Jump to content

David Biggar

Emsisoft Employee
  • Posts

    194
  • Joined

  • Days Won

    10

Everything posted by David Biggar

  1. Hello abhinav, Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter. For further questions please refer to bleepingcomputer.com forums: https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/ And thanks again for contacting Emsisoft.
  2. Hello amitkarmakar and Asif N Siddiqui, That extension is used by STOP(Djvu). Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter. For further questions please refer to bleepingcomputer.com forums: https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/ And thanks again for contacting Emsisoft.
  3. Hello mohamadtawalbeh, Please send one encrypted file about 1 MB in size, and one of the ransom notes left on the computer, for analysis. You can also email them to [email protected] and mention your forum thread URL.
  4. Thanks Lynx. Very correct reply! I'll keep an eye open for L_1_N_G_U_S' reply.
  5. That extension is used by STOP(Djvu). Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter. For further questions please refer to bleepingcomputer.com forums: https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/ And thanks again for contacting Emsisoft.
  6. Hello abteen6, Please attach one encrypted file about 1 MB in size, and one of the ransom notes left on the computer, for analysis.
  7. Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter. For further questions please refer to bleepingcomputer.com forums: https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/ And thanks again for contacting Emsisoft.
  8. Hello TeaJay, If that happens, please begin by restarting the computer. Sleep mode is traditionally a bit flaky, so I'm not entirely surprised by your report. In case there is something interfering that I can spot, please gather two logs using FRST, a tool used worldwide by malware removal experts for free malware removal and tech support, and attach them to a reply to this email. Instructions can be found here: https://help.emsisoft.com/en/1738/how-do-i-run-a-scan-with-frst/
  9. Guesses and theories do nobody any good. I've already replied to you, Kevin. As far as the rest of the questions, there are several, but much more outright conjecture than questions. I'm happy to try to answer those though if asked again without all of the guesswork muddying up the thread.
  10. 'Never' is a strong word. Something must be common between the computers you mention, because the number of those for whom it does work is vast in comparison. A conflict is not necessarily a bug, and isn't necessarily able to be fixed by us.
  11. Kokiem, You have it backward. Offline keys are potentially shared across many victims, so having one may help many people. Online keys are unique.
  12. Hello maki, That is almost always due to conflict. Most likely, with your SATA or SCSI device drivers. I'd suggest making sure they're up to date and trying again. However, it's very rare to actually need to use the rootkit scan option. It's there in case a rootkit is suspected. Many rootkits can be caught by behavior rather than by scan anyway.
  13. Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter. For further questions please refer to bleepingcomputer.com forums: https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/ And thanks again for contacting Emsisoft.
  14. It's asking again because Emsisoft Anti-Malware on that machine isn't properly communicating with the workspace that your subscription is associated with.
  15. I apologize for the very late reply, but the July 2021 (2021.07) update of Emsisoft Anti-Malware included a patch for high CPU use. Are you still having this issue?
  16. Log into your MyEmsisoft account, using your email address and password, using the forgot password link if needed: https://my.emsisoft.com/ Click the "Install protection" or "Add device" button in the upper-right side of the page to download a pre-keyed installer. Do not rename the file that is downloaded, because the long name is required for activation to work properly. Run the downloaded installer, and it should take care of installing and/or activating with your subscription for you. If you already have Emsisoft Anti-Malware installed, the installer will not appear to do anything when you run it, but it will activate Emsisoft Anti-Malware with your subscription. Open Emsisoft Anti-Malware, or wait for it to open if this is a new installation, and click the 'update' link in the lower right to update and synchronize with your subscription.
  17. Please gather two logs using FRST, a tool used worldwide by malware removal experts for free malware removal and tech support, and attach them to a reply to this email. Instructions can be found here: https://help.emsisoft.com/en/1738/how-do-i-run-a-scan-with-frst/ Email the logs to [email protected] with either a link to this forum thread, or a description of the issue, and we'll try to help.
  18. If you have the problem of Emsisoft Anti-Malware asking you to re-authenticate, there are a few things that can work. Easiest first, with the most 'drastic' last. Wait. Sometimes it will sort itself out in a day or so. Restart the computer. If you're using Windows 10, restart by right-clicking the Windows start button and using restart from the shutdown sub-menu. That performs a full restart instead of the cached rapid restart that is Windows 10's default. Sign into MyEmsisoft, click 'add device', and download the tagged installer. Don't rename it, and run it when it's done downloading. It might not appear to be doing anything, but it is. Give it 30 seconds, then open Emsisoft Anti-Malware and click update. Uninstall Emsisoft Anti-Malware, restart the computer (same method as above for Windows 10), then download and run your tagged installer per option 3. If everything fails, email us at [email protected], explain what you tried and what if anything didn't go right with each step you tried, and we'll help.
  19. If you have the problem of Emsisoft Anti-Malware asking you to re-authenticate, there are a few things that can work. Easiest first, with the most 'drastic' last. Wait. Sometimes it will sort itself out in a day or so. Restart the computer. If you're using Windows 10, restart by right-clicking the Windows start button and using restart from the shutdown sub-menu. That performs a full restart instead of the cached rapid restart that is Windows 10's default. Sign into MyEmsisoft, click 'add device', and download the tagged installer. Don't rename it, and run it when it's done downloading. It might not appear to be doing anything, but it is. Give it 30 seconds, then open Emsisoft Anti-Malware and click update. Uninstall Emsisoft Anti-Malware, restart the computer (same method as above for Windows 10), then download and run your tagged installer per option 3. If everything fails, email us at [email protected], explain what you tried and what if anything didn't go right with each step you tried, and we'll help.
  20. Hello, That extension is used by STOP(Djvu). Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter.
  21. Hello, That extension is used by STOP(Djvu). Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter.
  22. Olá, estou a utilizar DeepL Traduzir, e a minha língua materna é o inglês. Esta extensão é utilizada pela STOP(Djvu). Infelizmente, o STOP(Djvu) foi actualizado, e já não temos qualquer método para decifrar este resgate, a menos que a encriptação tenha ocorrido há algum tempo atrás, antes de 29 de Agosto de 2019. Para mais informações, consulte este post do fórum: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ Em resumo, uma identificação online é impossível de decifrar com a tecnologia actual. Um ID offline é decifrável se qualquer vítima com o mesmo ID pagar pela chave de encriptação e nos informar, para que a possamos adicionar ao nosso decifrador.
  23. That extension is used by STOP(Djvu). Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter. Your ID is an offline ID, so there is some hope that with time, an encryption key will be reported to us so we can add it to our decrypter.
  24. As it says, new variants are not supported. .sglh is a new variant. Some extra information: That extension is used by STOP(Djvu). Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019. Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter.
×
×
  • Create New...