Those behind the cyber-attack will inform the victim that SBPG ransomware virus has encrypted their entire files as contained in the computer, and since they made use of a very strong encryption key, they won’t be able to have access to the files anymore. However, if they can meet up with their ransom demand, the file decryption tool would be made available to him. To facilitate communication between them, these emails: manager@mailtemp.ch and helpsupportmanager@airmail.cc would also be forwarded to the victim.   Furthermore, they will notify their victim about certain payment conditions they must adhere to. For instance, they will point out that even though the ransom fee is $980 but they will be willing to accept a 50% discount which brings the ransom fee to $490, provided the victim would be fast enough to pay within 72 hours/3 days.   The moment the victim indicates interest in paying the ransom fee, they would direct him to pay the cryptocurrency worth of the fee into a wallet address they would make available. They apparently use this medium as a precautionary measure to always remain anonymous and avoid being tracked by law enforcement agents. In order to convince the victim about their capability to restore the encrypted files, they may inform them to forward any random piece but such must not contain any information they could perceive as important to the victim. Our policy as formulated by in-house cybersecurity experts is in tandem with FBI guidelines, and both recommend that victims SHOULD NOT PAY RANSOM, regardless of the situation. The reason for this stance is because there is no guarantee you will recover your encrypted files, even if you pay the stipulated ransom fee. Also, when victims pay ransom, they are only encouraging the cybercriminals to continue being a menace since they would find it profitable and would be spurred to even widen their net.  In addition, the virus equally releases other Trojans like VIDAR among others that are known to steal information from the already compromised computer. Such vital information that would be under threat of being stolen include banking details, software account login details, cryptocurrency wallets, browsing history, passwords saved in your browser etc. and once they get hold of these sensitive details, the victim would be at risk of further blackmail.   For those that are victims of STOP/DJVU variant already, you will need to urgently remove SBPG ransomware virus as soon as you can from your computer. You can make use of any strong and genuine antivirus to run a full scan on your computer. Our team recommends an exceptional one – INTEGO Antivirus. You can read more about it here. As an additional step, we suggest downloading RESTORO to repair virus damage on Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ways through which ransomware are distributed 

One of the most common ways through which STOP/DJVU ransomware variants (including SBPG virus) are spread is by downloading malicious torrents. Certain pirated software copies, especially counterfeit of some popular ones are often laced with malwares and uploaded in online torrents libraries. Most of the victims of cyber-attacks have reported visiting such illegal sites before their computer systems became compromised. Therefore, such platforms should be avoided at all costs, including those that claim to offer license activation tools or “cracks”. Indeed, there are countless software contents that cybercriminals reproduce for the purposes of spreading malware, but below are the most common ones:

Cubase;Adobe Illustrator;VMware Workstation;Fifa 20;Opera browser;AutoCad;Tenorshare 4ukey;Corel Draw;KMSPico (illegal Windows activation tool);Adobe Photoshop;League of Legends;Internet Download Manager. 

So far, it has become evident that visiting online torrents libraries is never a smart idea; therefore computer users should avoid them. We always advise individuals to obtain their software needs legitimately, either directly through the official sites of the original content producers or their authorized third party agents. Online torrents platforms may appear cheap on the face value but they’re mostly traps set by cybercriminals to catch unsuspecting victims. Also, when you source your software content needs legitimately, you will be encouraging the industry to grow and you won’t be at risk of possible lawsuits for using illegal pirated software copies.  Aside online torrents, another prolific way cybercriminals distribute ransomware is through malicious email attachments. In this format, they often create believable messages and documents, particularly making use of PDF, XLS or DOCX. These ones are popular because they have features that enable JavaScript or other macro functions that make it easy for the payload to be downloaded and released on any computer system.  If, as the case may be, you’re already a victim, it is still necessary that you should avoid any website that claim to have decryption solutions. Such does not exist at the moment and throwing caution to the wind because you’re already a victim can lead to further damage in two ways, namely;

Fake STOP/DJVU decryptors can be used to spread other ransomware versions like ZORAB;Downloading such fake tools can lead to double encryption of your files.

Further details about malware infection

For those that may be wondering about the extent of damage that was done to their computer system during the SBPG ransomware attack, this section would provide more insight. Generally, the first thing malware does after infiltration is to set up build.exe or build2.exe as well as winupdate.exe (i.e. the algorithm that prompts fake Window screen). Then, it makes a connection with https[:]//api.2ip.ua/geo.json while the result would be saved in geo.json file. It will then commence the process of gathering every piece of information about the computer such as its geo-location, time zone, zip code, hardware features and software contents, as well as longitude and latitude. This set of information will be forwarded to their central server.  Below image is an example of geo.json file. Afterwards, the malware will compare the geolocation of the computer against their list comprising of encryption-exempted countries, they are; Ukraine, Russia, Belarus, Kyrgyzstan, Syria, Kazachstan, Armenia, Tajikistan and Uzbekistan. If the computer’s geo-location matches with any of these countries, it will instantly stop any further attempt at encryption. However, if otherwise, it will proceed by fetching online encryption key from their central server which would be combined with the victim’s ID and saved to bowsakkdestx.txt file and to PersonalID.txt file.  Please check below to see how these files appear. However, if the virus fails to get an online encryption ID, it will make use of an offline ID which would be uniform for all victims of that same virus variant. You can tell if an offline ID was used if t1 key characters appear at the end of the personal ID. The implication of using an offline ID is that it increases the chances of decrypting .sbpg files, going forward.   More details about this is provided below this article.  At this stage, the ransomware will commence full data encryption process by scanning all folders and encrypting them with Salsa20 before locking the encryption with RSA-2048 key. While this process is still ongoing, the virus will mark every file with more extensions. The image below is an example of _readme.txt ransom note dropped in every folder. Next thing the virus does is to make use of Command Prompt task in deleting all Volume Shadow Copies as shown here: vssadmin.exe Delete Shadows /All /Quiet. Additionally, the virus gathers information about compromised system, such as infection timestamp, computer name, hardware details, active processes and installed software. Gathered information is saved to information.txt file and also transferred to criminals’ C&C server. You can see an example of this file below. The virus then wraps it up by compiling a list of domains on Windows HOSTS file and saves them on the localhost IP. By blacklisting these domains, the victim won’t be able to have access to them anymore and when he tries, DNS_PROBE_FINISHED_NXDOMAIN error message may appear on the screen each time the victim tries to browse any address from the list. The purpose of blacklisting these particular sites is to prevent the victim from getting any help online.  The virus would drop additional malware on the already compromised computer, particularly Trojans like VIDAR or AZORULT. 

Remove SBPG Ransomware Virus and Recover Your Files

The two basic things victims should do once they discover they’ve been infected by malware is to report the situation to local authorities in charge of handling such issues and also to remove SBPG ransomware virus immediately. The guide below will teach you how to safely and effectively make use of antivirus while setting up your computer appropriately. If you’re looking for a trustworthy antivirus to use, our team recommends INTEGO Antivirus. Additionally, you may want to try and download RESTORO, which comes in handy when trying to repair virus damage on Windows OS files. Now that you’ve completed SBPG virus removal, it is time to follow through on these steps as recommended by our experts: 

You should inform the appropriate local authorities in charge of handling cybercrime and related issues;Now is the time to put your backup devices to good use. However, you need to ensure there are no more traces of malware in your computer system before plugging any external storage device;Learn possible ways you can repair files damaged by STOP/DJVU versions;All passwords associated with the compromised computer should be changed as a matter of urgency. 

Cybercriminals are still very much on the prowl, desperately looking for unsuspecting users to prey on. However, by following the recommendations as stipulated here, it would help in preventing most of these unsavory experiences.  OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove SBPG Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove SBPG Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt SBPG files

Fix and open large SBPG files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. SBPG Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt SBPG files, follow the given tutorial.

Meanings of decryptor’s messages

The SBPG decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your SBPG extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of SBPG Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.