.adobee Files Ransomware (STOP) - How to Remove It

.adobee Files Ransomware (STOP) – Remove It

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article has been created in order to better explain to you what exactly is the .adobee files virus and how you can remove this version of the STOP ransomware and show you ways via which you can try and restore your encrypted files.

A new ransomware virus, going by the name .adobee has been reported by users to infect computers and then encrypt their files. Shortly after this, the ransomware virus ads the _openme.txt ransom note which contains the ransom message left there for victims by the cyber-criminals. The main idea is for the victim to pay a hefty ransom in order to be able to use their encrypted files once again. If your computer has been infected by the .adobee files virus, we would recommend that you read this article and learn how you can remove the malware files and try to restore your damaged files.

Threat Summary

Name.adobee Files Virus
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on the compromised computers and then extort the victims to pay hefty ransom in order to retrieve their files.
SymptomsFiles are encrypted with an added .adobee file extension. A ransom note, called _openme.txt is also dropped.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .adobee Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .adobee Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.adobee Files Virus – Distribution

The main methods that are used to redistribute files, infecting victims with the .adobee variant of STOP ransomware are believed to be via:

Malicious e-mails containing attachments.
Files, uploaded on websites, posing as legitimate software.

If the virus files are spread as a result of being uploaded on multiple different types of website, the infection files may pretend to be legitimate:

  • Setups.
  • Cracks.
  • Portable software.
  • License renews.
  • Hacktools.
  • Activators.
  • Key generators (Keygens).

In addition to this, the ransomware virus may also be spread by having attached the infection file in spam e-mails that are directly sent to victims. The attachments in this case are of different file types and they may often preted to be:

  • Invoices.
  • Receipts of purchase.
  • Order confirmations.

.adobee Files Virus – Analysis

Once a computer has been infected with the .adobee version of STOP ransomware, the malware may drop it’s virus files, likely In the following Windows Directories:

  • %Windows%
  • %LocalLow%
  • %Roaming%
  • %Temp%
  • %AppData%
  • %Local%

Among the files dropped by the .adobee variant of STOP ransomware is also the ransom note file, called _openme.txt. It contains the following extortionist message to victims:

———————————————- ALL YOUR FILES ARE ENCRYPTED ———————————————–

Don’t worry, you can return all your files!
All your files documents, photos, databases and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees do we give to you?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information
Don’t try to use third-party decrypt tools because it will destroy your files.
Discount 50% available if you contact us first 72 hours.


To get this software you need write on our e-mail:
Reserve e-mail address to contact us:

Your personal ID:
[redacted 43 alphanumeric chars]

After the virus drops the ransom note, it may also perform other unwanted activities on the computers, infected by it, such as begin to interfere with the following Windows registry sub-keys:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In them, te .adobe ransomware may create custom registry entries that may run files automatically on Windows boot.

In addition to this, the .adobee files virus may also delete backed up and shadow copy files on the infected machine in order to restrict any possibilities to users to recover their encrypted files this way:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

.adobee Files Virus – Encryption

For the .adobee files ransomware to encrypt your important files, the virus may run a scan operation of the files that are eligible for encryption:

  • Document file types.
  • Videos.
  • Images.
  • Audio files.
  • Archives.
  • Virtual drives.

To encrypt the files on the compromised computer, this ransomware infection alters key data from those files with the data from the encrypton algorithm it uses. The files are left looking like the image below shows:

Remove .Adobee Files Virus and Try Restoring Files

If you want to remove the .adobee file ransomware from your computer, we would recommend that you follow the removal instructions underneath. They have been divided in manual and automatic removal manuals so that if the manual removal does not seem to prove effective, you can use the automatic removal instructions and run a scan with an advanced anti-malware software. This tool aims to scan your computer in order to assure that the .adobee malicious files are removed from your computer.

If you want to try and restore files, encrypted by the .adobee file ransomware, we would suggest that you use the methods in the “try to restore” step below. They come with no guarantee that you will be able to restore as many encrypted files as possible, but with their aid, you might be able to recover at least some of your encoded files.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share