How to remove Foqe ransomware, Decrypt .foqe files.

What is Foqe file extension

.Foqe file extension is an extension that is used by a new variant of STOP ransomware. The ‘Foqe’ variant is very similar in its characteristics to other variants of this ransomware. It also encrypts files, and then renames them, giving them a new filename consisting of their old and ‘.foqe’ appended at the end. Criminals demand a ransom for a key-decryptor pair, which is necessary to unlock encrypted data. Fortunately, there is a free decryptor. It allows everyone to decrypt files that have been affected with any version of STOP (Djvu) ransomware, including ‘Foqe’ variant. Scroll down to find out more about the decryptor, where to download it and how to use it to decrypt .foqe files.

What is Foqe ransomware

Foqe ransomware is the 256th version of STOP (Djvu) ransomware. The behavior of this variant and the methods of its distribution are similar to other variants of STOP (Djvu). As before, the cybercriminals use adware, crack, activators and torrents web-sites to spread this ransomware. Upon execution, Foqe virus encrypts all files on the victim’s computer. This means that files on all drives connected to the computer will be encrypted. Files located on external devices, such as files on a flash drive and cloud storage, can also be encrypted.

Each file is encrypted using a strong encryption algorithm and a long key. The key that the virus uses can be of two types: online key and offline key. The security researchers found that if Foqe virus could establish a connection to its command-and-control (C&C) server before encrypting the files, then the key obtained from it is used, this key is called ‘online key’. Such a key is unique for each infection, which means that the key for decrypting files from one victim is not suitable for decrypting files from another victim. If Foqe could not establish a connection with the C&C server, then it uses an encryption key, which is the same for all cases of infection. This type of key is called ‘offline key’.

The authors of Foqe virus created it so that it encrypts as many files as possible. Therefore, the virus does not encrypt the entire file, but only its initial part, in the amount of 154kb. Thanks to this, the contents of some types of files (for example, zip archives) can be restored by simply returning the old filename to them, that is, removing the extension ‘.foqe’. In the process of encryption, the virus skips files, that is, leaves them in their original state if:

• files are located in the Windows system directories
• files have the extension .bat, .sys, .dll, .lnk, .ini
• files are named ‘_readme.txt’

All other files will be encrypted. That is, the contents of the following common file types can be encrypted:

.db0, .docm, .wb2, .dazip, .yal, .xxx, .mdbackup, .sid, .sidn, .indd, .x, .xf, .css, .kdb, .bsa, .pkpass, .dba, .apk, .cfr, .py, .2bp, .wps, .mef, .layout, .kdc, .zip, .ncf, .raf, .upk, .3fr, .docx, .t12, .qic, .rwl, .dbf, .wpb, .wp, .cdr, .wav, .xdl, .vfs0, .bay, .jpeg, .odc, .hkx, .wsd, .wpl, .svg, .zw, .xlsm, .7z, .wbz, .t13, .wma, .odm, .cas, .rgss3a, .ltx, .wgz, .bc7, .doc, .pfx, .hvpl, .wmf, .bik, .cr2, .wpe, .orf, .wn, .map, .litemod, .der, .wbd, .rar, .dxg, .sb, .p7c, .xlsx, wallet, .r3d, .ntl, .ibank, .mpqge, .menu, .wbc, .eps, .lbf, .xar, .arw, .vtf, .epk, .vdf, .cer, .wri, .crw, .x3f, .wps, .xll, .wmv, .avi, .iwi, .wpt, .dwg, .mcmeta, .dcr, .srw, .ws, .ptx, .dmp, .re4, .pdf, .xmind, .lvl, .erf, .wp6, .zif, .z3d, .odb, .fos, .das, .xwp, .sql, .sidd, .z, .1, .webdoc, .wm, .wpd, .wbk, .hplg, .mdf, .xls, .js, .fpk, .wp4, .pptm, .wdp, .sis, .xbplate, .sav, .wp7, .xml, .pak, .mddata, .tax, .xy3, .sie, .mdb, .pef, .arch00, .ztmp, .1st, .bkf, .0, .icxs, .wmv, .rb, .jpg, .mp4, .wma, .ysp, .xbdoc, .txt, .bc6, .blob, .wp5, .bkp, .xyw, .rw2, .wmo, .xlk, .gdb, .dng, .png, .xlsb, .rofl, .mrwref, .wot, .zi, .wmd, .x3f, .slm, .asset, .wotreplay, .srf, .xls, .xx, .webp, .mov, .xyp, .xpm, .3ds, .vpk, .p7b, .p12, .hkdb, .gho, .xdb, .qdf, .sr2, .pdd, .d3dbsp, .lrf, .wpa

After Foqe virus encrypts the file, it renames this file. Thus, each encrypted file gets a new filename. For example, the file ‘image.jpg’, after it is encrypted, will be renamed to ‘image.jpg.foqe’. In all directories where there is at least one encrypted file, the virus drops a file with the name ‘_readme.txt’. A sample of the contents of this file is shown in the figure below.

Criminals use this file to demand ransom from victims of Foqe virus. The message said that the victim’s files were encrypted with a strong algorithm and a key. The authors of the virus demand a ransom in exchange for a key and a decryptor. The ransom is $490 and must be paid within 72 hours. If the victim does not pay it during this time, the ransom increases to $980. Attackers offer to decrypt one file for free, but this file should be small in size and not contain any important information. Of course, decryption of one file cannot guarantee that after paying the ransom the victim will be able to recover files affected with the virus.

Threat Summary

Name	Foqe
Type	File locker, Crypto virus, Ransomware, Crypto malware, Filecoder
Encrypted files extension	.foqe
Ransom note	_readme.txt
Contact	helpmanager@mail.ch, restoremanager@airmail.cc
Ransom amount	$490, $980 in Bitcoins
Detection Names	Trojan.Ransom.Stop, TR/AD.InstaBot.AQ, W32.CrysisAgentGLD.Trojan, Trojan.Win32.Crypt, Win32/Kryptik.HGNO, Trojan.MalPack.GS, Ransom.Win32.STOP.DE, BScope.Trojan.CryptInject, Ransom.Wannacry
Symptoms	Encrypted files. Your files now have a odd extension. Your file directories contain a ‘ransom note’ file that is usually a .html, .jpg or .txt file. Ransom note displayed on your desktop.
Distribution methods	Malicious email attachments. Malicious downloads that happen without a user’s knowledge when they visit a compromised web page. Social media posts (they can be used to force users to download malicious software with a built-in ransomware downloader or click a suspicious link). Torrent web pages.
Removal	Foqe ransomware removal guide
Decryption	Foqe File Decrypt Tool

 

Security researchers confirm that Foqe virus does indeed encrypt files, and also that a decryptor and a key are required to decrypt them. Fortunately for all victims of this virus, as well as other variants of STOP (Djvu) ransomware, EmsiSoft developed a free decryptor. Thus, it is possible to decrypt .foqe files. This decryptor has only one limitation, so far it can decrypt files that were encrypted with an offline key. If the victim’s files were encrypted with an online key, then they cannot be decrypted. But even in this case, not everything is lost. Each Foqe victim has a chance to restore some or all of the encrypted files to their original state using alternative methods, which are described below.

How to remove Foqe ransomware virus; Recover, Decrypt .foqe files

If your files were encrypted with .foqe extension, then we recommend using the following steps. These steps will help you remove the ransomware and decrypt (restore) the encrypted files. Read the entire manual carefully. To make it easier for you to follow the instructions, we recommend that you print it or open it on your smartphone.

1. How to remove Foqe ransomware virus
2. How to decrypt .foqe files
3. How to restore .foqe files
4. How to protect your PC system from Foqe ransomware

How to remove Foqe ransomware virus

You need to remove the Foqe ransomware virus and its autostart entries before proceeding to decrypt or restore encrypted files. This must be done since otherwise the ransomware may re-encrypt the restored files. You can stop the ransomware from working, as it is not difficult to do. Another option is to perform a full system scan using free malware removal tools capable of detecting and removing ransomware infection.

It is very important to scan the computer for malware, as security researchers found that spyware could be installed on the infected computer along with the Foqe ransomware. Spyware is a very dangerous security threat as it is designed to steal the user’s personal information such as passwords, logins, contact details, etc. If you have any difficulty removing the Foqe virus, then let us know in the comments, we will try to help you.

To remove Foqe ransomware, follow the steps below:

1. Kill the Foqe ransomware process
2. Disable the Foqe ransomware Start-Up
3. Delete the Foqe ransomware Task
4. Delete the Foqe ransomware File
5. Scan computer for malware

Kill the Foqe ransomware process

Press CTRL, ALT, DEL keys together.

Click Task Manager. Select the “Processes” tab, look for something suspicious that is the Foqe ransomware then right-click it and select “End Task” or “End Process” option. If your Task Manager does not open or the Windows reports “Task manager has been disabled by your administrator”, then follow the guide: How to Fix Task manager has been disabled by your administrator.

It is not difficult to detect a process related to the Foqe ransomware. When looking for a malicious process, pay attention to the process icon and its name. Most often, this ransomware has a process name in the following format: 4-characters.tmp.exe or 4-characters.exe. For example: 7533.tmp.exe, A4b1.exe, CD15.tmp.exe, 19b2.exe. If you do not find a process with a similar name in the list of processes, then most likely the Foqe ransomware has finished working. But keep in mind, if you do not remove the ransomware autostart entries, as demonstrated below, and do not delete its file, then after a while it may start again, and if it finds unencrypted files, immediately encrypt them.

Disable the Foqe ransomware Start-Up

Select the “Start-Up” tab, look for something similar to the one shown in the example below, right click to it and select Disable.

Close Task Manager.

Delete the Foqe ransomware Task

Type “Task Scheduler” in the search bar. Click Task Scheduler app in the search results. Click “Task Scheduler Library” in the left panel. On the right panel, right-click to “Time Trigger Task” and select Delete.

Close Task Scheduler.

Delete the Foqe ransomware File

Run Task Manager and select the “Start-Up” tab. Right click to the Foqe ransomware Start-Up entry and select Open File Location as shown below.

A directory containing one file will open in front of you, this file is the Foqe ransomware. It needs to be removed. If you try to delete it immediately, then you will not succeed, since this file is protected from deletion.

To delete this file, you need to do the following. Right-click on the file, select Properties. In the window that opens, select Security tab. Next, click the Advanced button below. A window will open as shown in the following example.

Click Disable inheritance. In the Block inheritance dialog box that opens, select the first item (Convert inherited permissions…) as shown below.

In the Permission entries list, select “Deny Everyone”, click Remove button and then OK. Close the file properties window. You should now be able to remove the Foqe ransomware File. Right-click on the file and select Delete.

Scan computer for malware

Zemana Anti-Malware is a program that is used for trojans, adware software, worms, spyware, malware, ransomware virus and other security threats removal. This malware removal tool is one of the most efficient anti malware utilities. It helps in ransomware removal and and defends all other types of malware. One of the biggest advantages of using Zemana Anti-Malware is that is easy to use and is free. Also, it constantly keeps updating its virus/malware signatures DB. Let’s see how to install and scan your computer with Zemana in order to remove Foqe ransomware from your computer.

Visit the page linked below to download the latest version of Zemana for Windows. Save it on your Desktop.

When the downloading process is finished, close all windows on your PC. Further, start the set up file named Zemana.AntiMalware.Setup. If the “User Account Control” dialog box pops up such as the one below, click the “Yes” button.

It will open the “Setup wizard” which will allow you install Zemana AntiMalware on the PC. Follow the prompts and do not make any changes to default settings.

Once setup is finished successfully, Zemana AntiMalware (ZAM) will automatically start and you may see its main window as displayed below.

Next, click the “Scan” button to perform a system scan with this tool for the Foqe malware related folders,files and registry keys. When a malicious software, adware or potentially unwanted programs are found, the number of the security threats will change accordingly.

When Zemana Anti Malware is finished scanning your PC, a list of all items found is produced. Review the scan results and then click “Next” button.

The Zemana will delete Foqe ransomware and other security threats and move the selected items to the Quarantine. After that process is done, you can be prompted to reboot your computer.

In order to be 100% sure that the computer no longer has the Foqe virus, we recommend using the Kaspersky virus removal tool (KVRT). It is a free portable program that scans your computer for spyware, crypto virus, adware, PUPs, trojans, worms, malicious software and helps uninstall them easily. Moreover, it will also allow you delete any other security threats for free.

Download Kaspersky virus removal tool (KVRT) on your MS Windows Desktop from the link below.

Once the download is finished, double-click on the KVRT icon. Once initialization procedure is finished, you will see the Kaspersky virus removal tool screen as displayed in the figure below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next press Start scan button . Kaspersky virus removal tool utility will begin scanning the whole PC system to find out the Foqe crypto virus . This procedure can take quite a while, so please be patient. While the utility is scanning, you may see count of objects and files has already scanned.

When KVRT is finished scanning your PC, Kaspersky virus removal tool will open you the results as on the image below.

Make sure all threats have ‘checkmark’ and press on Continue to begin a cleaning process.

How to decrypt .foqe files

Files with the extension ‘.foqe’ are encrypted files. In other words, the contents of these files are locked. Their contents cannot be read even if you rename files or change their extension. As we reported above, there is a free decryptor, which was created by Emsisoft. This decryptor allows everyone to decrypt .foqe files.

To decrypt .foqe files, use Foqe File Decrypt Tool

• Download Foqe File Decrypt Tool from the following link.
  STOP Djvu decryptor
• Scroll down to ‘New Djvu ransomware’ section.
• Click the download link and save the ‘decrypt_STOPDjvu.exe’ file to your desktop.
• Run decrypt_STOPDjvu.exe, read the license terms and instructions.
• On the ‘Decryptor’ tab, using the ‘Add a folder’ button, add the directory or disk where the encrypted files are located.
• Click the ‘Decrypt’ button.

Foqe File Decrypt Tool is a free software that is able to decrypt files encrypted with an offline key. Files encrypted with an online key cannot yet be decrypted. The online key is unique to each infected computer, and at the moment there is no way to obtain this key. Of course, the authors of Foqe virus own this key, but we do not think that paying a ransom is the right way to decrypt .foqe files. In the case when the files are encrypted with an online key, there is a chance to restore the encrypted files using alternative methods, which are described below.

How to find out which key was used to encrypt files

Since Foqe File Decrypt Tool only decrypts files encrypted with the offline key, each Foqe’s victim needs to find out which key was used to encrypt the files. Determining the type of key used is not difficult. Below we give two ways. Use any of them.

Find out the type of key using ‘_readme.txt’ file

• Open the ransom demand message (‘_readme.txt’ file).
• Scroll down to the end of the file.
• There you will see a line with the text ‘Your personal ID’.
• Below is a line of characters that starts with ‘0233’ – this is your personal id.

Find out the type of key using ‘PersonalID.txt’ file

• Open disk C.
• Open directory ‘SystemID’.
• Open file named ‘PersonalID.txt’. This file lists ‘Personal ID’s that match the keys that the virus used to encrypt files.

The ‘Personal ID’ is not a key, it is an identifier related to a key that was used to encrypt files. If the ID ends with ‘t1’, then the files are encrypted with an offline key. If the ID does not end with ‘t1’, Foqe ransomware virus used an online key. If you could not figure out how to determine which key was used to encrypt files, then we can help. Just write a request here or in the comments below.

Foqe File Decrypt Tool : “No key for New Variant online ID”

If, when you try to decrypt .foqe files, Foqe File Decrypt Tool reports:

No key for New Variant online ID: *
Notice: this ID appears to be an online ID, decryption is impossible

It means that your files are encrypted with an ‘online key’ and their decryption is impossible, since only the Foqe authors have the key necessary for decryption. In this case, you need to use alternative methods listed below to restore the contents of encrypted files.

Foqe File Decrypt Tool : “No key for New Variant offline ID”

If, during decryption of .foqe files, Foqe File Decrypt Tool reports:

No key for New Variant offline ID: *t1
Notice: this ID appears be an offline ID, decryption MAY be possible in the future.

It means the following: your files are encrypted with an ‘offline key’, but the key itself has not yet been obtained by security researchers, in this case, you need to be patient and wait a while, in addition, you can also use alternative ways for recovering encrypted data.

If for some reason you were unable to decrypt the encrypted files, then We recommend to follow the news on our Facebook or YouTube channels. So you ‘ll know right away that it ‘s possible to decrypt .foqe files.

This video step-by-step guide will demonstrate How to use STOP Djvu decryptor to decrypt encrypted files.

How to restore .foqe files

If all your files are encrypted with an online key, or the Foqe File Decrypt Tool cannot decrypt the encrypted files, then you only have one thing left, use alternative methods to restore the contents of the encrypted files. There are several alternative methods that may allow you to restore the contents of encrypted files. However, if you have not tried the free decryptor, then try it first by following step 2 of this instruction, and then return here.

Alternative methods of file recovery do not use decryption, so there is no need for a key and decryptor. Before you begin, you must be 100% sure that the computer does not have active ransomware. Therefore, if you have not yet checked your computer for ransomware, do it right now, use free malware removal tools or return to step 1 above.

Restore .foqe files with ShadowExplorer

A free tool named ShadowExplorer is a simple solution to use the ‘Previous Versions’ feature of MS Windows 10 (8, 7 , Vista). You can recover your documents, photos, and music encrypted by Foqe ransomware from Shadow Copies for free. Unfortunately, this method does not always work due to the fact that the ransomware almost always deletes all Shadow copies.

First, click the following link, then click the ‘Download’ button in order to download the latest version of ShadowExplorer.

After the download is finished, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as on the image below.

Launch the ShadowExplorer utility and then select the disk (1) and the date (2) that you wish to recover the shadow copy of file(s) encrypted by the Foqe ransomware virus as shown below.

Now navigate to the file or folder that you want to restore. When ready right-click on it and press ‘Export’ button as on the image below.

This video step-by-step guide will demonstrate How to recover encrypted files using Shadow Explorer.

Recover .foqe files with PhotoRec

There is another, unfortunately the last, way to recover the contents of encrypted files. This method is based on using data recovery tools. We recommend using a tool called PhotoRec. It has all the necessary functions and is completely free.

Download PhotoRec from the following link. Save it on your Microsoft Windows desktop.

Once downloading is finished, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as shown on the image below.

Double click on qphotorec_win to run PhotoRec for MS Windows. It’ll open a screen as shown on the image below.

Select a drive to recover as displayed on the image below.

You will see a list of available partitions. Select a partition that holds encrypted photos, documents and music as displayed on the image below.

Press File Formats button and specify file types to recover. You can to enable or disable the restore of certain file types. When this is done, click OK button.

Next, click Browse button to choose where recovered personal files should be written, then click Search. We strongly recommend that you save the recovered files to an external drive.

Count of recovered files is updated in real time. All recovered personal files are written in a folder that you have selected on the previous step. You can to access the files even if the recovery process is not finished.

When the restore is complete, click on Quit button. Next, open the directory where recovered documents, photos and music are stored. You will see a contents similar to the one below.

All restored photos, documents and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you are looking for a specific file, then you can to sort your restored files by extension and/or date/time.

This video step-by-step guide will demonstrate How to recover encrypted files using PhotoRec.

How to protect your PC system from Foqe ransomware

Most antivirus apps already have built-in protection system against the ransomware. Therefore, if your device does not have an antivirus application, make sure you install it. As an extra protection, use the HitmanPro.Alert. All-in-all, HitmanPro.Alert is a fantastic tool to protect your PC from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of Microsoft Windows OS from Windows XP to Windows 10.

Installing the HitmanPro.Alert is simple. First you will need to download HitmanPro.Alert by clicking on the following link.

After downloading is finished, open the directory in which you saved it. You will see an icon like below.

Double click the HitmanPro.Alert desktop icon. Once the utility is started, you will be shown a window where you can choose a level of protection, like below.

Now click the Install button to activate the protection.

To sum up

This guide was created to help all victims of Foqe ransomware virus. We tried to give answers to the following questions: how to remove ransomware; how to decrypt .foqe files; how to recover files, if STOP (Foqe) decryptor does not help; what is an online key and what is an offline key. We hope that the information presented in this manual has helped you.

If you have questions, then write to us, leaving a comment below. If you need more help with Foqe related issues, go to here.