Kolz Ransomware - How to remove

Kolz is malicious software. It encrypts files and gives them a second file extension, “.kolz”. The people behind Kolz ask for ransom (hundreds of dollars) to fix the files.

Kolz comes from pirating sites. It infects various free software installers. It gets downloaded together with spyware, adware, and other malware.

About Kolz:

Classification	Ransomware.
How Kolz works	Downloaded from pirating sites, installs with other malware, encrypts files on the computer, breaking them.
How to recover the files	Restore files from a backup, recover deleted files, if Kolz used the offline key, use the free decryptor, manually repair the files.
How to remove Kolz	Scan your computer with antivirus tools (such as Spyhunter) and remove all malware.

What is Kolz?

File-encrypting malware

Kolz is ransomware – malicious software that encrypts files, effectively breaking them. The people behind it want money, so they ask for up to $980 to be paid in exchange for decryption software and the decryption key. While the decryptor is available for everyone, it is useless without the decryption key. But the decryption key is unique to each victim, meaning that they can only be provided by the attackers behind Kolz.

Encryption is meant for hiding information. It turns meaningful text into gibberish. When Kolz uses it on your files, it basically locks your files behind a password. Kolz marks the locked files with the file extension “.kolz” and the file type KOLZ. Try to open a text file that was encrypted by Kolz and you will see a bunch of random symbols that really don’t mean anything.

Kolz is part of the Djvu family of ransomware, together with Kasp, Boop, Vari, and others. They’re well-known and security researchers have already looked at them very closely. They tried to find ways for the victims of Djvu to fix their files without paying money to the criminals. It somewhat worked at the time, but the criminals fixed their ransomware since, so that new versions of Djvu, such as Kolz, can no longer be broken.

The ransom demands by Kolz’s operators are laid out in the ransom note called “_readme.txt” that Kolz peppers all over the folders of the infected computer.

Can the files be fixed?

Assuming that you didn’t have a backup of some important files when Kolz attacked, is there anything you can do to restore them without having to give cybercriminals hundreds of dollars?

Make backups of the encrypted files. There are some ways that Kolz’s harm can be partially undone:

• Data recovery programs may help you to recover the files that Kolz deleted. But you need to be very careful and read the guides and instructions of your chosen recovery program.
• There’s the rare case where the encryption (and decryption) keys used by Kolz are not unique – offline encryption. Happens when Kolz can’t connect to its servers, like if you don’t have internet connection. Try the Emsisoft decryptor.
• Some files, including archives, video, audio, and image files, and other big files can be partially repaired, though it’s complicated and might need to be done manually for each and every file. It’s only possible because Kolz only encrypts parts of the bigger files. It’s enough to break the files but not enough to destroy all of their data.

Also, check all of your folders. Kolz may have skipped some folders, especially those nested deep in other folders.

Downloaded with other programs

Kolz infects computers when it is downloaded from pirating sites. It’s usually hidden inside various free programs. You downloaded and run the installer, only for Kolz and other malware to be downloaded and installed. This is made worse by the fact that people sometimes disable their antivirus software to run cracks.

The other malware that comes with Kolz ay be spyware and adware. You might see a lot of pop-ups in your browser and you might even have your online accounts hacked after your passwords being stolen (change your passwords after deleting all malware).

Once downloaded, Kolz disables the Task Manager and blocks various websites by changing your hosts file.

How to remove Kolz

Make a backup of the files that you may want to repair or decrypt. Fix the Task Manager problem. Fix the hosts file as described below, then update or reinstall your antivirus program or use another one, like Spyhunter. Scan your computer, delete Kolz and all the malware that came with it.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Kolz Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Kolz Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Kolz Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Kolz Ransomware. You can check other tools here.  

Step 3. Restore Kolz Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Kolz Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Kolz Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.