GT500

5 hours ago, Joe FMInvest said:

I used a company called Fast Data Recovery ...

This company doesn't recover your files, they secretly pay the ransom and then overcharge you for doing so.

4 hours ago, Nana said:

how about this case? has anyone found a solution

This is Phobos. It's not decryptable.

8 hours ago, Georgi said:

Do you have any update of this Basilisque Locker Ransomware?

I don't think we ever got a copy of the ransomware's executable (the malicious program that encrypts files). I'll ask to be certain.

Disable Security Center Integration in Emsisoft Anti-Malware (in Advanced settings), run the following command in an elevated (running as admin) Command Prompt, restart the computer, and then re-enable Security Center Integration:

WMIC /NODE:localhost /NAMESPACE:\\root\SecurityCenter2 PATH AntiVirusProduct WHERE "displayName like 'Emsisoft%'" DELETE

3 hours ago, Déco said:

Hello, I would like to know if Emsisoft supports Opera browser, if I use Opera will I be protected against phishing and bank protection? Or does protection only apply to Chrome?

Our extension only officially supports Google Chrome, Microsoft Edge (both new and old versions), and Mozilla Firefox. That being said, the extension does work in other Chromium based browsers (such as Vivaldi), and thus it should work fine in Opera as well.

QA let me know that "free with no AV" in Kabuto means "uninstall Emsisoft Anti-Malware", so please allow me to apologize for that mistake.

I've also been told that Kabuto runs scheduled tasks once every couple of hours or so, and so it may take some time for Emsisoft Anti-Malware to be uninstalled.

12 hours ago, halcetin said:

Sayın Emisoft Desteği; 27 .12. 2020 tarihinde dizustu bilgisayarıma .igal uzantılı virüs girdi C ve D de bulunan 700GB tüm arşivim (pdf, rar, mp3, wav, exel, word, jpeg.pnp,) şifrelendi virüs taraması yaptırdım açılmıyor Bu. igal uzantılı virüs için çözüm nedir ne yapmalıyım. beni aydınlatırsanız memnun olurum.

This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

Google tarafından sağlanan çeviri:
Bu, STOP / Djvu'nun daha yeni bir çeşididir. Çevrimdışı bir kimliğiniz varsa, bu varyant için şifre çözme anahtarını bulup veritabanımıza ekledikten sonra dosyalarınızı kurtarabilmeniz gerekir. Ancak, çevrimiçi bir kimliğiniz varsa (ki bu daha olasıdır), dosyalarınızı kurtarmanız mümkün olmayacaktır. Aşağıdaki bağlantıda daha fazla bilgi var:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

14 hours ago, sufiyan said:

so sir what can i do?

Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future.

We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:
https://www.bleepingcomputer.com/

If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:
https://www.bleepingcomputer.com/feed/

What did the ransomware add to the end of the names of all of your files?

O que o ransomware adicionou ao final dos nomes de todos os seus arquivos?

It won't continue to run with real-time protection once the trial license has expired.

Normally our software would automatically downgrade to freeware mode once the trial license has expired, however I don't think the Enterprise Security licensing allows for running in freeware mode. I'll ask QA to verify.

Windows Defender will detect a number of utilities, especially from Nirsoft. These detections are normal, and the only way to prevent them would be to exclude a2emergencykit.exe from Windows Defender's protection so that it doesn't monitor it.

19 hours ago, dkds said:

let me understand pls; for what reason then, it goes into this mode,  if  change nothing?

Emsisoft Anti-Malware enters Silent Mode when a fullscreen application is open (games, videos, etc). By default Silent Mode will prevent updates, suppress notifications, and prevent scheduled scans from running in order to prevent these features from disrupting a user's activity on the computer. If you disable all of these, then Silent Mode will do nothing when it activates.

12 minutes ago, sufiyan said:

so sir how i decrypt online id

The only known way is to obtain the private key from the criminals, and currently they only known way to do that is to pay the ransom.

17 hours ago, Amigo-A said:

My guess is confirmed. This is Phobos Ransomware.

Unfortunately Phobos isn't decryptable.

4 hours ago, jedsiem said:

Is there a best practice? Hints for registry keys to check?

Can you try running the following PowerShell command, and paste the output into a reply (you can send it in a private message if there's anything confidential in the output)?

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct

The command doesn't require admin rights on Windows 10.

13 hours ago, Amigo-A said:

No. We need original files of notes, the picture will not do in this case.

The PDF wasn't what I thought it was. My mistake.

You're welcome.

11 hours ago, Amigo-A said:

Attach a ransom note and several different encrypted files to your message. 

It looks like they already did that.

13 hours ago, AD Music said:

I got my files encrypted with .coos extension :[ is there literally any way i can get back my only one mp3 file

Im soo sad :,(

It might be possible to use software intended for recovering MP3 files, as the ransomware only encrypts a small portion of the beginning of the files. Larger files that are in formats that are tolerant of missing data can actually be recovered, and some music and video formats fall into that category.

You're welcome.

21 hours ago, arifromansa12 said:

No key for New Variant online ID: kHPl9xz72WpsHv4iypkRLqWBRMDZZ62f5hZhTado
Notice: this ID appears to be an online ID, decryption is impossible

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

You're welcome.

23 hours ago, sufiyan said:

.QLKM

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

23 hours ago, kai said:

Your personal ID:
0276oPsw3z93WJcaCBdx0c1hOPraKFRfAzWyKZ4kMS64SeBd5

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

11 hours ago, dkds said:

even if silent mode is disabled on workspace and locally?

You can turn off the various effects that Silent Mode has, however you can't actually prevent Emsisoft Anti-Malware from enabling Silent Mode. If you disable all of the things that Silent Mode does, then it just does nothing when it turns on automatically.

20 hours ago, redvet said:

Is that all that is necessary please ?

Yes, as long as Emsisoft Anti-Malware and Emsisoft Browser Security are working, then your computer should be protected.

18 hours ago, puanpuan said:

Is virual keyoard necessary also ?

Virtual keyboards often work by simulating keyboard input, and it may be possible for keyloggers to read what you type on them like with a real keyboard.

Emsisoft Anti-Malware's Behavior Blocker will automatically quarantine anything trying to log keystrokes.