Remove Mppq Ransomware

The STOP Ransomware continues to be the most active ransomware family and, unfortunately, there is still no reliable way to recover the files it locks for free. This is only possible if the victim has an up-to-date reserve copy of their data. However, this might not be the case for many of the ransomware's victims. The STOP Ransomware is being used by cybercriminals worldwide, and they release different variants of the infamous file-locker. One of the latest variants is the Mppq Ransomware, and it is not that different from other versions of the file encryption Trojan.

When the Mppq Ransomware infiltrates a system successfully, it will carry out the file encryption attack immediately and lock the contents of media, documents, archives, databases, backups and other files. In addition to this, it will mark the locked files using the extension '.mppq.' For example, the file 'document.xlsx' will be called 'document.xlsx.mppq.'

The Mppq Ransomware drops the ransom message '_readme.txt' to finish off its attack. The message is nearly identical to the one found in other variants of the threat. Victims are told to pay $490 via Bitcoin in the next 72 hours to get a decryption tool – if they fail to do this on time, the fee will be doubled to $980, and in 168 hours, their decryption key will be purged from the server of the attackers. 

The criminals list two addresses that can be used to contact them – helpteam@mail.ch and helpmanager@airmail.cc. You should not message them. Trying to pay is a terrible idea, and it is advisable to ignore their attempts to convince you to trust them. Instead, run a malware removal tool to terminate the ransomware, and then try to restore from a backup or use alternative data recovery options.