Ofww Virus

7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.

*Ofww is a variant of Stop/DJVU. Source of claim SH can remove it.


Ofww is a Ransomware virus that can apply encryption to all files stored on your computer. Typically, Ofww can target work-related or personal documents, images, video and audio files, as well as system records with the idea to demand money for their decryption.

Ofww 1024x606
The Ofww ransomware will leave a _readme.txt file with instructions

If you’ve come across this post, you probably have been looking for a way to remove Ofww, Oflg or Aamv from your computer. That’s why, in the next lines, we will do our best to help you. The two most obvious symptoms of a Ransomware infection are the appearance of a ransom-demanding message that lets you know about the demanded ransom and your inability to access most or all of your files that are on the attacked computer. The crooks may set a short deadline for the ransom payment and threaten that if you don’t pay on time, they will double the ransom or leave the file encrypted forever. Naturally, receiving such a message can be very frustrating but security experts advise victims not to panic. There are methods that may potentially help with the removal of the infection and the recovery of the encrypted files and it is worth trying them out.

The Ofww virus

The Ofww virus is an infection based on Ransomware encryption that restricts access to digital files without a warning. The Ofww virus can encrypt different files stored inside a computer and demand a payment in cryptocurrency to decrypt them.

Ofww Virus 1024x606
The Ofww virus will encrypt your files

The Ofww virus sneaks in your computer without your consent and silently gets down to business. Its first job is to scan the entire system for specific file types and once it detects them, the Ransomware will start encrypting them one by one. After that, it will generate a warning message, informing you about the encryption that has taken place and the methods to pay for reversing it. Typically, the money you are required to transfer is to “buy” a private decryption key from the hackers who are behind the Ofww virus. This key is necessary for your encrypted data to be converted to its previous state.

An interesting fact about Ransomware is that those threats are oftentimes distributed via Trojan Horses that backdoor them into the systems of their potential victims. The Trojan-Ransomware combination can often be distributed via large-scale spam email campaigns, malicious file attachments, torrents, cracked software installers, or malvertisements. The actual infection happens the moment the user clicks on the transmitter, downloads the malicious file or installs the infected setup package. That’s why we always advise our readers to keep away from shady web links, spam messages, cracked software installers or email attachments, especially when they come from unreliable sources and unknown senders.

The Ofww file encryption

The Ofww file encryption is an advanced code that can restrict access to specific files until a ransom is paid. Decrypting the Ofww file encryption is a complex process that requires a decryption key which can only be obtained from the hackers behind the Ransomware.

If you don’t know how to deal Ofww we strongly recommend that you don’t hurry to complete the ransom payment that the hackers want from you. For one, there’s just no guarantee they will keep their word and give you the encryption key. And, secondly, even if they send the key and it works, if the Ransomware has not been removed from the system, all the decrypted files may get encrypted again and you will be back to where you started. That’s why, before considering the ransom payment or trying any file-recovery methods, we encourage you to first remove Ofww with the help of the instructions in the guide below.

Danger LevelHigh (Ransomware is by far the worst threat you can encounter)
Detection Tool

*Ofww is a variant of Stop/DJVU. Source of claim SH can remove it.

Remove Ofww Ransomware


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



*Ofww is a variant of Stop/DJVU. Source of claim SH can remove it.

Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous. 


Right-click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    After you open their folder, end the processes that are infected, then delete their folders. 

    Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections.


    Hold the Start Key and R –  copy + paste the following and click OK:

    notepad %windir%/system32/Drivers/etc/hosts

    A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

    hosts_opt (1)

    If there are suspicious IPs below “Localhost” – write to us in the comments.

    Type msconfig in the search field and hit enter. A window will pop-up:


    Go in Startup —> Uncheck entries that have “Unknown” as Manufacturer.

    • Please note that ransomware may even include a fake Manufacturer name to its process. Make sure you check out every process here is legitimate.

    Type Regedit in the windows search field and press EnterOnce inside, press CTRL and F together and type the virus’s Name. 

    Search for the ransomware in your registries and delete the entries. Be extremely careful –  you can damage your system if you delete entries not related to the ransomware.

    Type each of the following in the Windows Search Field:

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    Delete everything in Temp. The rest just check out for anything recently added. Remember to leave us a comment if you run into any trouble!


    How to Decrypt Ofww files

    Depending on the ransomware strain that has infected your computer, you may need to use a variety of tools and methods to recover encrypted files. That’s why, to have success when you deal with this malware, you first need to figure out the exact variant that has attacked you. You may find this information if you look at the file extensions of the encrypted files.

    New Djvu Ransomware

    The most recent Djvu ransomware strain is called STOP Djvu. Victims of the threat may notice the addition of the .Ofww extension at the end of their encrypted files after being attacked.

    When it comes to file-recovery, presently, only files encrypted with an offline key may be decrypted from the STOP Djvu encoding. If that is your case, we recommend you use the decryptor tool at this URL:


    The STOPDjvu.exe file may be downloaded from the URL above by clicking the Download button in the window’s top right corner. In order to launch the decryptor, you must first right-click the decryptor file and choose “Run as administrator”, followed by clicking the “YES” box.

    You can start the decryption process by selecting the Decrypt button. Before that, however, please read the license agreement and the quick instructions for use. Note that this program cannot decode files that have been encrypted with unknown offline keys or online encryption.

    Before recovering any files, make sure that Ofww has been completely removed from the compromised computer. To save time, you may scan the system with the professional removal program that we recommend, or you can individually check any suspicious files with the free online virus scanner to see whether they include Ofww or any other malware. Feel free to share your experience with this guide in the comments or post any questions, and we’ll do our best to assist you.


    About the author


    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1