.Covm file extension ransomware (Covm File Recovery Guide)

What is Covm file extension

.Covm file extension is an identifier that is appended to the names of the files that have been encrypted by the Covm ransomware virus. The Covm ransomware is a new malware that belongs to the STOP (Djvu) ransomware family. It encrypts the victim’s files, changes the names of the affected files, appending .covm extension to their name, creates a file called “_readme.txt” with a ransom demand message. After the files are encrypted, their contents become inaccessible. The Covm authors demand to pay the ransom in exchange for the key and the decryptor necessary for decrypting the files. Fortunately, there is a free Covm File Decrypt Tool and several other alternative methods that can help the ransomware victims decrypt .covm files and restore the encrypted files to their original state.

Ransomware is one of the most dangerous types of computer viruses. What is characteristic of these viruses is that they stealthily encrypt files of the victim without giving themselves away. Most often, the victim does not notice the activity of a virus that encrypts files. Only when all the files are encrypted, it becomes clear that the computer was the victim of a ransomware attack. If you encounter such a situation, your computer was infected with the ransomware, and your files are encrypted with the .covm file extension, know that we created this article for you and other people faced with the same problem. This article contains a guide with important information about Covm ransomware, how it functions, how to remove the ransomware from a computer. But more importantly, this article contains detailed instructions with information on how to decrypt .covm files, as well as what other methods exist to restore encrypted files without paying a ransom to criminals.

What is Covm ransomware

Covm ransomware is a malware that was created to encrypt files located on the victim’s computer, and then extort money to decrypt them. Covm virus sneaks into the system without any visible symptoms, which is why users notice that their computer is infected too late, when the files are already encrypted.

Typically, ransomware like Covm can infect a computer when installing programs downloaded from torrent web-sites as well as when running cracked games, freeware, key generators and other similar software. Upon execution, the virus creates a directory in the Windows system directory, copies itself to this directory, changes some OS settings, and also collects information about the infected computer. After that, Covm virus tries to connect to its command server. If this succeeds, the virus sends data on the infected computer to the server, and from it receives a key (so-called ‘online key’) necessary for file encryption. If the connection to the command server has not been established, then the virus uses a fixed key (so-called ‘offline key’).

The main difference between an online key and an offline key is that the online key is in the hands of criminals and cannot be determined. The offline key is fixed and can be determined by security researchers. This gives hope that the ransomware victims will be able to decrypt files without paying ransom.

.blob, .wps, .wav, .vfs0, .zdc, .css, .xwp, .layout, .raw, .wpd, .y, .xmind, .3fr, .3dm, .qic, .wpt, .xar, .x, .vtf, .kdc, .xlsm, .zabw, .iwi, .yal, .wp, .iwd, .crt, .desc, .hplg, .xls, wallet, .jpeg, .wmd, .xbdoc, .wma, .bay, .zdb, .rtf, .ltx, .mpqge, .arw, .xlsm, .icxs, .odt, .t12, .kdb, .ztmp, .vcf, .das, .ff, .accdb, .rw2, .xyw, .itl, .odm, .wbc, .ybk, .lrf, .wmo, .7z, .sid, .xls, .crw, .webp, .odc, .bik, .wsc, .bkp, .jpg, .raf, .3ds, .zip, .wpe, .zw, .wot, .re4, .pem, .xlsb, .ncf, .ptx, .p7b, .ibank, .odb, .d3dbsp, .wma, .docx, .py, .wpw, .menu, .sum, .hkdb, .m3u, .z, .wn, .esm, .asset, .bar, .hkx, .bsa, .wb2, .tax, .upk, .1, .wbm, .pptx, .xll, .wpg, .zi, .syncdb, .txt, .xbplate, .xf, .mp4, .mov, .pdd, .xx, .epk, .wbd, .rwl, .rim, .litemod, .ntl, .x3f, .p12, .t13, .bkf, .srf, .ods, .m2, .0, .yml, .xml, .doc, .wsh, .rb, .dmp, .vpk, .rar, .wp6, .lbf, .pst, .wgz, .cfr, .bc7, .wmv, .2bp, .cer, .sb, .arch00, .wbmp, .mddata, .xlsx, .xlk, .mdbackup, .sav, .sidd, .xyp, .psk, .kf, .der, .ppt, .wcf, .csv, .wp4, .p7c, .wp7, .r3d, .z3d, .qdf, .mrwref, .avi, .dwg, .psd, .wpa, .lvl, .cas, .wpb, .dbf, .wps, .zif, .flv, .zip, .cr2, .pfx, .xdb, .mdb, .hvpl, .cdr, .pptm, .gho, .wsd, .wpd, .dng, .gdb, .xdl, .rgss3a, .erf, .dcr, .nrw, .apk, .wmv, .xpm, .wire, .bc6, .fos, .mdf, .itdb

As we said, ‘Covm file’ is an encrypted file. To decrypt it, you must use the key and the decryptor. This is reported by the authors of Covm virus, in a message that they leave on the infected computer. This message is in a file called ‘_readme.txt’. The criminals place such a file in every directory where there is at least one encrypted file. An example of the contents of this file is given below.

The contents of this file are a ransom demand message. Criminals report that all files on the computer are encrypted, and only the key and decryptor can decrypt these files and restore access to their contents. Attackers demand a ransom of $980 in exchange for a key and a decryptor. If the victim is ready to pay the ransom quickly, within 72 hours, the size of the ransom is halved to $490. The authors of the virus offer to decrypt one Covm file for free and thus prove the possibility that the files can be decrypted.

Threat Summary

Name	Covm ransomware
Type	Filecoder, File locker, Crypto malware, Ransomware, Crypto virus
Encrypted files extension	.covm
Ransom note	_readme.txt
Contact	helpmanager@mail.ch, restoremanager@firemail.cc
Ransom amount	$980, $490 in Bitcoins
Detection Names	Trojan[Ransom]/Win32.Stop, Trojan.Ransom.Stop, Win32:CoinminerX-gen [Trj], Gen:NN.ZexaF.34110.Sq0@aGaeMNkG, W32/Trojan.ANXF-3583, Win32/Kryptik.HDLM, W32/Kryptik.HDLF!tr, Trojan.Win32.Crypt, Generic/HEUR/QVM10.2.4F74.Malware.Gen, Trojan:Win32/Tofsee.GM!MTB, Trojan.Win32.VIGUA.USXVPEJ20
Symptoms	Encrypted files. Windows Explorer displays a blank icon for the file type. Files named such as ‘_readme.txt’, ‘#_README_#’, ‘_DECRYPT_’ or ‘recover’ in each folder with at least one encrypted file.. Ransom note displayed on your desktop.
Distribution methods	Malicious spam (also known as ‘malspam’). Drive-by downloads (ransomware virus has the ability to infect the computer simply by visiting a website that is running malicious code). Social media posts (they can be used to entice users to download malicious software with a built-in ransomware downloader or click a suspicious link). Malvertising campaigns.
Removal	Covm ransomware removal guide
Decryption	Covm File Decrypt Tool

How to remove Covm ransomware, Recover, Decrypt .covm files

Security researchers confirm that files with .covm extension are encrypted and to decrypt them you need to use a key and special software – decryptor. Fortunately there is a Covm File Decypt Tool which was created by Emsisoft and named Stop (djvu) decryptor. This tool allows everyone to decrypt .covm files completely free. Unfortunately, this decryptor is limited in that it can only decrypt files encrypted with an offline key, files encrypted with an online key cannot yet be decrypted. The reason for this is that only the Covm ransomware creators have the online key and this key cannot be determined or cracked. In addition to using the Covm File Decypt Tool from Emsisoft, there are several other ways to restore the content of encrypted files.

The instructions below detail how to remove Covm ransomware virus, decrypt .covm files, and also how to recover encrypted files if the free Covm File Decypt Tool could not decrypt them. Read the entire manual carefully. To make it easier for you to follow the instructions, we recommend that you print it or open it on your smartphone.

To remove Covm ransomware virus & Recover, Decrypt .covm files, use the following steps:

1. How to remove Covm ransomware virus
2. How to decrypt .covm files
3. How to restore .covm files
4. How to protect your PC from Covm ransomware

How to remove Covm ransomware virus

If you become a victim of ransomware, the first thing you need to do is perform a full scan of your computer, find and remove Covm ransomware. If there is no antivirus on your computer, then you need to install it; if there is an antivirus, update it and then perform a full scan. In addition to an antivirus, we strongly recommend that you use free malware removal tools. The utilities below will help you find all the components of the ransomware, and then remove it. Do not use only one utility, at least two, since they use different engines, this will significantly increase the chances that Covm will be completely removed.

Remove Covm ransomware with Zemana

Zemana Anti Malware highly recommended, because it can scan for security threats such as ransomware, other malicious software and trojans which most ‘classic’ antivirus software fail to pick up on. Moreover, if you have any Covm removal problems which cannot be fixed by this tool automatically, then Zemana Anti Malware provides 24X7 online assistance from the highly experienced support staff.

Installing the Zemana Anti Malware is simple. First you’ll need to download Zemana installation file from the following link.

Once downloading is complete, close all apps and windows on your system. Open a directory in which you saved it. Double-click on the icon that’s called Zemana.AntiMalware.Setup as displayed in the figure below.

When the install starts, you will see the “Setup wizard” that will help you install Zemana Free on your PC.

Once install is complete, you will see window as displayed below.

Now press the “Scan” button for checking your personal computer for the Covm crypto malware related folders,files and registry keys. A scan can take anywhere from 10 to 30 minutes, depending on the count of files on your PC system and the speed of your PC. When a threat is detected, the number of the security threats will change accordingly. Wait until the the scanning is finished.

When the system scan is done, the results are displayed in the scan report. Review the scan results and then press “Next” button.

The Zemana Anti-Malware (ZAM) will uninstall Covm ransomware and other security threats.

Remove Covm virus with MalwareBytes Free

Remove Covm ransomware manually is difficult and often the ransomware is not completely removed. Therefore, we advise you to run the MalwareBytes Free which are completely clean your PC. Moreover, this free program will allow you to remove malicious software, PUPs, toolbars and adware that your machine can be infected too.

Installing the MalwareBytes Anti Malware is simple. First you will need to download MalwareBytes Anti Malware by clicking on the link below. Save it on your MS Windows desktop or in any other place.

After the downloading process is done, close all windows on your computer. Further, open the file called MBSetup. If the “User Account Control” dialog box pops up as displayed in the figure below, press the “Yes” button.

It will open the Setup wizard which will allow you install MalwareBytes Anti Malware on the personal computer. Follow the prompts and don’t make any changes to default settings.

Once installation is finished successfully, click “Get Started” button. Then MalwareBytes Anti-Malware (MBAM) will automatically run and you can see its main window as displayed in the figure below.

Next, click the “Scan” button . MalwareBytes Free program will scan through the whole computer for the Covm virus related folders,files and registry keys. When a malicious software, adware or potentially unwanted applications are found, the count of the security threats will change accordingly.

After that process is finished, it will show the Scan Results. Once you have selected what you wish to remove from your PC press “Quarantine” button.

The MalwareBytes Free will remove Covm ransomware and other security threats. After finished, you can be prompted to reboot your computer. We recommend you look at the following video, which completely explains the procedure of using the MalwareBytes Anti-Malware to remove hijacker infections, adware software and other malware.

Use KVRT to remove Covm from your PC

Kaspersky virus removal tool (KVRT) is a free removal tool that can be downloaded and run to delete ransomware, adware software, spyware, trojans, worms, PUPs, malicious software and other security threats from your machine. You can run this utility to search for threats even if you have an antivirus or any other security application.

Download Kaspersky virus removal tool (KVRT) on your personal computer from the link below.

When the downloading process is complete, double-click on the KVRT icon. Once initialization procedure is done, you’ll see the Kaspersky virus removal tool screen like below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button for scanning your personal computer for the Covm crypto virus and other malicious software. A system scan can take anywhere from 5 to 30 minutes, depending on your PC. While the KVRT application is checking, you can see count of objects it has identified as threat.

Once Kaspersky virus removal tool has completed scanning, the results are displayed in the scan report as shown below.

Make sure all items have ‘checkmark’ and click on Continue to start a cleaning process.

How to decrypt .covm files

All files with .covm extension are encrypted and the only way to access their contents is to decrypt them. To decrypt .covm files, you need to use a unique key and the Covm File Decypt Tool. As we said above, Emsisoft company was able to create a decryptor and found a way in some cases to determine the key that was used to encrypt the files. This allows victims of the virus to decrypt .covm files for free.

To decrypt .covm files, use free Covm File Decypt Tool

• Download Covm File Decypt Tool from the following link.
  STOP Djvu decryptor
• Scroll down to ‘New Djvu ransomware’ section.
• Click the download link and save the decrypt_STOPDjvu.exe file to your desktop.
• Run decrypt_STOPDjvu.exe, read the license terms and instructions.
• On the ‘Decryptor’ tab, using the ‘Add a folder’ button, add the directory or disk where the encrypted files are located.
• Click the ‘Decrypt’ button.

Covm File Decypt Tool is a free software that can decrypt files that were encrypted with an offline key, as Emsisoft found a way to determine this key. Unfortunately, files encrypted with an online key cannot yet be decrypted. The online key is unique to each infected computer, and at the moment there is no way to find this key. Of course, criminals have this key, but we do not think that paying a ransom is a way to decrypt .covm files. In the case when the files are encrypted with an online key, there is a chance to restore the encrypted files using alternative methods, which are described below.

This video step-by-step guide will demonstrate How to use STOP Djvu decryptor (Covm File Decypt Tool) to decrypt encrypted files:

How to find out which key was used to encrypt files

Below we will demonstrate how to find out the type of key with which files were encrypted. This is very important, since knowing the type of key you can understand if you can decrypt .covm files for free using the Covm File Decypt Tool. We recommend using the second method, as it is more accurate.

Find out the type of key using ‘_readme.txt’ file

• Open the ransom demand message (‘_readme.txt’ file).
• Scroll down to the end of the file.
• There you will see a line with the text ‘Your personal ID’.
• Below is a line of characters that starts with ‘0220’ – this is your personal id.

Find out the type of key using ‘PersonalID.txt’ file

• Open disk C.
• Open directory ‘SystemID’.
• Open file named ‘PersonalID.txt’. This file lists ‘Personal ID’s that match the keys that the virus used to encrypt files.

The ‘Personal ID’ is not a key, it is an identifier related to a key that was used to encrypt files. If the ID ends with ‘t1’, then the files are encrypted with an offline key. If the ID does not end with ‘t1’, Covm ransomware virus used an online key. If you could not figure out how to determine which key was used to encrypt files, then we can help. Just write a request here or in the comments below.

This video step-by-step guide will demonstrate How to find out the type of a key.

Covm File Decypt Tool : No key for New Variant offline ID

If during decryption of .covm files the Covm File Decypt Tool reports No key for New Variant offline ID, then this means the following: your files are encrypted with an ‘offline key’, but the key itself has not yet been found by security researchers, in this case, you need to be patient and wait a while, in addition, you can also use alternative ways for recovering encrypted data. It is impossible to say exactly when the ‘offline key’ will be determined. Sometimes it takes several days, sometimes more. We recommend that you try to decrypt .covm files from time to time. You can also use alternative ways listed below for recovering encrypted data.

Covm File Decypt Tool : No key for New Variant online ID

If, when you try to decrypt .covm files, the Covm File Decypt Tool reports No key for New Variant online ID, then this means that your files are encrypted with an ‘online key’ and their decryption is impossible, since only the Covm authors have the key necessary for decryption. In this case, you need to use alternative methods listed below to restore the contents of encrypted files.

How to restore .covm files

If your files were encrypted with .covm extension, then there is a chance that you can recover the files without decryption. We recommend using PhotoRec and ShadowExplorer that are designed to find and recover lost and deleted data. Mostly such programs are paid, but these tools can restore your files for free. Each of these tools has helped many times to recover files after ransomware infection in what would seem to be the most hopeless cases. We want to remind you that before you try to recover files, you need to check your computer for ransomware using free malware removal tools. It is very important to find the Covm virus and completely remove it.

Recover .covm files with ShadowExplorer

Modern versions of the Windows OS have one very useful feature. The Windows automatically makes copies of the files you use. These copies are called ‘Shadow Volume Copies’ and are not directly visible to the user. ShadowExplorer will allow you to get easy access to these files, and thus restore the original state of encrypted files. Of course, not everything is so simple, unfortunately very often ransomware deletes these copies, thus preventing the simple recovery of encrypted files. But in some cases, copies of the files remain and allow for quick file recovery. Therefore, our opinion, you need to try this method.

ShadowExplorer can be downloaded from the following link. Save it on your Desktop.

After the downloading process is complete, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as displayed on the image below.

Double click ShadowExplorerPortable to start it. You will see the a window as shown in the following example.

In top left corner, select a Drive where encrypted personal files are stored and a latest restore point as shown in the following example (1 – drive, 2 – restore point).

On right panel look for a file that you want to recover, right click to it and select Export as shown below.

This video step-by-step guide will demonstrate How to recover encrypted files using Shadow Explorer.

Use PhotoRec to restore .covm files

There is another very good way to recover .covm files – use a tool that finds and restores deleted files. We recommend using PhotoRec. This is one of the few programs that allows you to do this for free. The reason that allows you to recover encrypted files using this method is simple – when you or any program, including the ransomware, deletes the file, this file is not deleted, the Windows OS marks it as deleted and hides it. PhotoRec finds such deleted files and restores them. Thus, at the output, you get files in an unencrypted state. The only thing I want to draw your attention to is that the less you used your computer after ransomware infection, the higher your chance of recovering encrypted files.

Download PhotoRec on your MS Windows Desktop by clicking on the following link.

After the downloading process is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and choose Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as displayed in the following example.

Double click on qphotorec_win to run PhotoRec for MS Windows. It’ll open a screen like below.

Select a drive to recover as displayed on the screen below.

You will see a list of available partitions. Choose a partition that holds encrypted files such as the one below.

Press File Formats button and specify file types to recover. You can to enable or disable the restore of certain file types. When this is finished, click OK button.

Next, press Browse button to choose where restored files should be written, then press Search.

Count of recovered files is updated in real time. All recovered photos, documents and music are written in a folder that you have selected on the previous step. You can to access the files even if the restore process is not finished.

When the recovery is complete, click on Quit button. Next, open the directory where restored files are stored. You will see a contents as shown on the image below.

All recovered documents, photos and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you’re looking for a specific file, then you can to sort your recovered files by extension and/or date/time.

This video step-by-step guide will demonstrate How to recover encrypted files using PhotoRec.

How to protect your PC from Covm ransomware

Most antivirus programs already have built-in protection system against the ransomware virus. Therefore, if your system does not have an antivirus program, make sure you install it. As an extra protection, use the HitmanPro.Alert. All-in-all, HitmanPro.Alert is a fantastic utility to protect your PC system from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of MS Windows OS from MS Windows XP to Windows 10.

Installing the HitmanPro Alert is simple. First you will need to download HitmanPro.Alert on your personal computer by clicking on the following link.

Once downloading is done, open the directory in which you saved it. You will see an icon like below.

Double click the HitmanPro Alert desktop icon. After the utility is launched, you’ll be displayed a window where you can choose a level of protection, as shown on the screen below.

Now press the Install button to activate the protection.

Finish words

This guide was created to help all victims of Covm ransomware virus. We tried to give answers to the following questions: how to remove Covm ransomware; how to decrypt .covm files; how to recover files, if the Covm File Decypt Tool does not help; what is an online key and what is an offline key. We hope that the information presented in this manual has helped you.

If you have questions, then write to us, leaving a comment below. If you need more help with Covm related issues, go to here.