AHGR Virus (.AHGR Files Ransomware) Decrypt + Removal Tool

The Ahgr virus belongs to the STOP/DJVU family of ransomware-type infections. It encrypts your files (videos, photos, documents), which can be identified by the “.ahgr” extension. This virus employs a strong encryption method that renders key calculation impossible.

I have compiled a comprehensive list of all possible solutions, tips, and techniques for neutralizing the Ahgr ransomware and decrypting your data. In certain scenarios, retrieving your files is straightforward, while in other cases, it may be impossible.

Brendan Smith

IT Security Expert

First, perform a PC scan with an antivirus tool!

I will assist you in removing the Ahgr virus and guide you on how to decrypt or restore encrypted files. There are several universal methods to recover encrypted .ahgr files, which will be demonstrated below. It is crucial to carefully read the entire instruction manual and ensure full comprehension. Do not omit any steps. Each of these steps is highly significant and requires your completion.

DOWNLOAD NOW

Gridinsoft Anti-Malware 6-day trial available.
EULA | Privacy Policy | 10% Off Coupon

When the Ahgr ransomware infects your computer system, it initiates the encoding of files and appends an “.ahgr” extension to the encrypted files. The virus requires a ransom in order to obtain a decryption key that can unlock the encrypted files. Typically, the ransom note appears as a text file named “_readme.txt”.

Each victim is assigned a unique Ahgr key, except in one scenario:

• If malware fails to establish a connection with its command and control servers (C&C Server) prior to commencing the encryption process, it uses offline keys. These keys are the same for all victims, enabling the decryption of files that were encrypted during a ransomware attack.

What is Ahgr?

☝️ Ahgr can be correctly identify as a STOP/DJVU ransomware infection.

The Ahgr ransomware is a specific kind of malware that encrypted your documents and then forces you to pay to restore them. Djvu/STOP ransomware family was first revealed and discovered by virus analyst Michael Gillespie.

Ahgr ransomware is basically similar to other representatives of the same DJVU family: Ahtw, Ahui, Neqp. This virus encrypt all common file types and adds its own “.ahgr” extension into all files. For example, the file “1.jpg”, will be amended into “1.jpg.ahgr“. As soon as the encryption is accomplished, virus generates a specific text file “_readme.txt” and adds it into all folders that contain the modified files.

Below is an illustrative image showcasing the appearance of files with the “.ahgr” extension:

Ahgr File (STOP/DJVU Ransomware)

This text asking payment is for get files back via decryption key:

_readme.txt (STOP/DJVU Ransomware) – The scary alert demanding from users to pay the ransom to decrypt the encoded files contains these frustrating warnings

The Ahgr ransomware performs a range of operations on the victim’s computer to accomplish various tasks. One of the first operations executed is winupdate.exe, which displays a deceptive Windows update prompt throughout the attack. This strategy is designed to deceive the victim into associating sudden system slowdowns with a Windows update. At the same time, the ransomware triggers another operation (usually named with four random characters) to scan the system for specific files and encrypt them. Furthermore, the ransomware utilizes the following CMD command to delete Volume Shadow Copies:

vssadmin.exe Delete Shadows /All /Quiet

Once deleted, it becomes impossible to restore the previous state of the computer using System Restore Points. The ransomware operators purposefully eliminate Windows OS-based methods that could assist the victim in file restoration without payment. Furthermore, the perpetrators modify the Windows HOSTS file by appending a list of domains and associating them with the localhost IP address. Consequently, when attempting to access any of the blocked websites, the victim encounters a DNS_PROBE_FINISHED_NXDOMAIN error.

It is worth noting that the ransomware endeavors to block websites that provide various how-to guides for computer users. Evidently, by restricting specific domains, the criminals aim to hinder the victim’s access to relevant and helpful information regarding ransomware attacks. Additionally, the virus deposits two text files on the victim’s computer containing pertinent details about the attack: the victim’s public encryption key and personal ID. These files are named bowsakkdestx.txt and PersonalID.txt.

Even after implementing these modifications, the malware does not cease its activities. Variants of the STOP/DJVU ransomware often deploy the Vidar password-stealing Trojan on compromised systems. This particular threat possesses an extensive range of capabilities, including:

• Stealing login credentials for Steam, Telegram, and Skype;
• Pilfering cryptocurrency wallets;
• Downloading and executing malware on the infected computer;
• Extracting browser cookies, saved passwords, browsing history, and other sensitive data;
• Viewing and manipulating files on the victim’s computer;
• Enabling remote access for hackers to perform various tasks on the victim’s computer.

The DJVU/STOP virus employs the AES-256 cryptography algorithm. It supposes that there are 2^256 possible decryption keys. Simply put, if your files have been encrypted with a unique online decryption key, it becomes utterly impossible to decrypt them without that specific key.

Once Ahgr operated in online mode, obtaining access to the AES-256 key is unattainable. This key is stored on a remote server controlled by the criminals responsible for distributing this ransomware. To obtain the decryption key, a payment of $980 is required. The victims are instructed to contact the fraudsters via email (support@fishmail.top) to receive the payment details.

The message by the ransomware states the following information:

ATTENTION!

Don't worry, you can return all your files!

All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.

What guarantees you have?

You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.

You can get and look video overview decrypt tool:

https://we.tl/t-WJa63R98Ku

Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.

Please note that you'll never restore your data without payment.

Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:

support@fishmail.top

Reserve e-mail address to contact us:

datarestorehelp@airmail.cc

Your personal ID:
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Do not pay for Ahgr!

Please, try to use the available backups, or Decrypter tool

The _readme.txt file also states that computer owners should contact the Ahgr representatives within 72 hours from the time their files were encrypted. By doing so, users will receive a 50% rebate, reducing the ransom amount to $490. However, I strongly advise against contacting these fraudsters and making any payments.

One of the most effective solutions to recover the lost data is to utilize available backups or employ a Decrypter tool.

It’s worth noting that viruses of this nature follow a similar set of actions to generate a unique decryption key for data recovery. Unless the ransomware is still in the development stage or has significant flaws that are difficult to trace, manual recovery of encrypted data is not feasible. Regularly backing up your critical files is the only reliable solution to prevent data loss.

Keep in mind that even if you maintain regular backups, they should be stored in a separate location, not connected to your primary workstation. For example, you can store backups on a USB flash drive, an external hard drive, or utilize online (cloud) storage services.

It’s important to note that if you store your backup data on your primary computer, it may also become encrypted like the rest of your data. Therefore, storing the backup on the same device is not a wise decision.

How I was infected?

Ransomware has a various methods to built into your system. But it doesn’t really matter what concrete method had place in your case.

Ahgr virus attack following a successful phishing attempt.

How To Remove Ahgr Ransomware?

In addition to encode a victim’s files, the Ahgr infection has also started to install the Vidar Stealer on system to steal account credentials, cryptocurrency wallets, desktop files, and more.³

Reasons why I would recommend GridinSoft⁴

There is no better way to recognize, remove and prevent ransomware than to use an anti-malware software from GridinSoft⁵.

1. Download Removal Tool.

   You can download GridinSoft Anti-Malware by clicking the button below:

   Download GridinSoft Anti-Malware

2. Run the setup file.

   When setup file has finished downloading, double-click on the setup-antimalware-fix.exe file to install GridinSoft Anti-Malware on your computer.

   

   An User Account Control asking you about to allow GridinSoft Anti-Malware to make changes to your device. So, you should click “Yes” to continue with the installation.

   

3. Press “Install” button.

   

4. Once installed, Anti-Malware will automatically run.

   

5. Wait for complete.

   GridinSoft Anti-Malware will automatically start scanning your system for Ahgr infections and other malicious programs. This process can take a 20-30 minutes, so I suggest you periodically check on the status of the scan process.

   

6. Click on “Clean Now”.

   When the scan has finished, you will see the list of infections that GridinSoft Anti-Malware has detected. To remove them click on the “Clean Now” button in right corner.

   

7. Trojan Killer for special instances

   In certain situations, Ahgr ransomware may block the execution of setup files for various anti-malware programs. In such cases, you can resort to using a removable drive that contains a pre-installed antivirus tool.

   There are only a few security tools available that can be installed on USB drives, and most of them require an expensive license. However, I can recommend an alternative solution from GridinSoft called Trojan Killer Portable. It offers a 14-day free trial mode that provides all the features of the paid version ⁶. This trial period should be sufficient to effectively eliminate malware.

   How To Decrypt .ahgr Files?

   Restoring Solution for Large “.ahgr Files“

   You can attempt to restore your files by removing the .ahgr extension from a few large files and trying to open them. There are two possibilities: either the Ahgr ransomware read the file but did not encrypt it, or there was a bug and the file was not marked for encryption. If your files are very large, exceeding 2GB, the latter scenario is more probable. I kindly request you to provide feedback in the comments to let me know if this method works for you.

   The newest extensions released around the end of August 2019 after the criminals made changes. This includes Nerz, Neon, Weqp, etc.

   As a result of the changes made by the criminals, STOPDecrypter is no longer supported. It has been removed and replaced with the Emsisoft Decryptor for STOP Djvu Ransomware developed by Emsisoft.

   You can download free decryption tool here: Decryptor for STOP Djvu.

   1. Download and run decryption tool.

      Start downloading the decryption tool.

      Make sure to launch the decryption utility as an administrator. You need to agree with the license terms that will come up. For this purpose, click on the “Yes” button:

      

      As soon as you accept the license terms, the main decryptor user interface comes up:

      

   2. Select folders for decryption.

      Based on the default settings, the decryptor will automatically populate the available locations in order to decrypt the currently available drives (the connected ones), including the network drives. Extra (optional) locations can be selected with the help of the “Add” button.

      Decryptors normally suggest several options considering the specific malware family. The current possible options are presented in the Options tab and can be activated or deactivated there. You may locate a detailed list of the currently active Options below.

   3. Click on the “Decrypt” button.

      As soon as you add all the desired locations for decryption into the list, click on the “Decrypt” button in order to initiate the decryption procedure.

      Note that the main screen may turn you to a status view, letting you know of the active process and the decryption statistics of your data:

      

      The decryptor will notify you as soon as the decryption procedure is completed. If you need the report for your personal papers, you can save it by choosing the “Save log” button. Note that it is also possible to copy it directly to your clipboard and to paste it into emails or messages here if you need to do so.

   The Emsisoft Decryptor might display different messages after the attempt to restore your ahgr files:

   ✓ Error: Unable to decrypt file with ID: [your ID]

   There is no corresponding decryption key in the Emsisoft decryptor’s database.

   ✓ No key for New Variant online ID: [your ID]

   Notice: this ID appears to be an online ID, decryption is impossible

   Malware encrypted your files with an online key. So no one else has the same encryption/decryption key pair. Recovery of ahgr files without paying the criminals is impossible. 🙁

   ✓ Result: No key for new variant offline ID: [example ID]

   This ID appears be an offline ID. Decryption may be possible in the future.

   Malware used an offline key, but the utility cannot restore the files (the offline decryption key isn’t available yet). But, receiving this message is good news for you, because it might be possible to restore your ahgr files in the future. 🙂
   It can take a few weeks or months until the decryption key gets found and uploaded to the decryptor. Please follow updates regarding the decryptable DJVU versions here.

   ✓ Remote name could not be resolved

   It’s an indication of a DNS issue on your PC. Our first recommendation is to reset your HOSTS file back to default.

   How to Restore .ahgr Files?

   In some case Ahgr ransomware is not doom for your files…

   Ahgr ransomware encryption mechanism feature is next: it encrypts every file byte-by-byte, then saves a file copy, deleting (and not overriding!) the original file. Hence, the information of the file location on the physical disk is lost, but the original file is not deleted from the physical disk. The cell, or the sector where this file was stored, can still contain this file, but it is not listed by the file system and can be overwritten by data that has been loaded to this disk after the deletion. Hence, it is possible to recover your files using special software.

   I recently had my pc infected by the Ahgr virus. It managed to bypass 2 Antivirus software and 2 malware fighters.

   Anyway, after realizing it was an online algorithm, it is impossible to retrieve my encrypted files. I also had my backup drive plugged in at the time of the virus, and this was also infected, or so I thought. Every folder within my backup drive had been infected and was encrypted. However, despite losing some important files, I retrieved almost 80% of my 2TB storage.

   When I started going through the folders, I noticed the readme.txt ransom note in every folder. I opened some of the folders and found that all files that were not in a subfolder within that folder had been encrypted. However, I found a flaw and glimmer of hope when I went into the subfolders in other folders and found that these files had not been encrypted. Every folder within my c and d drives, including subfolders, had been encrypted, but this was not the case with the backup drive. Having subfolders created within a folder has saved 80% of my data.

   As I said, I believe this to be only a small loophole on a backup drive. I’ve since found a further 10 % of my data on another hard drive on a different pc. So my advice is if you use a backup drive, create subfolders. I was lucky, I guess. But I was also unlucky that the virus hit as I was transferring some files from my backup.

   Hopefully, this can help some other people in my situation.

   Jamie Newland

   Recovering your files with PhotoRec

   PhotoRec, an open-source program originally designed for recovering files from damaged disks or restoring deleted files, has evolved over time to support recovery of files with over 400 different extensions. Therefore, it can be utilized for data recovery following a ransomware attack.

   To begin, you will need to download the application. It is completely free; however, the developer does not guarantee file recovery. PhotoRec is bundled with another utility by the same developer called TestDisk. When you download the archive, it will be named TestDisk, but rest assured, the PhotoRec files are contained within.

   To access PhotoRec, locate and open the file named “qphotorec_win.exe”. No installation is necessary, as the program includes all the required files within the archive. You can even store it on a USB drive and use it to assist a friend, family member, or anyone affected by the DJVU/STOP ransomware.

   

   After the launch, you will see the screen showing you the full list of your disk spaces. However, this information is likely useless, because the required menu is placed a bit higher. Click this bar, then choose the disk which was attacked by ransomware.

   

   After choosing the disk, you need to choose the destination folder for the recovered files. This menu is located at the lower part of the PhotoRec window. The best desicion is to export them on USB drive or any other type of removable disk.

   

   Then, you need to specify the file formats. This option is located at the bottom, too. As it was mentioned, PhotoRec can recover the files of about 400 different formats.

   

   Finally, you can start files recovery by pressing the “Search” button. You will see the screen where the results of the scan and recovery are shown.

   

   Ahgr files recovery guide

   
   

   Frequently Asked Questions

   🤔 How can I open “.ahgr” files?

   
   No way. These files are modified by ransomware. The contents of .ahgr files are not available until they are decrypted.

   🤔 Ahgr files contain important information. How can I decrypt them urgently?

   
   If your data remained in the .ahgr files are very valuable, then most likely you made a backup copy.
   If not, then you can try to restore them through the system function – Restore Point.
   All other methods will require patience.

   🤔 You have advised using GridinSoft Anti-Malware to remove Ahgr. Does this mean that the program will delete my encrypted files?

   
   No, your computer is not at risk from the encrypted files. The events have already occurred.

   To effectively eliminate active system infections, you should utilize GridinSoft Anti-Malware. The virus responsible for encrypting your files is likely still operational and regularly conducts tests to encrypt additional files. Furthermore, these viruses frequently implant keyloggers and backdoors to facilitate subsequent malicious activities, such as stealing passwords and credit card information.

   🤔 Ahgr Ransomware has blocked infected PC: I can’t get the activation code.

   
   In this situation, you need to prepare the memory stick with a pre-installed Trojan Killer.

   🤔 Decryptor did not decrypt all my files, or not all of them were decrypted. What should I do?

   
   Have patience. You are infected with the new version of STOP/DJVU ransomware, and decryption keys have not yet been released. Follow the news on our website.

   We will keep you posted on when new Ahgr keys or new decryption programs appear.

   🤔 What can I do right now?

   
   The Ahgr ransomware specifically encrypts only the first 150KB of files. As a result, larger files like MP3s may still be playable in certain media players, such as Winamp. However, the initial 3-5 seconds of the file, which corresponds to the encrypted portion, will be missing.

   To recover the original files, you can try finding copies from various sources:

   • Re-download files from the Internet that were encrypted, as you can obtain the original versions again.
   • Request the original pictures from family and friends with whom you shared them, and they can send them back to you.
   • Retrieve photos from social media platforms or cloud services such as Carbonite, OneDrive, iDrive, Google Drive, etc., where you might have uploaded them.
   • Search for attachments in emails that you sent or received and saved, as they may contain unencrypted versions of the files.
   • Check older computers, flash drives, external drives, camera memory cards, or iPhones where you previously transferred data to the infected computer, as these devices might still have the original files.

   By exploring these options, you may be able to find and recover unencrypted copies of your files.

   Video Guide

   How to use GridinSoft Anti-Malware and Emsisoft Decryptor for fix ransomware infections.

   If the guide doesn’t help you to remove Ahgr virus, please download the GridinSoft Anti-Malware that I recommended. Do not forget to share your experience in solving the problem. Please leave a comment here! This can help other victims to understand they are not alone. And together we will find ways to deal with this issue.

   I need your help to share this article.

   It is your turn to help other people. I have written this article to help users like you. You can use buttons below to share this on your favorite social media Facebook, Twitter, or Reddit.

   Brendan Smith

   AHGR Ransomware — How To Restore & Decrypt Files?

   Name: AHGR Ransomware

   Description: The AHGR Virus belongs to the STOP/DJVU family of ransomware infections. This malicious software encrypts various types of files, including videos, photos, and documents, which can be identified by the specific "ahgr" extension. As a result, these files become inaccessible and unusable. The AHGR ransomware then demands a ransom payment in Bitcoin from its victims, typically ranging from $490 to $980.

   Operating System: Windows

   Application Category: Virus

   Sending

   User Review

   4.26 (19 votes)

   Comments Rating 0 (0 reviews)
   

   References

   1. My files are encrypted by ransomware, what should I do now?
   2. About DJVU (STOP) Ransomware.
   3. Windows passwords vulnerability (Mimikatz HackTool): https://howtofix.guide/mimikatz-hacktool/
   4. GridinSoft Anti-Malware Review from HowToFix site: https://howtofix.guide/gridinsoft-anti-malware/
   5. More information about GridinSoft products: https://gridinsoft.com/comparison
   6. Trojan Killer Review: https://howtofix.guide/trojan-killer/

   German Japanese Spanish Portuguese (Brazil) French Turkish Chinese (Traditional) Korean Indonesian Hindi Italian