Zobm Ransomware - How to remove

Zobm is ransomware, also called cryptomalware. Zobm infects your computer, runs your files through an algorithm that encrypts them (makes them unreadable to you or to computer programs), and then leaves a note demanding hundreds of dollars to be sent to this malware’s creators. Zobm is being used here by cyber-criminals as a tool to perform extortion.

What does Zobm ransomware do?

Zobm is a malicious tool in an extortion scheme that uses cryptography to break your files:

Zobm infection symptoms	During the encryption, a fake Windows Update pop-up appears Your old files are named: “file.type.zobm” The files are also now ZOBM type “_readme.txt” files are placed in many folders [email protected] and [email protected] are given to contact Zobm’s operators Some cybersecurity sites do not open
Zobm cryptovirus characteristics	Installs Azorult, the password stealer Spreads in pirating sites Uses asymmetric encryption to secure the keys Encrypts only parts of big files
Similar cryptoviruses	Rote Kodg Mbed
How to restore the files	Recover your files from a backup Use the decrypter Use other methods, like data recovery

Encryption

Zobm adds the suffix “.zobm” to your file names, leaves text files “_readme.txt” lying around (that’s where the makers of this cryptovirus ask for money), and runs repeatedly to encrypt any new files that you create.

Zobm is quite the formidable ransomware. It uses cryptography to turn your files to gibberish and nonsense, which is why all the files marked “.zobm” refuse to be opened, or only show noise and random characters instead of their normal content – the programs you’ve installed cannot read the encrypted files. An image displaying application can’t recognize picture.jpg.zobm as an image even if you rename the file to get rid of the “.zobm” at the end because the internal data of the files is scrambled. In some cases, only portions of the files are broken (the bigger the file, the more data unencrypted), but these files also fail to open.

Zobm is not meant to completely ruin your files (the cryptoviruses that do that are called wipers, and Zobm is not one of them) – the creators behind Zobm have certain numbers, keys, that can be used to completely reverse what Zobm did, restoring the files to normal again. Unfortunately, so far, that’s the only way. Zobm’s encryption is too well secured:

• The keys used by Zobm are unique to each victim.
• The keys are too long and complicated to guess (seriously, it’s totally impractical with current technology).
• Zobm uses asymmetric encryption for security, which means that only the people behind this cryptovirus have access to the keys.
• The ransomware that Zobm is based on has been analyzed and mostly understood by cybersecurity researchers, so if it had any bugs or flaws, they would have been found already.

Actually, there kind of is a small bug with how Zobm works, we’ll discuss it later.

How Zobm spreads

A lot of ways exist for ransomware to infect computers – malicious email, remote desktop access, exploit kits – but for Zobm,  the tactic of being uploaded on pirating sites as cracks and activated software is used. This tactic is a threat to individual PC users, including children, students, workers on job laptops who cannot afford to lose their files, and even small businesses.

While Zobm is used to encrypt the files, it might not be the only malware that was infiltrated to your computer: a password-stealing trojan known as Azorult might have been included with it. If you have saved passwords in your browser, e-mail application, games launcher, if you have your cryptocurrency wallet data saved somewhere, Azorult will extract that and send it over to Zobm’s makers; they might sell your account, hack it, or sell your information. Some victims of Azorult noticed their crypto-wallet robbed, others their social media account hacked.

Of course, you will also notice that Zobm cripples your antivirus program by deleting crucial updates and blocks cybersecurity sites in your OS settings, which might make it hard to find information on Zobm if you’re using the infected computer (better to turn it off while you’re figuring things out).

How to fix Zobm files and remove the ransomware

So, about that bug: Zobm uses unique keys to lock the files on each computer, except when it’s forced to run offline (like, if your internet or the Zobm’s operators’ internet wasn’t working when the cryptovirus started). If that happened, Zobm still encrypted the files, but it must have used the offline encryption key. This key is still unknown, however, cybersecurity researchers constantly reach out to ransomware victims who paid the ransom ($490 or $980) to get more information (they really do work a lot with ransomware and are really busy). Occasionally, a person turns up who paid the ransom and one of their keys was the offline one. They can share the key with all the other victims. If any of your files were encrypted with Zobm’s offline key (that’s a big if), the good researchers at Emsisoft upload it to their free tool Emsisoft decryptor for STOP Djvu (Djvu is the name of Zobm’s brand of ransomware – the same creators have released many other similar cryptoviruses). Try it later, though you might want to create backups of your encrypted files before that. If you have backups of the Zobm files, also try repairing some bigger files (like songs) and opening archive files (like zip and rar) to recover some unencrypted data.

Of course, none of that matters if you had backups of your unencrypted files from before the Zobm infection. In that case, great work – with good backups, you’re impervious against ransomware attacks.

To prevent files from being encrypted, you can format the infected drive (erase everything on it) or use an anti-malware scanner (such as SpyHunter) to get rid of Zobm, Azorult, and other malware.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Zobm Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Zobm Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Zobm Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Zobm Ransomware. You can check other tools here.  

Step 3. Restore Zobm Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Zobm Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Zobm Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.