.Devos file extension. Remove virus. Restore .Devos files.

Devos file extension

.Devos file extension is an extension that uses the newest variant of Phobos ransomware to mark files that have been encrypted. Ransomware is malware created by criminals that restricts access to the victim’s files by encrypting them and demands a ransom for a pair of key-decryptor, necessary for decrypting files. Files encrypted with .Devos extension become useless, their contents cannot be read without the key that the criminals have. To date, several variants of Devos virus have been detected, they are distinguished by the extension, which is added to the name of the encrypted files: .[qq1935@mail.fr].Devos, .[saveyourfiles@qq.com].Devos.

Devos virus

Devos virus is the latest version of Phobos ransomware, which was discovered by security researchers some days ago. Like other variants, it encrypts all files on the computer and then demands a ransom for decryption. This virus encrypts files using a strong encryption method, which eliminates the possibility of finding a key in any way. For each victim, Devos ransomware uses a unique key. It has the ability to encrypt files of any type, regardless of what is in them. Thus, the following common file types can be easily encrypted:

.yal, .p7c, .apk, .ybk, .wbd, .sidn, .das, .dbf, .epk, .asset, .dba, .vtf, .srw, .dcr, .wbz, .orf, .bkp, .ncf, .sql, .lrf, .rgss3a, .wn, .gdb, .mdf, .wma, .avi, .wpd, .wb2, .odt, .rar, .wpe, .ods, .p12, .pdf, .wps, .r3d, .wcf, .3fr, .xlsx, .pdd, .ibank, .itm, .xlk, .xll, .wsd, .wot, .sidd, .kf, .bkf, .arw, .vdf, .srf, .zdb, .xml, .forge, .itl, .wps, .pfx, .mcmeta, .mef, .xx, .2bp, .indd, .desc, .psk, .wpl, .wdp, .nrw, .vpp_pc, .pef, .ai, .bay, .sis, .svg, .xlsb, .re4, .xmind, .pst, .wp5, .js, .dwg, .d3dbsp, .dxg, .z3d, .xwp, .csv, .w3x, .ptx, .hvpl, .x3d, .qdf, .sr2, .3dm, .bc6, .t12, .zw, .xld, .sie, .accdb, .syncdb, .jpeg, .wpg, .xpm, .hplg, .rofl, .jpe, .docm, .sav, .rb, .wbc, .upk, .pak, .webdoc, .raf, .sid, .ltx, .p7b, .wsh, .cr2, .tor, .bc7, .qic, .wav, .esm, .mpqge, .7z, .bik, .xlsx, .xy3, .fpk, .big, .wma, .zip, .py, .xar, .kdb, .crt, .css, .wotreplay, .pkpass, .layout, .zif, .litemod, .y, .mov, .x, .zdc, .pptm, .m3u, .rtf, .wire, .xdb, .wpd, .crw, .wgz, .1st, .flv, .kdc, .erf, .fos, .snx, .rw2, .0, .dazip, .xls, .wbm, .arch00, .blob, .icxs, .cfr, .png, .ztmp, .cer, .odm, .iwd, .fsh, .wm, .wri, .lbf, .xbplate, wallet, .x3f, .raw, .xlsm, .wbk, .rim, .wp7, .3ds, .mdb, .doc, .wpw, .rwl, .wsc, .txt, .xbdoc, .vfs0, .xmmap, .wp, .psd, .slm, .iwi, .xlgc, .wpt, .lvl, .ysp, .webp, .odc, .wbmp, .eps, .docx, .itdb, .wdb, .odp, .zabw, .wmo, .xyp, .xdl, .sb, .xf, .hkx, .pem, .m2, .cdr, .dng, .wp4, .cas, .1, .xls, .wpb, .ppt, .pptx, .wpa, .wmf

Each file that has been encrypted will be renamed. This means the following. If the file was called ‘document.docx’, then after encryption, it will be named ‘document.docx.id[user-id].[qq1935@mail.fr].Devos’. Devos ransomware can encrypt files located on all drives connected to the computer. Therefore, files located in network attached storage and external devices can also be encrypted. It encrypts file by file, when all the files in the directory are encrypted, it drops two files in the directory, which are called ‘info.txt’ and ‘info.hta’. Below is the contents of these files.

The contents of info.txt:

!!!All of your files are encrypted!!!
To decrypt them send e-mail to this address: qq1935@mail.fr.

The contents of info.hta:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail qq1935@mail.fr
Write this ID in the title of your message
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

All directories with encrypted files have these files. But the contents of these files are the same everywhere. These files contains a message from Devos ransomware creators. In this message, the criminals report that all the files were encrypted and the only way to decrypt them is to buy a decryptor and key. Attackers demand a ransom and report that the size of the ransom depends on how quickly it is paid. The faster, the smaller its size. Devos authors left two email addresses that the victim must use to contact them. To confirm the possibility of decryption, criminals offer to decrypt 5 files for free. But it’s obvious that there is no guarantee that even by paying the ransom, the victim will be able to decrypt all files that have been encrypted.

Threat Summary

Name	Devos ransomware virus
Type	Filecoder, Crypto virus, Crypto malware, File locker, Ransomware
Encrypted files extension	.[qq1935@mail.fr].Devos, .[saveyourfiles@qq.com].Devos
Ransom note	info.txt, info.hta
Contact	qq1935@mail.fr, saveyourfiles@qq.com
Ransom amount	$300-$1000 in Bitcoins
Detection Names	Win32/Filecoder.Phobos.C, Trojan-Ransom.Phobos, Trojan.Encoder.29362, Ransom.Phobos, Trojan.Win32.Filecoder, Troj/Phobos-B, Trojan/Win32.BantaRansom, Trojan.Ransom.Phobos.F, TR/Crypt.XPACK.Gen, W32/Phobos.C
Symptoms	Your personal files fail to open. You get an error message like ‘Windows can’t open this file’, ‘How do you want to open this file’. Files called like ‘info.txt’, or ‘info.hta’ in each folder with at least one encrypted file.
Distribution ways	Phishing email scam that attempts to scare users into acting impulsively. Drive-by downloads (ransomware is able to infect the machine simply by visiting a webpage that is running malicious code). Social media posts (they can be used to trick users to download malicious software with a built-in ransomware downloader or click a misleading link). Cybercriminals use misleading ads to distribute malware with no user interaction required.
Removal	To remove Devos ransomware use the removal guide
Recover	To recover Devos ransomware encrypted files use the steps

 

If you came across this article, you were probably searching for a method on how to remove Devos virus, which does not involve paying the ransom. The goal of this blog post is to provide you with the necessary instructions that can help you understand how remove ransomware virus and recover documents, photos and music which have been encrypted.

Quick links

1. How to remove Devos ransomware virus
2. How to decrypt .Devos files
3. How to restore .Devos files
4. How to protect your PC from Devos crypto virus

How to remove Devos crypto virus

It is not recommended to immediately start decrypting or restoring files, this will be your mistake. This way is wrong. The best way is to go step by step: scan your computer for ransomware, detect and remove Devos virus, decrypt (restore) files. To search for ransomware, we recommend using free malware removal tools. It is very important to use multiple malware removal tools to identify and remove Devos. Each of the used tools should be based on a different anti-virus (anti-malware) engine. This is the only way to make sure that the ransomware was found and completely removed.

Remove Devos ransomware with Zemana Free

Zemana Free is a malicious software scanner that is very useful for detecting and removing Devos ransomware. The steps below will explain how to download, install, and use Zemana Free to scan your computer and remove ransomware, malware, trojans, adware software, spyware, worms for free.

1. Download Zemana AntiMalware from the following link.
   
   

   Zemana AntiMalware
   164029 downloads
   Author: Zemana Ltd
   Category: Security tools
   Update: July 16, 2019
   
2. Once you have downloaded the installation file, make sure to double click on the Zemana.AntiMalware.Setup. This would start the Zemana Anti Malware setup on your system.
3. Select installation language and click ‘OK’ button.
4. On the next screen ‘Setup Wizard’ simply click the ‘Next’ button and follow the prompts.
   
5. Finally, once the installation is complete, Zemana Anti Malware will launch automatically. Else, if doesn’t then double-click on the Zemana AntiMalware (ZAM) icon on your desktop.
6. Now that you have successfully install Zemana, let’s see How to use Zemana to delete Devos ransomware from your computer.
7. After you have started the Zemana, you’ll see a window as shown below, just click ‘Scan’ button . Zemana Anti-Malware utility will begin scanning the whole computer to find out Devos virus.
   
8. Now pay attention to the screen while Zemana scans your computer.
   
9. After Zemana Anti Malware (ZAM) has completed scanning your personal computer, the results are displayed in the scan report. In order to remove all threats, simply press ‘Next’ button.
   
10. Zemana Free may require a reboot system in order to complete the Devos ransomware removal process.
11. If you want to permanently remove crypto virus from your computer, then click ‘Quarantine’ icon, select all malicious software, adware software, PUPs and other threats and press Delete.
12. Reboot your PC to complete the crypto virus removal procedure.

Use MalwareBytes AntiMalware (MBAM) to remove Devos ransomware

You can delete Devos ransomware virus automatically through the use of MalwareBytes. We suggest this free malicious software removal tool because it can easily remove crypto virus, adware, malware and other unwanted applications with all their components such as files, folders and registry entries.

1. MalwareBytes AntiMalware can be downloaded from the following link. Save it on your Windows desktop or in any other place.
   
   

   Malwarebytes Anti-malware
   326382 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: April 15, 2020
   
2. When downloading is finished, close all apps and windows on your PC. Open a directory in which you saved it. Double-click on the icon that’s named mb3-setup.
3. Further, click Next button and follow the prompts.
4. Once installation is done, press the “Scan Now” button to perform a system scan with this utility for the Devos crypto virus, other kinds of potential threats such as malware and trojans. A scan can take anywhere from 10 to 30 minutes, depending on the number of files on your machine and the speed of your computer.
5. Once the system scan is done, it will display the Scan Results. All detected threats will be marked. You can remove them all by simply click “Quarantine Selected”. When disinfection is complete, you can be prompted to reboot your PC system.

The following video offers a step-by-step instructions on how to remove browser hijacker infections, adware software and other malware with MalwareBytes.

Remove Devos ransomware virus with Kaspersky virus removal tool

Kaspersky virus removal tool (KVRT) is free and easy to use. It can scan and uninstall crypto viruses, malware, potentially unwanted applications and adware software in Chrome, Edge, Microsoft Internet Explorer and Firefox browsers and thereby restore their default settings. KVRT is powerful enough to find and uninstall malicious registry entries and files that are hidden on the personal computer.

Download Kaspersky virus removal tool (KVRT) on your personal computer from the following link.

After the download is finished, double-click on the KVRT icon. Once initialization procedure is done, you will see the KVRT screen as displayed on the image below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button to perform a system scan for the Devos crypto malware and other trojans and malicious programs. This task can take some time, so please be patient. When a threat is detected, the count of the security threats will change accordingly. Wait until the the checking is finished.

When KVRT has finished scanning, you may check all items found on your PC like below.

Review the report and then press on Continue to begin a cleaning procedure.

How to decrypt .Devos files

All files with the ‘.Devos’ extension are encrypted. Their contents cannot be unlocked simply by removing this extension or completely changing the filename. Unfortunately, today there is no way to decrypt files encrypted with Devos virus, because to decrypt them you need a unique key, and this key is in the hands of criminals.

Never pay the ransom! Some users, wishing to recover access to blocked documents, photos and music, pay the ransom amount of money to cyber frauds. However, it is important to remember before performing this action that you are interacting with unscrupulous and dishonest people, and the probability that after transferring money they will not provide you with a decryption key to decrypt the encrypted files or increase the amount of ransom is high enough.

Fortunately, there are several alternative methods that do not require the use of a key and therefore allow you to restore the contents of encrypted files. Try to recover the encrypted files using free tools listed below.

How to restore .Devos files

As we said above, today you cannot decrypt .Devos files. Fortunately, there are several simple ways that in some cases can help restore the contents of encrypted files without decryption. Each of these methods does not require a decryptor and a unique key, which is in the hands of criminals. The only thing we strongly recommend that you perform (if you have not already done so) is to perform a full scan of the computer. You must be 100% sure that Devos virus has been removed. To find and remove ransomware, use the free malware removal tools.

Recover .Devos encrypted files using Shadow Explorer

In order to recover .Devos documents, photos and music encrypted by the ransomware from Shadow Volume Copies you can use a utility called ShadowExplorer. We recommend to use this solution as it is easier to find and restore the previous versions of the encrypted files you need in an easy-to-use interface.

Visit the page linked below to download ShadowExplorer. Save it on your Windows desktop.

When the download is complete, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as shown on the screen below.

Double click ShadowExplorerPortable to start it. You will see the a window as displayed on the screen below.

In top left corner, select a Drive where encrypted photos, documents and music are stored and a latest restore point like below (1 – drive, 2 – restore point).

On right panel look for a file that you want to restore, right click to it and select Export like below.

Use PhotoRec to recover .Devos files

Before a file is encrypted, the Devos ransomware virus makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to recover your documents, photos and music using file restore software such as PhotoRec.

Download PhotoRec by clicking on the link below.

Once the download is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and choose Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as shown on the screen below.

Double click on qphotorec_win to run PhotoRec for MS Windows. It’ll display a screen as shown below.

Select a drive to recover as on the image below.

You will see a list of available partitions. Choose a partition that holds encrypted personal files as on the image below.

Press File Formats button and specify file types to restore. You can to enable or disable the restore of certain file types. When this is complete, press OK button.

Next, press Browse button to choose where restored files should be written, then click Search.

Count of recovered files is updated in real time. All restored documents, photos and music are written in a folder that you have selected on the previous step. You can to access the files even if the restore process is not finished.

When the restore is complete, click on Quit button. Next, open the directory where restored files are stored. You will see a contents as shown below.

All restored photos, documents and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you are looking for a specific file, then you can to sort your restored files by extension and/or date/time.

How to protect your PC from Devos crypto virus

Most antivirus apps already have built-in protection system against the ransomware virus. Therefore, if your personal computer does not have an antivirus program, make sure you install it. As an extra protection, use the HitmanPro.Alert. All-in-all, HitmanPro.Alert is a fantastic tool to protect your computer from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of Windows operating system from MS Windows XP to Windows 10.

Download HitmanPro.Alert from the link below.

After the downloading process is finished, open the folder in which you saved it. You will see an icon like below.

Double click the HitmanPro Alert desktop icon. When the utility is launched, you will be shown a window where you can choose a level of protection, as shown on the screen below.

Now click the Install button to activate the protection.

Finish words

This guide was created to help all victims of Devos ransomware virus. We tried to give answers to the following questions: how to remove ransomware; how to recover .[qq1935@mail.fr].Devos files. We hope that the information presented in this manual has helped you.

If you have questions, then write to us, leaving a comment below. If you need more help with Devos related issues, go to here.