Jump to content

Leaderboard

Popular Content

Showing content with the highest reputation since 11/29/20 in Posts

  1. Note: It is recommended to make a backup of all important files before using the decrypter. Link to decrypter download page. <- The decrypter will tell you if your files are decryptable, whether you're dealing with an "old" or "new" variant of STOP/Djvu, and whether your ID is online or offline. Link to instructions for using the decrypter (PDF). Link to "file pair" submission form. Link to more information about the decrypter. <- Article at BleepingComputer.com Link to more detailed information about STOP ransomware (covers more than just STOP/Djvu). <- Forum post at BleepingComputer.com Can I report this encryption of my files as a crime? Yes. Distribution of malicious files and holding property for ransom are criminal acts in many countries, and we encourage all victims to report such incidents to the national law enforcement in the country where they reside as this helps them determine how best to prioritize investigations into such criminal activity. There is a list of national law enforcement agencies who are participating in the No More Ransom project at the following link with information on how to file a report (if you live in a country not on the list then feel free to report the incident to your local law enforcement): https://www.nomoreransom.org/en/report-a-crime.html Someone says they can decrypt my files, but I will have to pay them. Is this safe? Such individuals or companies are either scam artists, or they are paying the ransom without telling you and overcharging you for it. Either way we recommend avoiding any contact with those who claim they can decrypt your files for a fee. How do I remove the ransomware? The STOP/Djvu decrypter will stop the ransomware from running so that it can't continue encrypting your files, however it doesn't completely remove the ransomware. Most Anti-Virus software will detect STOP/Djvu if you run a scan for it, however if you don't have Anti-Virus software installed then you can run a Malware Scan with Emsisoft Emergency Kit (free for home/non-commercial use). Note that formatting the hard drive and reinstalling Windows will also remove the infection, however this ransomware is particularly easy to remove, so if a computer is only infected with STOP/Djvu then formatting the drive would be unnecessary. Will removing the infection unlock my files? No. Your files are encrypted. This encryption needs to be reversed (via a process called "decryption") before your files will be usable again. This encryption cannot be removed or undone simply by removing the STOP/Djvu ransomware infection. The decrypter can't decrypt my files? In most cases this means you have an online ID. It could also mean your files were encrypted by a newer variant of STOP/Djvu. See below for explanations. Why won't the decrypter run? The decrypter requires version 4.5.2 or newer of the Microsoft .NET Framework, so this could mean your version of the .NET Framework is out of date. We recommend installing the latest version of the .NET Framework (4.8 at the time of writing this), and then trying the decrypter again. What does "Remote name could not be resolved" mean? This can happen if your computer isn't connected to the Internet. If your Internet connection is working, then it can also be an indication of a DNS issue, and we recommend you reset your HOSTS file back to default if everything else seems fine. Microsoft has an article about this at the following link: https://support.microsoft.com/en-us/help/972034/how-to-reset-the-hosts-file-back-to-the-default Why is the decrypter stuck on "Starting"? When you run the decrypter, it looks for encrypted files. It will say "Starting" until it is able to find some. If the decrypter remains stuck on "Starting" for a long period of time, then this means it is unable to find any encrypted files. Offline ID. When the ransomware can't connect to its command and control servers while encrypting your files, it uses a built-in encryption key and a built-in ID. Offline ID's generally end in t1 and are usually easy to identify. Since the offline key and ID only change with each variant/extension, everyone who has had their files encrypted by the same variant will have the same ID and the files will be decryptable by the same key (or "private key" in the case of RSA keys). Online ID. In most cases the ransomware is able to connect to its command and control servers when it encrypts files, and when this happens the servers respond by generating random keys for each infected computer. Since each computer has its own key, you can't use a key from another computer to decrypt your files. The decrypter is capable of working around this with older variants as long as it has some help, however for newer variants there is nothing that can be done to recover files. Old Variants. Old variants were those in distribution until near the end of August, 2019. Our decrypter supports offline ID's for almost all older variants, and can decrypt files for those with offline ID's without needing any help. For online ID's, it's necessary to supply file pairs to our online submission form so that the decrypter can be "trained" how to decrypt your files. A list of extensions from older variants can be found at the bottom of this post. Is it possible to change an online ID into an offline ID? Your files' ID serves to identify which private key is needed to decrypt your files. If you were to somehow change the ID that was added to your encrypted files, then all you would accomplish is making it impossible to decrypt your files at all, even if you paid the ransom. It is imperative that you don't attempt to modify your encrypted files if you want to make sure that they can be decrypted some day. New Variants. These use more secure RSA keys which are impervious to most types of attacks. Support for some offline ID's has been added to the decrypter for newer variants, and support for new offline ID's will be added as we are able to figure out private keys (decryption keys) for them. As for online ID's, due to the usage of RSA keys, there's currently nothing the decrypter can do to help recover files. How long does it take to add support for new offline ID's to the decrypter? Private keys for offline ID's are donated by victims who paid the ransom, and there is no way for us to be able to estimate when this will happen. If you have an offline ID then try running the decrypter once every week or two, and if we have been able to add the private key for your ID then it will start decrypting files. Will it ever be possible to decrypt new variants with online ID's? That depends on whether or not law enforcement is able to catch the criminals who are behind this ransomware. If law enforcement is able to catch them and release their database of keys, then we can add those to our database for decryption. Are there any ways to recover/repair files that can't be decrypted? In most cases this is not possible, however there is a tool called DiskTuna that can help repair some videos that have been encrypted. This tool was made by a third-party, and they are not affiliated with us, however one of our developers has verified that it does work in at least some cases. You can find more information at this link. What is a file pair? This refers to a pair of files that are identical (as in they are the exact same file), except one copy is encrypted and the other is not. Our decryption service can analyze the differences between an encrypted file and an original unencrypted copy of the same file, allowing it to determine how to decrypt that type of file. For most victims with an older variant of STOP/Djvu, submitting file pairs will be the only way they will get their files back. File pairs only work for one type of file. Due to the way encryption works in STOP/Djvu, file pairs can only help the decryption service figure out how to decrypt one type of file. For instance, if you submit a file pair for an MP3 file, then the decrypter will be able to decrypt all of your other MP3 files, however it won't be able to decrypt any other type of file. There are some exceptions to this, such as certain newer Microsoft Office documents (such as DOCX and XLSX) since those files are technically ZIP archives. The decrypter can't decrypt all of my pictures even though I submitted file pairs for them? JPEG/JPG images have a format oddity that causes file pairs to be specific to each source of pictures, rather than the file format in general. As an example, if you have pictures from two different cameras, and submit a file pair from the group of pictures from one of the cameras, then the decrypter will only be able to decrypt files from the camera that the file pair came from. In order to decrypt all JPEG/JPG images, you will need to submit file pairs from every source you've obtained those pictures from. Extensions from older variants that the decrypter supports:
    6 points
  2. You've not yet adequately answered my questions. I have however noticed that EAM hasn't nagged me recently; does that mean that someone's tweaked the code to stop the nagging, or is it just coincidence (since the nags seemed to be at irregular intervals)? If the nagging is going to continue, then please explain once and for all WHY this authentication is needed for a user who is not using the website-based console. Please also address all the other points I've raised here, namely: - the possibility (if there's not multiple instances) that your backend server is a single point of failure - the possibility (if someone manages to hack into those server(s)) of the security of customers' systems being at risk. I'm sure you won't have forgotten that an Emsisoft server was breached in Jan-Feb 2021. I know that was reported as a fairly minor data leak, but that doesn't mean that other kinds of breach are impossible. I wonder how much thought Emsisoft have given to how they'd mitigate effects (on customers' systems) if such a breach were to occur. And, do you run disaster-recovery tests on your infrastructure? If eg a data-centre which houses your servers burns down (as did OVHcloud, Strasbourg, France, in March 2021) how long will your customers be affected for? - the point about the website console, if one chooses to change to "Local Only" resetting my (private) PC's EAM configuration to default - two problems there: why would it reset anything, and secondly how/why (if my PC is not authenticated to the workspace) does it have the right to perform a reset? - the tooltip text for the "Local Only" option I do not think I have muddied the waters with conjecture. But note that "conjecture" means speculation based on inadequate information. The very fact that I've been asking the initial question here (about the nagging) over and over again without a proper answer being given has not helped. Questions about single points of failure etc might have been less relevant before when your customers' systems were less tightly integrated with your servers; I mean all of us could cope with occasional absences of signature updates. But centralised control of our copies of EAM by your servers considerably heightens risk for customers. I would like you to understand that I ask about these things based on my professional experiences in a UK bank's datacentre.
    3 points
  3. -----BEGIN PRIVATE KEY----- MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC3o1EdFgHqpSNB LWoTeHUvhHfQFE+NPBSpwP4t2B90ifXU/iPa1BpXC6UWXKGG/r9C+PYMTTGH0uoU fHa+D91iRuwt3s0V3IPelqlpb4DCAScveYrUBHNNgufV5UsHFiKI2XUfWDkJoCDj 7nth9wcG2/vwHG7YVYEMPnWZZDlS7afMgAFQ8T5TwIEtNrDfLPiKnwHjvtv6+rJR HD3ODQJWwDkLDApp6UN3V/K0vxEZ5GK5ebcBJOdrUgMQJRTtT3v2Ffval/mEvKXv rtnWP8rf6cDJh5D3VPMbjumpb3Mon07kWOJGFDOk3r7awNTMp/TQZfdsCpDOATX2 4vdy67+hAgMBAAECggEAHU83twi4LZdF1TVGZO0o5vihlthnCge41I81AmQoQRVz 4xbc6iRIP/Rf2P3X2g/2vt21h6kaaq9DJRnoadVmZDUlpPyWhxK3CWPKjkV5q307 n9wqSESdkpV+IymBnBPwVx8+Dk6qa9re5QI/NxeSS4n44A3psyWSfz3Izz6r14xJ jyrIjMm0m0jkStBGPStHTsmqcUAXxZibaeNwTFTIp9wiARnDv4mpWm8an8XiHoIq nGCQvZgOQMjzJpSOiCROE8f6NX12PaYVmcsFYZGLBvNAKWbMrAuT6UgrGqFKWkGF 9AEbjEqXWhbZZ6H3xb33LoWLW5GdY8yBBc1GJwDTMQKBgQDmwIca3RTT5Mz3605F XThttCY5wrSu73BrUWemJ1rEJm32G6uEQYlSYe4EG2evZT5di3M+x+kt8e8Ox3A/ 9UntKInFqIs1+6NIA0tmHHMjqTiRn7aJZpE7kCnF+lSlAPFGy6wPNSfFfiX2dWmV kHkE4S+l3TnGMzfoFxikpz7/ewKBgQDLuxnl+T0zlkTmEh7TJRyrF9fPNENrqFyI 65EZqeZ+4fwRE0+RMCwI3sa2VfnYDaEyJmjUGIQr/idvQPrNBahnWTIyJVTSiRdU VR9vHDZE6cmVDtKLjv8LIJZ4S9PnbGgHw+tkNnarUfA0acLyr9rSQoEp4ef4MJ6y 8fFipelkkwKBgQCrGalUhwgRkn9VebpA/r1/wuvxOmmlqU+vk94KOvY3qdMxgRTt 7XZ4irrlerioOqdCz8s1iyBg/Brp14JpOmWFn+CAmtgWwC8zj5XR8liB4dFbUZUV TuNzyhLfhR5Md2VwvEcpw51o+IAHvsn6p/TEZIFjOKXFTGcxBic0t/qjjwKBgQCm KoO0E/Y79itZ75ueoZ1hWwAVK052J4rZzjC52t55zL33+2UhSUYRMgqnOzadZnh8 W+GSZDChZRkq37fvstao/JI5XkNxuIkDqq4JxNvqlzhoT/+f/lC89aZklYxPLBcp hj2ereFaWGlvhneP06jJZ57L10qJHrbBwx4bVLEo6wKBgQClA42b6Oe4NSmzA/PD 0ymVUIkGAZ+QtHVQwkHlmlPLvDUUwrLITz7pf4eTziKbpW+Cbzwx0iIQcMWWml+L GZUVGj47B3r5qsae5tjmvydLjzi4rT5tyW1R88sxy9FT7XIkNWgto9KfgomOQobO A+wX+ZkqmWsnZ+xE4hBlZY7Bow== -----END PRIVATE KEY----- i contract with a friend and he unlock all my locked files (all my files had .orkf) so try to add this key to your database for others files
    2 points
  4. It's more difficult with pictures. They are more compressed and less fragmented than video files, so the cipher damages them much. If you transferred a collection of photos from one disk to another and after that did not fill this place on the disk with anything, then using data recovery programs you can recover some of the photos from the previous location.
    2 points
  5. Do you mean this Minimalist? https://support.emsisoft.com/topic/33516-why/?
    2 points
  6. Because the decrypter already supports it. The reason it can't decrypt files encrypted by this newer variant is due to the fact that we don't have the private key for it's offline ID. We have to wait for a victim with an offline ID who paid the ransom to donate their private key to us.
    2 points
  7. Hello, The posts you found are more than 5 years old. In terms of security software that means the information there is severely outdated. In the past years considerable changes have been made to our products and currently Emsisoft Anti-Malware protects against fileless malware. Fileless malware detection has nothing to do with the reputation settings you asked about; our behavior blocker routines were adapted to adequately detect and block fileless malware a few years ago.
    2 points
  8. The issue appears to be due to non-Latin characters in workspace names. We're implemented a workaround for this, so hopefully that resolves the update issues.
    2 points
  9. When law enforcement arrests the criminals and releases their database of private keys for inclusion in decryption tools.
    2 points
  10. This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
    2 points
  11. Thank you for your feedback. We may consider it for future development.
    1 point
  12. Die Updates laufen seit gestern Nachmittag wieder. Wir bitten Sie vielmals um Entschuldigung für die Störung. Claude Bader
    1 point
  13. Bonjour @GillesV, J'utilise DeepL pour traduire. L'anglais est ma langue maternelle. Veuillez contacter notre équipe Ransomware Recovery en utilisant le formulaire web à l'adresse https://www.emsisoft.com/en/tools/ransomware-recovery/inquire/. Une personne de notre équipe Ransomware Recovery vous contactera par e-mail. Nous vous contacterons par e-mail dans les 12 à 24 heures. --------------------------------------------------------------------------------------------- Hello @GillesV, I am using DeepL to translate. English is my native language. Please contact our Ransomware Recovery team using the web form at https://www.emsisoft.com/en/tools/ransomware-recovery/inquire/ Someone from our Ransomware Recovery team will contact you by email. We will follow up with you via email within the next 12-24 hours.
    1 point
  14. Hi, As a general rule for mods for popular games like Minecraft, they are safe if you download them from the official websites, for example for RLcraft that would be: https://www.curseforge.com/minecraft/modpacks/rlcraft If you're not sure you can always scan the downloaded files or upload them to https://www.virustotal.com
    1 point
  15. Why did this happen? This 'STOP Ransomware' enters the PC due to the fact that computer is poorly protected. People often use free antivirus programs with the 'Free' label in the name. None of these programs will protect PC from programs similar to 'STOP Ransomware', because basic protection is not capable of this feat. If users used comprehensive protection of the 'Internet Security' class, then it would help protect PC from ransomware attacks. There is no 100% protection against malware, but what the 'Free' antivirus gives is 1-2 percent protection. After this attack, PCs could have stayed other malware elements. This maybe is an info-stealer and something else. Therefore, it is urgent to conduct a full check and destroy malware. Use an comprehensive anti-virus software such as Emsisoft Anti-Malware to effectively remove the malware. You can get a free trial 30-days version of Emsisoft Anti-Malware here: https://www.emsisoft.com/en/home/antimalware/ It will help you clean your PC from other malware for free. !!! You need to neutralize all malicious files in the system. This should be done as quickly as possible. Otherwise, the files may be encrypted using the online ID and decryption will never be possible.
    1 point
  16. Hello @[email protected] Thanks for your answer. My first 4 digits in _readme.txt -> personal ID are 0339.
    1 point
  17. Hello @feras, Welcome to the Emsisoft Support Forums. Please read this Topic. It contains information about your situation and whether or not your files can be decrypted. https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
    1 point
  18. t1 at the end of the identifier usually tells us that the files can be decrypted, but only in the future when someone with a generous hand send a decryption key with the developers of the decryptor.
    1 point
  19. Read this Guide, there is a link to the Emsisoft Decryptor at the beginning of the article. Run it, it will tell you the result. There may be 1 shared key for several different variants. But you didn't tell us the extension that was added to the files after encryption.
    1 point
  20. 1 point
  21. Backing up the encrypted files is something that you should do. There is always the possibility that law enforcement may be able to catch the criminals and release their database of private keys, meaning that you could try again using tool in few weeks in case something changed. Removing the infection that is installed by the latest variants can be somewhat difficult to remove. No all of it is showing in logs or being detected by an AV.
    1 point
  22. Im no IT expert, but i red on BC forum that a guy was able to recover 50% of his data using header bytes from decrypted file on encrypted files. Not sure what you guys have been talking about, just wanted to put info here.
    1 point
  23. How do you know who they work for? and why doesn't the police and government take them down and locate the command and control server and release the private keys so people's files are restored? is it possible the cybercriminals are working together with the police? Where are they located? I heard most of them originate from russia. In the meantime, what can we do about our files? because I am thinking of storing encrypted files with .pcqq files into a seperate external hard drive. Should I also place these files in microsoft onedrive? or will the virus spread within onedrive ? Also, should I delete _readme.txt files inside some of the folders? is that supposed to be a virus. When i try to open some of them, there is a message saying I need administrator privilege. One more thing, what exactly should I do with files encrypted with .pcqq files like in a detailed explanation? I have like 6 external hard drives and a box account, onedrive with 2 TB of storage so I have plenty of hardware for backups but exactly how do I proceed with backing up my system, clone my current hard drive using acronis true image? or using any other softwares etc..etc...
    1 point
  24. @Jorge MirandaOur recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future. Please review our Protection Guides at your leisure, they contain several tips on protecting your computer and data. We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters: https://www.bleepingcomputer.com/ If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news: https://www.bleepingcomputer.com/feed/
    1 point
  25. https://dropmefiles.com/wugkV this file i suspect, once i restored and i opened it, soon my files became corrupt again
    1 point
  26. This is offline ID and files can be decrypted, when the decryptor gets the key for this variant. Free Ransomware Decryption Tools https://www.emsisoft.com/ransomware-decryption-tools/free-download It is a legitimate file decryption software without paying a pay. This is not crackware.
    1 point
  27. Adding the decryption key to the Emsisoft Decryptor depends on the voluntary transfer of the key by someone who paid the ransom. When this will be done, no one can predict. Therefore, the wait may drag on indefinitely. --- Only after neutralizing all malicious files ... I recommend this following method only when there is no other way. You decide what action to take. This is not the decryption, it is the recovery of certain types of files using the features of these files. 1) If you have encrypted archives, you can partially recover them. Only 1-2 files are damaged there. Remove the extension that the ransomware added to the archives, and extract the files in the usual way. Everything except 1-2 files will be fixed. If there is only 1 file in the archive, then it will most likely be unrecoverable. 2) There is an alternative (additional) way to recover some media files: WAV, MP3, MP4, M4V, MOV, 3GP. https://www.disktuna.com/media_repair-file-repair-for-stop-djvu-mp3-mp4-3gp But before trying the alternative variant with media files, it is recommended that you make a copy of the encrypted files. Something will be restored better, something will be restored worse. An alternative method for other files has not yet been found.
    1 point
  28. Why did this happen? This 'STOP Ransomware' enters the PC due to the fact that computer is poorly protected. People often use free antivirus programs with the 'Free' label in the name. None of these programs will protect PC from programs similar to 'STOP Ransomware', because basic protection is not capable of this feat. If users used comprehensive protection of the 'Internet Security' class, then it would help protect PC from ransomware attacks. There is no 100% protection against malware, but what the 'Free' antivirus gives is 1-2 percent protection. After this attack, PCs could have stayed other malware elements. This maybe is an info-stealer and something else. Therefore, it is urgent to conduct a full check and destroy malware. Use an antivirus such as Emsisoft Anti-Malware to effectively remove the malware. You can get a free trial 30-days version of Emsisoft Anti-Malware here: https://www.emsisoft.com/en/home/antimalware/ It will help you clean your PC from other malware for free.
    1 point
  29. Also you should know that... This 'STOP Ransomware' enters the PC due to the fact that computer is poorly protected. People often use free antivirus programs with the 'Free' label in the name. None of these programs will protect PC from programs similar to 'STOP Ransomware', because basic protection is not capable of this feat. If users used comprehensive protection of the 'Internet Security' class, then it would help protect PC from ransomware attacks. There is no 100% protection against malware, but what the 'Free' antivirus gives is 1-2 percent protection. After this attack, PCs could have stayed other malware elements. This maybe is an info-stealer and something else. Therefore, it is urgent to conduct a full check and destroy malware. Use an antivirus such as Emsisoft Anti-Malware to effectively remove the malware. You can get a free trial 30-days version of Emsisoft Anti-Malware here: https://www.emsisoft.com/en/home/antimalware/
    1 point
  30. Hello @Lucas donizeti, That extension is used by STOP(DJVU). Unfortunately, we no longer have any method to decrypt STOP(DJVU) unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter.
    1 point
  31. That extension is used by STOP(DJVU). Unfortunately, we no longer have any method to decrypt STOP(DJVU) unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter.
    1 point
  32. I got this malware last weekend. my files are very importance so I'm already paid for it. but I don't know this decryptor suitable for that attack on your computer .NUSM malware or not
    1 point
  33. It is important that no new encryption occurs. To do this, you can install any antivirus product of the Internet Security class, which provides a trial period of up to 1 month, with a full set of protection. For example, Emsisoft Anti-Malware After a month, you can install another AV and also for 1 month for free. After a while, you can choose the best one, in your opinion.
    1 point
  34. Emsisoft Mobile Security should automatically use the language on your device. To change the language of the Bitdefender Mobile Security interface, go to your device’s Language & keyboard settings and set the device to the language you want to use. Let me know if you have trouble.
    1 point
  35. I can only add that 'Crackithub.com', 'kmspico10.com', 'crackhomes.com', 'piratepc.net' are some of the STOP Ransomware distribution sites. Any program downloaded from there can be infected with this ransomware. Moreover, if you run the same malicious file again, the malware may receive an update and the files will be encrypted with a newer version. Independent experiments show that these sites also distribute other ransomware, so files can be encrypted by several different encryptors, and the encryption can be looped. We have seen samples of encrypted files that were encrypted every time the computer was restarted. There are many such cases here on the forum. Therefore, it is necessary to check your computer drives and remove any other infection.
    1 point
  36. In addition, archive files are not fully encrypted. Usually, the first 1-2 files are damaged. You can extract all the files, and then determine which file with errors is damaged.
    1 point
  37. Thank you, I did the repair reinstall so will have to wait. I have been very lucky for years doing that. Fingers crossed !!!!
    1 point
  38. No. Encrypted file - a file with OMFL extension. Original file - an unencrypted file that has not yet been encrypted. The ransom note _readme.txt is not needed here.
    1 point
  39. I use Emsisoft and Wise Vector together without any problems. Works well for me
    1 point
  40. Correct. Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future. We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters: https://www.bleepingcomputer.com/ If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news: https://www.bleepingcomputer.com/feed/
    1 point
  41. This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
    1 point
  42. Please don't post malicious links on our forums. If you would like for us to analyze a file, or a malicious URL (aka. link), then run it through VirusTotal and post the link to the analysis here for us to review. We can download files from VirusTotal, so anything you upload there we have access to.
    1 point
  43. There is no issue with decrypting the file. It's probably something preventing the decrypter from accessing the file, and since we removed all I/O errors from the output (people didn't understand what they meant) the decrypter just isn't displaying an error that it is unable to access the file. Try adding the decrypter to the exclusions in your Anti-Virus software.
    1 point
  44. Well, your ID for STOP/Djvu (.coos) is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ As for files with .ROGER added to their names, those were encrypted by Dharma, and there's no way to decrypt them without paying the ransom.
    1 point
  45. This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/
    1 point
  46. This may be FonixCrypter, however I still recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can be certain which ransomware it is: https://id-ransomware.malwarehunterteam.com/ You can paste a link to the results into a reply if you would like for me to review them.
    1 point
  47. For your own safety and security, never ask for files from people you don't know. In this case, you would have merely reinfected your computers, and run the risk of making your problems even worse. Stick with solutions from the experts, and if someone promises a "solution" then give us a chance to verify it first. Our goal is to try to thwart these criminals and keep everyone safe, and if there's anything we believe has a reasonable chance of helping you then we'll let you know.
    1 point
  48. @SalasKafa Try running the decryptor again; we may have just received a key for that ID recently. 😉
    1 point
×
×
  • Create New...