LSSR ransomware was made for only one purpose – extorting inattentive computer users. The virus does so by using military-grade encryption algorithms to make files inaccessible. It encrypts only the first 150 KB of each file, enough to corrupt it yet finish the whole computer data encryption quickly before the victim notices anything. This also allows restoring certain file formats with minimal data loss at the beginning of the file. For example, the victim might be still able to open audio files which will miss some seconds of the recording in the very beginning. For more information about file decryption and repair, please see this guide. The note left by the virus, _readme.txt, explains that all files were encrypted using strongest encryption algorithms. It also suggests that the victim can get LSSR decryption tool and unique key if one manages to contact the criminals and pay the ransom with 72 hours (3 full days). In case the victim delays, the ransom price will be $980. The criminals will further clarify that the said amount must be paid in cryptocurrency (most likely Bitcoin). Using such payment method keeps the attackers untraceable. To convince the victim to pay up sooner, they even suggest testing the decryption by sending one small encrypted file for them which they promise to decrypt for free and send it back. Our team experts do not recommend paying ransoms to cybercriminals. The same is advised by FBI. In fact, there are various reasons that should convince you to keep your money to yourself:

There’s no way to get your money back if you transfer it to cybercriminals. Besides, it doesn’t guarantee that criminals will actually provide you with tools to decrypt files.Ransomware operators earn millions of US dollars each year. Not only this helps to fuel further malicious operations, but also lures other people to join this industry. Paying a ransom might be considered an illegal act in your country.Viruses that belong to STOP/DJVU ransomware family such as LSSR virus run AZORULT Trojan on the infected computer. This is a well-known information stealer which can be remotely controlled by the attacker to perform illegal actions on victim’s PC.

Ransomware damage in detail

LSSR ransomware arrives as a set of processes that are meant to perform different tasks on victim’s computer. One of the first ones being launched is winupdate.exe, a deceptive process that displays a fake Windows update prompt during the attack. This is meant to convince the victim that a sudden system slowdown is caused by a Windows update. However, at the same time the ransomware runs another process (usually named by 4 random characters) which starts scanning the system for target files and encrypting them. Next, the ransomware deletes Volume Shadow Copies from the system using the following CMD command: vssadmin.exe Delete Shadows /All /Quiet Once deleted, it becomes impossible to restore previous computer state using System Restore Points. The thing is, ransomware operators are getting rid of any Windows OS-based methods that could help the victim to restore files for free. In addition, the attackers modify Windows HOSTS file by adding a list of domains to it and mapping them to localhost IP. As a result, the victim will run into DNS_PROBE_FINISHED_NXDOMAIN error when trying to access one of the blocked websites. In fact, it has been noticed that the ransomware attempts to block websites that publish various how-to guides for computer users. It is obvious that by restricting specific domains, the crooks are trying to prevent the victim from reaching relevant and helpful ransomware-attack related information online. The virus also saves two text files on victim’s computer that provide attack-related details – victim’s public encryption key and personal ID. These two files are called bowsakkdestx.txt and PersonalID.txt. After all these modifications, the malware doesn’t stop. Variants of STOP/DJVU have a tendency to drop AZORULT password-stealing Trojan on compromised systems. This threat has a lengthy list of capabilities, such as:

Downloading malware to the computer and running it;Stealing Steam, Telegram login credentials;Viewing or deleting files on victim’s computer;Stealing cryptocurrency wallets;Stealing browser cookies, saved passwords, browsing history and more;Allowing the attacker to perform other tasks on victim’s computer remotely.

Consider the huge amount of damage done by the crypto-virus and the Trojan it brings alongside it, we recommend securing your system as soon as possible. Our team recommends a 2-step rescue plan: remove LSSR ransomware virus and related threats using professional antivirus software first. For this task, you should use an up-to-date software and our team recommends INTEGO Antivirus. Next, we suggest scanning with RESTORO to repair virus damage caused for Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques

When it comes to ransomware distribution, it can be said that malevolent actors typically use malicious email spam, illegal online downloads or fake decryption tools as the payload delivery vectors. Speaking of STOP/DJVU variants such as LSSR virus, almost all of them can be found in torrent downloads, specifically software or game cracks or tools like KMSPico. According to victims’ reports, these are the names of programs that criminals use to create fake cracks and deliver file-encrypting virus variants in them:

Adobe Photoshop;Corel Draw;Cubase;Adobe Illustrator.

Cybersecurity experts recommend avoiding suspicious websites that offer free ways to install paid software. It is always better to support legitimate software developers rather than paying hefty ransoms for criminals later. Therefore, if you’re looking for a real and fully working software version, head straight to its developers’ websites get it from there. Another very common ransomware distribution technique is attaching a maliciously modified file to an email and distributing it to thousands of potential victims. The attackers usually get such email lists from various data leaks. Nowadays, the attackers can attach a malicious script into various popular file formats, including DOCX, XLS, PDF and others. The script can connect to an external resource (internet website that contains malicious file), download it from there and run it on victim’s computer. Typical red flags in such emails are:

Urgent message tone and suggestions to open attached contents immediately;Claims about an invoice or another important document that needs to be reviewed instantly;The sender pretends to be someone from a well-known company;Spoofed email address.

Our advice is to only open emails from people you know and communicate regularly, also only open emails that you expected to receive. Do not let your curiosity take over, because if you didn’t expect an invoice or a shipment from anyone lately, there is no reason to open such file at all. If you absolutely need to, please download the attachment first and scan it with an up-to-date antivirus before trying to open it. Final ransomware distribution strategy that we must mention is fake decryption tools. Actors from other ransomware strains such as ZORAB were noticed uploading fake STOP/DJVU decryption tools to shady websites, luring victims to download them. Sadly, this would only result in a double file encryption. Believe us, if an official decryption tool would exist, you wouldn’t need to search for it on shady websites – all the well known and reputable ones would be writing news about it.

Remove LSSR ransomware and decrypt your files

Follow the instructions given below to remove LSSR ransomware virus and other malware from your PC professionally. We highly recommend securing your PC with INTEGO Antivirus, then scanning with RESTORO to repair virus damage on Windows OS files. Now that you have completed LSSR ransomware virus removal, consider taking the following actions:

Inform your local cybersecurity authority about a case of a STOP/DJVU ransomware attack.Use data backups to restore as many files as possible.Follow the given instructions to decrypt or repair files affected by STOP/DJVU versions.Change your passwords for websites you have accounts for and have login credentials saved in your browser. This is recommended due to the fact that Azorult Trojan is capable of stealing them. Do not forget to change Steam, Telegram and Skype passwords as well.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove LSSR ransomware virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove LSSR ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt LSSR files

Fix and open large LSSR files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. LSSR ransomware virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt LSSR files, follow the given tutorial.

Meanings of decryptor’s messages

The LSSR decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your LSSR extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of LSSR ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.