They will reiterate that CKAE ransomware virus has encrypted their entire database, thereby rendering all files useless, including important documents, pictures, data etc. They will claim that a very strong and unique encryption key was used. In other words, there is no other way they could get around it except by paying ransom to cybercriminals. To facilitate further discussions, they will drop two email addresses: support@sysmail.ch and helprestoremanager@airmail.cc. Also included in the information would be decryption service prices and terms of payment. They will notify the victim that how much they would pay depends on how fast they’re able to comply. For instance, if they desire to pay only 50% of the total cost of ransom, then payment must be made within 72 hours/3 days max. Therefore, they would have to pay $490 only but once 72 hours elapses, only the full payment of $980 would be acceptable. However, once the victim reaches out to them, he would be informed that payment can only be made by purchasing cryptocurrency that is worth the ransom fee and transferring same to a wallet address they would make available. They usually make use of such payment option because of the anonymity it provides. They consider other payment channels too risky and easily traceable by law enforcement agents who may come after them. To convince the victim that all encrypted files will be restored by them once payment is made; they may request for excerpts of the encrypted files to be forwarded to them for test decryption but will also make it clear that such excerpts must not contain information that could be seen as valuable to the victim. Regardless of what the cybercriminals are saying, our cybersecurity experts advise that victims SHOULD NOT PAY RANSOM and this standpoint is similar to FBI’s guidelines relating to ransom payments. The reason is that there is no guarantee that files will be restored even after paying the ransom. Also, paying the ransom would put more funds in the hands of cybercriminals, thus enabling them to employ more rogue developers to victimize more people. In addition to the two reasons already mentioned, paying ransom in any form is illegal. Cybercriminals equally drop other Trojans like AZORULT and VIDAR which they use to steal sensitive information such as banking details, software account credentials, cryptocurrency wallets, and saved passwords. Such sensitive information in the hands of cybercriminals will open new fronts for stealing or blackmail. Computer users that are already infected with any variant of STOP/DJVU including the one being reviewed should remove CKAE ransomware virus from their computer without further delay. This can be effectively done by setting up the infected computer in Safe Mode with Networking before running any strong antivirus on it. It is important to ensure that only genuine antivirus software is used. If you are not sure of the antivirus to use, we recommend INTEGO Antivirus because it has proven to be very strong and reliable. You should also consider downloading RESTORO to help you repair Windows OS files that were damaged by the virus.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution methods used by cybercriminals

The most common method cybercriminals use in distributing STOP/DJVU ransomware variants including the nascent CKAE virus is through downloads of malicious software contents from online torrents. They often hide malware in pirated software copies including the so-called “cracks” and key generators, so when unsuspecting users download them in their PC, they end up triggering ransomware attack. Reports have shown that victims usually noticed their computers became compromised after downloading certain pirated software contents from online torrents platforms. They were deceived by cybercriminals who uploaded such contents as license activation tools or “cracks” to enable bypass the copyrighted genuine ones without paying the requisite fees. These fake software contents are nothing but baits used in getting their victims. Some of the most popular ones are listed below:

Adobe Photoshop;KMSPico (illegal Windows activation tool);Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;VMware Workstation;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;Fifa 20;Various AV software.

As can be deduced thus far, going to online torrents platform to download software contents is indeed a very bad idea and anyone involved in such habit should stop it immediately for their own good. Otherwise, they could become victims of ransomware attack. Also, such illegal download of copyrighted software contents is against the law and perpetrators are liable to be prosecuted accordingly. Instead it is advisable to do the right thing by downloading needed software contents from official channels and also paying the requisite fees attached to them. Whatever amount that is paid for it can’t be compared to the mind boggling ransom fees cybercriminals usually demand from their victims and neither would there be any risk of losing important/sensitive data. In addition to online torrents platforms, cybercriminals also make use of malicious email attachments in distributing ransomware. In this method, they would compose ordinary-looking but believable messages while impersonating legitimate brands or individuals. They would make use of DOCX, PDF or XLS among similar formats in composing such messages because they enable JavaScript and macro functions for downloading payloads and triggering them in random computers. Be that as it may, victims of STOP/DJVU ransomware variants should not visit suspicious websites that make bogus claims of offering decryption services because, more often than not, they’ve been found to be dubious, and their intention is to further scam the victims by spreading other ransomware versions like ZORAB. At the moment, only DiskTuna and Emsisoft offer decryption/data repair tools that are reliable.

More important information concerning the infection

This section covers the technical aspect of the malware and how much a PC could be affected during CKAE ransomware attack. Firstly, the malware would set up build.exe or build2.exe executables as well as winupdate.exe. Afterward, it will connect to https[:]//api.2ip.ua/geo.json while saving the outcome in geo.json file. It then proceeds to information gathering about every relevant detail concerning the computer. The computer’s geolocation, time zone, zip code, latitude and longitude, and stores them in the geolocation file before creating another file where hardware details, software list and active processes would be stored in information.txt. An example is provided below showing geo.json file. See a screenshot of information.txt file below. Using the geolocation details, the malware would make a comparison between it and their list of encryption exempted countries, namely: Ukraine, Russia, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Belarus and Uzbekistan. If it indicates positive to any of the listed countries, they would instantly abort their mission but otherwise, they would move to the next stage by fetching online encryption key from their central server and merging it with the victim’s ID before saving it in the bowsakkdestx.txt file and to the PersonalID.txt file. Displayed below are examples of such files. In situations where it fails to extract online encryption key, it will settle for the use of an offline encryption key, and the latter is uniform for all victims of the same variant. The appearance of t1 characters suffixed to a victim’s personal ID is an indication that offline key was used, and it raises hope of decrypting .ckae files going forward. More information about this is provided below. The ransomware would at this point commence full data encryption by scanning all folders and encrypting them with Salsa20 before locking it with the RSA-2048 key. While this is ongoing, the malware will mark each file with .ckae extension. Shown in the screenshot below is an example of the _readme.txt ransom note that is left in all folders. The next thing the virus does is to delete all Volume Shadow Copies by making use of the command prompt as shown below: vssadmin.exe Delete Shadows /All /Quiet Lastly, the malware would compile a list of domains that would be sent to the Windows HOSTS file and mapped to the localhost IP. This action will automatically prevent the victim from having any access to the blacklisted sites and the DNS_PROBE_FINISHED_NXDOMAIN error message might appear on the screen whenever they make any attempt. Why they do this is to preempt any move by the victim to seek online help from certain websites that offer it. The virus would equally drop more malware such as AZORULT or VIDAR on the already infected PC.

Remove CKAE Ransomware Virus and Recover Your Files

Victims of this malware variant are advised to remove CKAE ransomware virus without further delay. This can be effectively done by booting the infected PC using the Safe Mode with Networking option before running genuine antivirus software on it. This option is highly recommended because it will free up space in the computer and enable the antivirus to remove every trace of the malware. If you can’t decide on which AV to use, we highly recommend INTEGO Antivirus. We also recommend using RESTORO to repair virus-affected Windows OS files. Afterward, the victim should follow the steps outlined below:

Inform relevant local authorities about the ransomware attack.Make use of any backup device to restore lost files.Learn possible ways variants of STOP/DJVU encrypted files could be decrypted.Change all passwords that were used on the compromised computer.

Being proactive and avoiding activities that could put you at risk of ransomware attacks is the best thing to do. However, anyone whose PC became infected for one reason or another should equally follow the steps recommended in this article. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove CKAE Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove CKAE Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt CKAE files

Fix and open large CKAE files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. CKAE Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt CKAE files, follow the given tutorial.

Meanings of decryptor’s messages

The CKAE decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your CKAE extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of CKAE Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.