Efji File-Locking Malware - How to remove

The malware Efji breaks files with the help of encryption, marks them with an “efji” file extension, then, asks for money in exchange for fixing them. It can be deleted, as can the other malware that came with it. But when your personal files being held for ransom by a malicious computer program under the control of a cybercriminal group, getting your data back without paying hundreds of dollars to cybercriminals will be a little complicated, if it’s even possible.

About Efji in short:

Type of threat	Ransomware, trojan.
How Efji spreads	Downloaded from the internet, likely from pirating sites.
Can you get your files back?	Recover them from a backup, use data recovery tools, repair the files manually, use the free decryptor.
How to remove Efji	Undo the changes made to settings delete Efji and other malware with Spyhunter or other antivirus tools, reset passwords and protect other data that may have been stolen by the spyware.

How Efji infects a computer

Downloaded from the internet

Efji ransomware is mostly spread on pirating websites. People get it when trying to pirate a program, mostly.

Some pirating sites don’t have great moderation and can’t check every uploaded file. This allows cybercriminals to sneak malware into the downloads and have it stay up for hours or even days.

When the infected file is run, it downloads Efji and some other malware.

Bundled with other malware

Efji comes bundled with other malware, most likely – a trojan named Azorult. Azorult logs credentials saved in web browsers, it spies on other online apps. It can steal passwords from its victims, potentially resulting in their accounts being hacked. It may also install an adware virus, resulting in excessive pop-ups in the browser.

As for Efji, it makes a lot of changes of its own:

• It blocks many websites that talk about solutions for malware (it blocks our site, too).
• It disables the Task Manager.
• It deletes restore points and file shadow copies.
• It deletes antivirus updates.

Efji does all of this to make recovery harder or impossible for its victims.

Encrypts files

Finally, Efji goes through the infected computer and encrypts many user files. Encrypts, as in, scrambles their data in such a way that it’s impossible to recognize. Open a text file encrypted by Efji – it should be full of random symbols.

The point of encryption is to hide information by confusing the text according to some arbitrary rules. Then, the only way to recover that information is to know the rules and to have the unique decryption key.

Unfortunately, Efji gives unique encryption/decryption keys to each victim. These keys are impossible to guess.

To mark each encrypted file, Efji also gives them a label – a second file extension, “efji”.

The criminals behind Efji want money – they ask for up to $980 in exchange for giving a victim the key. They don’t always give it, of course – sometimes they just ask for more money and/or ignore the victim. It must be lucrative for them, as Efji is one of many, many variants of the Djvu ransomware that’s existed for years now. Foqe is another recent one.

How to get back your files

Assuming you don’t have backup copies of your files (backups are important and pretty easy to do) and don’t want to give your money to criminals, there are some ways in which you may be able to get some of your files back from the dead.

Review your files. It’s possible that Efji missed some of them and didn’t encrypt them.

Use data recovery software. Provided you have not used the computer that was attacked much yet, there’s hope of getting some of your files back.

Repair the files. You see, Efji only encrypts a fixed amount of data in each file. The smaller files are entirely encrypted, while the bigger files have lots of unencrypted portions and that data may still be recoverable. The might be some gaps in those files, but it’s better than nothing. Some people have created repair tools specifically because of the Djvu attacks.

Decrypt the files. I lied when I said that every encryption key that Efji uses is unique. In very special circumstances (no internet, no connection to the server) Efji may use a non-unique encryption key. More on Emsisoft’s website Emsisoft.com.

How to remove Efji

If you’re planning on recovering the files that Efji encrypted, make backups. Always have backups before making changes to those files.

Fix the hosts file (instructions below), the Task Manager, and update your antivirus program. Scan your computer with it, or another reliable tool, such as Spyhunter. Efji, the spyware trojan and whatever malware it downloaded, as well as the file that originally infected your PC all need to be deleted.

Reset your passwords in case the spyware stole them. Use 2-factor authentication.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Efji File-Locking Malware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Efji has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Efji File-Locking Malware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Efji. You can check other tools here.  

Step 3. Restore Efji File-Locking Malware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Efji tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Efji File-Locking Malware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.