COOS ransomware typically awaits in illegal torrent downloads, such as software cracks, keygens, and similar activators. The victim downloads such files hoping to bypass the need to purchase program’s license key. After opening a disguised ransomware executable, the series of events happen:

The ransomware attempts to connect to its Command&Control server and based on success decides whether to use online or offline key.Ransomware scans computer system, encrypting files in every folder with RSA algorithm and adding extensions based on the virus’ name. During this procedure, the malware drops _readme.txt in every affected folder.Next, the ransomware runs several command line commands to delete Volume Shadow Copies from the system, thus getting rid of this data recovery option.The virus then alters Windows HOSTS file by inserting a list of domains to it. As a result, these websites become unreachable from the host (computer), no matter what browser is used. It is believed that virus’ developers seek to prevent victim from accessing computer security related domains. Finally, the ransomware installs password-stealer named AZORULT.

How the virus chooses encryption key

After being executed on victim’s computer, COOS ransomware attempts to use host’s network connection to reach the Command&Control server. If the connection succeeds, the virus requests a unique encryption key for the computer. In this context, we’ll call this an online key. It is a RSA public key, which is used to lock all files on the PC. To recover files, a RSA private key, also known as the decryption key, is required. However, sometimes the virus cannot connect to the C&C server (it can happen for various reasons, such as poor network connection, server down during the time of connection and similar). In such case, the virus uses else function and decodes in-built encryption key instead. In this context, it is called the offline encryption key. The main difference between online and offline keys for one virus’ version is the fact that all victims of offline encryption can use one and same decryption key, while victims of online encryption are subject to unique decryption keys only. You can check whether your version is decryptable and which encryption type you’re affected with by following instructions in this STOP/DJVU decryption/repair guide. Criminals behind COOS ransomware make your files inaccessible for only one reason – they want to extort you financially. They know that they have corrupted your work or study files, or important and valuable memories such as family photos or videos, so they are going to ask you to pay large sums for data decryption. However, cybersecurity professionals do not recommend paying ransoms to criminals.

_readme.txt serves as a message from the criminals

_readme.txt is a text file created by the ransomware that introduces the attackers’ intentions. The note says that all files, such as photos, videos, documents and archives have been encrypted with strongest algorithm. As the note suggests, the only way to decrypt .coos files is to pay a ransom to cybercriminals. The note suggests testing the file decryption tool on one file. However, the crooks are not going to provide you with tools so soon – so they ask you to send one small encrypted file to them for test decryption. They promise to send a decrypted file version back. In order to reach the criminals, the victim has to write to helpmanager@mail.ch or restoremanager@airmail.cc and insert personal ID in the message subject (so that the criminals could identify the victim). The note also informs that the ransom price depends on how fast the victim decides to listen to criminals’ demands. If the victim writes to the attackers within 72 hours (3 days) from the infection timestamp, the ransom price is $490. If the victim fails to pay within 3 days, the price rises to $980 (the full price, according to the note). It is never recommended to pay a ransom. No matter which cybersecurity expert you’ll contact, the answer is going to be the same (most likely). There are many reasons not to pay, including:

The attackers might disappear and never reply after receiving the ransom.The decryption tool might be faulty and not work properly.If you transfer money to virtual attackers, you will support the whole cybercrime industry and help to keep it running.Remember that ransom payments are illegal in specific countries.Remember that this virus dropped password-stealer on your system, which means that you will be scammed financially (most likely). Do you really want to waste more money on these scammers?

DO NOT PAY THE RANSOM. Try the recommended decryption/file repair tools listed below. COOS is the 275th extension variant of STOP/DJVU malware gang that has released viruses such as QLKM, BOOA, IGDM, NOBU, EPOR, OMFL. The version you’re infected with is known as the “new” variant, which is harder to decrypt. Computer users who were hit by this ransomware are advised to remove COOS ransomware virus as soon as possible. To repair virus damage, we suggest downloading RESTORO and performing full system scan. You must change all your passwords after malware removal procedure (due to AZORULT activity on the system).

Primary ransomware infection vectors

COOS ransomware primarily spreads via infected torrent downloads including software cracks and keygens. These are usually accessible via peer-to-peer download agents, such as uTorrent. Another success factor is that many computer users ignore antivirus or anti-malware software alerts about possibly malicious crack and open it anyway. Many people head to these free file sharing sites because they are willing to save money. Unfortunately, this typically leads to even bigger financial damage because malicious programs distributed via such downloads either ask for large ransoms for data decryption, or function as a banking information stealers that can empty your accounts or even perform transactions using your login credentials. According to user reports, the majority of them downloaded this ransomware alongside Adobe Photoshop crack or KMSPico. Most of them report searching for such torrents online. Therefore, if you’re willing to get access to these programs/OS licenses, head to their official distributor’s website instead. Ransomware is also commonly distributed via email spam campaigns. The attackers typically pretend to be sending an invoice or missing payment information for the victim, asking to open attached contents. These attachments are usually in .img, .ace or .pdf formats. Moreover, crooks like to exploit the whole online shopping concept during these pandemic times as more people shop online than usual. Such emails include a link asking to track parcel, which can lead to malware or a phishing website.

General tips to avoid ransomware infections

Be extremely careful if you use peer-to-peer download agents to download torrent-based files. We also advise staying away from illegally distributed and copyright-protected content, such as cracked software versions.If you decide to download something from online, scan it with anti-malware and DO NOT IGNORE its alerts if it displays any.Be careful when checking your email. Avoid spam folder and do not open attachments or links in even slightly suspicious emails. By suspicious, we mean emails that you did not expect to receive, or that include grammar errors, or their design seems off, links are shortened, and you can feel that message urges you to open attached contents. Criminals can inject malicious code into many file formats nowadays, for example, .img, .pdf or .docx. While the file itself isn’t malware, it can function as a helper that contains a script to download the payload from external source and executes it on your computer.Backup your files regularly and frequently. Use external data storage device to store them.

Remove COOS ransomware virus and decrypt files

The primary task you need to do is to remove COOS ransomware virus and related malware from the system. After doing so, you will be able to securely perform other actions such as securing your passwords and try data recovery tools. We have prepared in-detail instructions how to remove the virus from the system. We also advise scanning with for virus damage removal. As soon as the COOS virus removal is complete, head to the decrypt .coos files section and try Emsisoft’s tool for STOP/DJVU-affected file recovery. Moreover, you should read full guide for file decryption/repair. Finally, report cybercrime incident via given authority pages or use directions to find the one for your country. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove COOS ransomware virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove COOS ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt COOS files

Fix and open large COOS files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. COOS ransomware virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt COOS files, follow the given tutorial.

Meanings of decryptor’s messages

The COOS decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your COOS extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of COOS ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.