Ofoq Virus

7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.

*Ofoq is a variant of Stop/DJVU. Source of claim SH can remove it.

Ofoq

Ofoq is a ransomware threat that cybercriminals use to generate quick money for themselves via extortion. The way Ofoq attacks a computer is it scans it for frequently used files, applies advanced encryption to them and then demands a ransom for the decryption key.

Ofoq 1024x616
The Ofoq ransomware will leave a _readme.txt file with instructions

Computers are places where all types of valuable digital information can be kept. Whether that is some important documentation, correspondence, favorite music, pictures of special moments, projects, archives or other types of digital data, we certainly don’t want to lose access to it. Unfortunately, malicious hackers have found a way to make some good and quick money by limiting access to this type of information. They have created Ofoq (Oflg, Aamv) — a cryptovirus that encrypts user files and blackmails you to pay a ransom for their decryption. This online threat has recently become a lucrative “business” for many cyber criminals. Nevertheless, on this page, you can find information on how to remove the infection. The removal guide which you can find below will take you through all the steps, but you can also use the professional Ofoq removal tool attached to it if you need any specialized help.

The Ofoq virus

The Ofoq virus is malicious software that uses a powerful encryption algorithm to lock files on an infected computer and prevent victims from accessing them. The cyber criminals behind the Ofoq virus use various tactics to make the victims pay for their files.

Ofoq Virus 1024x610
The Ofoq virus will encrypt your files

For instance, they display scary ransom notifications on the screen of the infected computer and threaten that if no payment is made within a given deadline, the encrypted files will remain inaccessible forever. The crooks usually ask for a ransom that is payable in Bitcoins, which is an untraceable cryptocurrency. In return, they promise to send a specially generated decryption key that can be used to decrypt the inaccessible files. The ransom amount needed for this key can be between a few hundred bucks to thousands of dollars. That’s why many victims are eager to try other solutions to retrieve their information and remove the Ransomware that has infected their computer.

The Ofoq file decryption

The Ofoq file decryption is a process that is used to reverse the encryption that the ransomware has applied. Users who want to activate the Ofoq file decryption have to obtain a decryption key from the hackers.

Unfortunately, there is no assurance that you will recover your files by paying the ransom. In fact, the cyber criminals don’t really care about your encrypted information and whether you will get it back as long as they receive the money. Once you transfer the required amount, the crooks may simply vanish and leave you with nothing. Unfortunately, when more web users pay the ransom, these threats become more common as they become a favorite tool for unscrupulous people to make money. Therefore, we strongly recommend that you take the time to research and explore other alternatives that can help you restore any files and remove Ofoq. The removal guide below and the professional removal tool attached to it can be a good starting point.

SUMMARY:

Name Ofoq
Type Ransomware
Data Recovery Tool Not Available
Detection Tool

*Ofoq is a variant of Stop/DJVU. Source of claim SH can remove it.

Remove Ofoq Ransomware


Step1

Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).

Step2

WARNING! READ CAREFULLY BEFORE PROCEEDING!

*Ofoq is a variant of Stop/DJVU. Source of claim SH can remove it.

Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous. 

malware-start-taskbar

Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Loading
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    After you open their folder, end the processes that are infected, then delete their folders. 

    Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections.

    Step3

    Hold the Start Key and R –  copy + paste the following and click OK:

    notepad %windir%/system32/Drivers/etc/hosts

    A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

    hosts_opt (1)

    If there are suspicious IPs below “Localhost” – write to us in the comments.

    Type msconfig in the search field and hit enter. A window will pop-up:

    msconfig_opt

    Go in Startup —> Uncheck entries that have “Unknown” as Manufacturer.

    • Please note that ransomware may even include a fake Manufacturer name to its process. Make sure you check out every process here is legitimate.
    Step4

    Type Regedit in the windows search field and press EnterOnce inside, press CTRL and F together and type the virus’s Name. 

    Search for the ransomware in your registries and delete the entries. Be extremely careful –  you can damage your system if you delete entries not related to the ransomware.

    Type each of the following in the Windows Search Field:

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    Delete everything in Temp. The rest just check out for anything recently added. Remember to leave us a comment if you run into any trouble!

    Step5

    How to Decrypt Ofoq files

    To improve your odds of decrypting your data, you should eliminate Ofoq and any other viruses that may be lurking on your computer. Use professional anti-virus software like the one recommended here if you aren’t a tech whiz.

    After you are sure that Ofoq has been successfully removed from your computer, you may safely move on to the file-recovery solution below:

    The different types of ransomware have different methods that are effective against the applied file-encryption. So, it is important to look at the file extension that has been added to your encrypted files to figure out which version of ransomware you have.

    New Djvu Ransomware

    The most recent type of Djvu ransomware that is currently spreading online is called STOP Djvu. A telltale sign that you have been compromised by this variant is the .Ofoq suffix attached to the encrypted files. suffix attached to the encrypted files.

    STOP Djvu files encrypted with an offline key are currently the only ones that can be successfully decrypted. This, however, should not discourage you to seek alternative solutions. There is a decryptor tool in the link below that may help you recover some of your data if you give it a try:

    https://www.emsisoft.com/ransomware-decryption-tools/stop-djvu

    You can get the STOPDjvu.exe program from the website listed above by clicking the blue Download button in the top right corner.

    To launch the program, right-click the file you downloaded and choose “Run as Administrator”. Then, select the “Yes” option. The decryption process should begin as soon as you’ve read the agreement and the brief instructions and clicked the Decrypt button. To have realistic expectations, please note that this decryptor cannot decrypt files encrypted with unknown offline keys or online encryption.

    In case you run into any problems during any of the steps in this guide, let us know in the comments. Keep in mind that the anti-malware tool presented here might help you swiftly and easily eliminate the ransomware, therefore saving valuable time. If you need extra help, you may also use the free online virus scanner to scan any files you suspect may be infected.


    About the author

    blank

    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    4 Comments

    • Hello, I am a poor and sick man and I have no money. All the files of sick cases and the file of social security ofoq assistance in Egypt are encrypted and I cannot pay any amount and I need to open my files to be able to dispense medicines and small social security assistance

      • Hi, Mostafa! If you have a New Variant online ID, there is no key for New Variant online ID. That means for now, the only other alternative to paying the ransom, is to backup/save your encrypted data as is and wait for a possible future solution if encrypted with an ONLINE KEY.

        • Hi there, when you open any encrypted file with note++, they all end with the same identical number, that looks like: {36xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxF5}. Makes me wonder if that could be the key for decryption ?

          • Hi Kevin,
            I firmly believe that this is not the case. Did you uploaded your infected files to Emsisoft? There is a decryptor , but I suggest to you to check with what Variant you are infected first.

    Leave a Comment