Q1G is no less dangerous than the previous versions: it preys on businesses and organizations which are suspected to be dependent on their data and which are in some way vulnerable to the virus.

Q1G was discovered on the weekend, on August 3rd. This virus is named after the file extension given to the files that Q1G affects. This includes the vast majority of documents and media files but not the files required for the operating system to run (the Windows OS). Q1G also affects files that are stored on storage devices connected to the local network and deleted local backups, so it shouldn’t be taken lightly.

Characteristics of Q1G

Q1G is similar to Panama777, Harma, Wal, and other Dharma viruses. It renames the locked files by appending “.[[email protected]].Q1G” to their names, creating RETURN FILES.txt and info.hta ransom notes that provide directions on how to pay the ransom (usually the price is said to be no less than $8000).

The email address used by Q1G is [email protected], it’s included in the extension of the affected files (id-[random].[[email protected]].Q1G), as well as the hta file that pops up after Q1G is done encrypting your data. This window also includes a message from the extortionist, including a threat that the decryption keys won’t be recoverable after 7 days and an offer to decrypt a single file as proof that decryption works (this is necessary because of the abundance of ransomware viruses that corrupt the data irrecoverably).

In order to make the locked files unusable but recoverable, the developers of Q1G use cryptography. It is strong, fast, and secure. There is no practical way to brute-force them. While sometimes a flaw in the software does allow a decrypter to be developed for a ransomware virus, such as the one that was created for the early versions of Dharma.

Whether a free decrypter is possible remains unknown, it’s possible that it will never be developed. However, free decrypters are the safest way to recover the locked data when they’re available. They’re usually created by cybersecurity companies and released for everyoneon sites such as nomoreransom.org. Paid decryption services should always be viewed with some suspicion: scammers are always looking to prey on desperate victims, other recovery companies sometimes simply contact the extortionists and pay the ransom, passing the cost onto the victim. Based on the previous versions of Dharma, a few file types are more resistant to the kind of encryption that Q1G uses and might be recoverable by an expert, but it’s still important to be careful. If you are planning  on recovering the locked files, have backups of the original encrypted data so that you don’t accidentally corrupt the files even further.

How to avoid ransomware infections

The main and most important thing to do to be safe against ransomware is to have a data backup. It can’t be connected to your computer or network and it can’t be accessible for the virus in theory. Some malware developers are clever enough to find and abuse flaws that people haven’t thought of, so it’s a good idea to have redundant backups and be insured against any data loss — malware, floods, or a hardware malfunction.

Securing the RDP connections is extremely important because ransomware and spyware are smuggled into the targeted systems using Remote Desktop connections. This access can be used to cause tremendous harm, such as stealing data. And even when RDP is secured, the administrator account credentials are sometimes simply brute-forced or a vulnerability could be exploited to get access. So it’s good to prevent malicious actors from even attempting to connect.

Up-to-date software is important to have in order to be protected against viruses like Q1G. For example, WannaCry abused a then-known vulnerability that already had a patch released by Microsoft — many systems simply hadn’t installed it. Using outdated software is very dangerous for any device that connects to the internet.

Training people to recognize phishing and spam emails might also reduce the risk of Q1G and other infections because phishing and ransomware spread by emails.

How to remove Q1G

If you seek to reverse all the damage done by Q1G, it will not be easy. Removing the virus can be done with almost any professional antivirus tool, like Spyhunter, and safe mode. This does not do anything to recover the locked data, though.

If you don’t have working backups of your data that you could restore your files from, the below guide does describe a few ways of recovering encrypted, corrupted, or deleted data that do not require a decryption key. And though these ways are not guaranteed to show good results, they’re worth trying for those looking to avoid dealing with the criminals responsible for Q1G.

Automatic Malware removal tools

How to recover [email protected] Q1G Cryptovirus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before [email protected] Q1G Cryptovirus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of [email protected] Q1G Cryptovirus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to [email protected] Q1G Cryptovirus. You can check other tools here.  

Step 3. Restore [email protected] Q1G Cryptovirus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually [email protected] Q1G Cryptovirus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover [email protected] Q1G Cryptovirus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.