MPAJ ransomware wants to extort victims after encrypting their filesRansom note holds message from criminalsEncryption and decryption explainedThreat SummaryThe virus might block access to computer and cybersecurity related sitesRansomware enters targets systems using Trojan-like strategyRemove MPAJ file virus for good

In addition to data corruption, MPAJ virus installs AZOrult Trojan on the system, a highly dangerous and stealthy password-stealer. This malicious piece of software can grab all passwords you type or save in your browser and send them to criminals’ remote server. The ransomware installs silently and operates as a background process, meanwhile, a fake Windows update screen appears on the screen. Therefore, the victim might not suspect a cyber attack that easily. MPAJ ransomware then connects to a remote C&C server to obtain an unique encryption key for the victim and starts encrypting all files at once. In case the connection between the victim’s host and criminals’ server cannot be established, the virus uses an offline encryption key instead.

Ransom note holds message from criminals

The _readme.txt note explains that files cannot be recovered in any other way than paying the criminals. They offer a free decryption for one file and also suggest contacting them within 3 days to qualify for a lower ransom proce ($490) instead of full price ($980). The contact emails provided are helpdatarestore@firemail.cc and helpmanager@mail.ch. If you have been attacked by this virus and now you cannot open your files, you must remove MPAJ ransomware virus as soon as possible and eliminate the password-stealer it installed on your system. To clean out virus damage we recommend using software like System Mechanic Ultimate Defense.

Encryption and decryption explained

The encryption type can be identified by looking at the key ending on C:/SystemID/PersonalID.txt file. If the key ends in t1, an offline encryption was used, and there are chances to recover data. If your files were encrypted with online key, THERE ARE NO chances to decrypt .mpaj file type for free. MPAJ file type files can no longer be opened as they’re encrypted with a highly secure algorithm. No matter what program you’ll try to use, the original content won’t appear as before. Moreover, some victims question the possibility to compare original and encrypted files, but this doesn’t help in the context of encryption as well. The only way to restore files is to have a decryption software and private key held by the criminals. Of course, victims can always recover their files using a data backup. STOP/DJVU Decryption tool can help victims subject to offline encryption. Please read the article and check back for updates to see when MPAJ decryption becomes available.

Threat Summary

MPAJ ransomware virus belongs to the new STOP/DJVU variants group, which is an advanced and more robust malware variant. It also includes new features, and one of them is ability to modify Windows HOSTS file. The file can be used to block certain websites on the computer. This feature is often used for child activity controls on the computer. In this case, the ransomware restricts victim’s access to various computer and security themed sites. Our bet is that the criminals are trying to frighten the victim and prevent him/her from seeking help online. Some of the blocked websites include pages like BleepingComputer, Microsoft, and others.

Ransomware enters targets systems using Trojan-like strategy

MPAJ virus is no different from previous DJVU versions (JOPE, MOSK, OPQZ, OOSS, etc.) and tends to await victims in a form of software cracks, keygens, and other illegal downloads. Such downloads are especially popular during COVID-19 quarantine season, since people are staying indoors and watching movies/playing computer games are one of the most popular activities. Unfortunately, ransomware creators know the fact that many computer users are unwilling to spend money on legitimate software licenses, therefore they pack the ransomware into files that seem to be the software license activators and upload them to file sharing websites. Such files are usually downloaded via peer-to-peer download managers like uTorrent, eMule, and similar. Once activated, the ransomware hits the system and does irreversible damage instantly. However, if you’re trying to protect yourself against ransomware attacks, you should beware of other ransomware distribution strategies, such as unsecured RDP, malicious email spam, infected websites, fake updates and similar.

Remove MPAJ file virus for good

You must remove MPAJ ransomware virus remains and delete AZORULT malware it installed on your computer. This is essential to make your PC safe to use again. In addition, we recommend deleting malware automatically, using a recommended software such as System Mechanic Ultimate Defense. MPAJ virus removal needs to be completed in Safe Mode even when using automatic security software. We strongly recommend you to follow the instructions provided below to delete malware successfully. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Alternative software recommendations

Malwarebytes Anti-Malware

Method 1. Enter Safe Mode with Networking

Before you try to remove the virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it: Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10 users Now, you can search for and remove MPAJ ransomware files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable malware removal program. In addition, we suggest trying a combination of INTEGO Antivirus (removes malware and protects your PC in real-time) and RESTORO (repairs virus damage to Windows OS files).

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future. Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.