What to remove by hand
No removal guide we read lists exact file paths, registry keys or tasks that belong to Copa itself.
PCrisk gives none for this variant. The traces below are the ones the STOP/Djvu family is known for, so treat them as places to look and not as a confirmed list for Copa. Use our removal plan for the clicks.
The hosts file: C:\Windows\System32\drivers\etc\hosts. Family members append many lines that point security and removal websites to another address, which is why such sites may not open. Lines you did not add, below the normal comments, can be deleted. Open the file with Notepad run as administrator.
The program folder: the family unpacks a copy of itself into a folder with a random or GUID name under %AppData% or %LocalAppData%, and often sets a deny permission on that folder so it cannot be deleted easily. Look there for an unknown executable that was created on the day of infection.
The startup entry:
- the family sets a value under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runand often a scheduled task - commonly named like
Time Trigger Task - that starts the copy
Check Task Scheduler and Settings > Apps > Startup for anything you do not know.
The ID folder: a folder C:\SystemID with a file PersonalID.txt is a known mark of this family. The ID in it tells identification services whether the key is online or offline, so copy it before cleaning up.
The note: _readme.txt in every affected folder. Keep one copy off the PC, then delete the rest after the scan. The extension .copa shows which files are locked.
We found no browser extension, search engine, start page, browser policy, service or certificate tied to Copa. If you suspect a stealer was installed, review the extensions page of each browser, Settings > Apps > Installed apps sorted by date, and Task Manager for unknown processes.