mustafa 0 Report post Posted May 18 Please help me Encryption Type codnat Quote Share this post Link to post Share on other sites
Amigo-A 43 Report post Posted May 19 More precisely, now you have all the files encrypted and have the extension .codnat STOP Ransomware encrypted your files. Before you decrypt the files, you need to make sure that there is neither this infection nor any other infection on the PC. We have seen cases when those who suffered from previous versions STOP Ransomware successfully decrypted files, but then they were attacked by the same encryptor, which encrypted files with a different extension, and used an encryption key that cannot be calculated. In punishment for haste and complacency, the user lost his files a second time and, possibly, forever. Quote Share this post Link to post Share on other sites
Amigo-A 43 Report post Posted May 19 As experience shows, very often after encryption on a PC, this or another infection remains, which you could get together with the encryptor.Malicious programs often work in groups: trojans of a different type, password hijackers, backdoors, dormant malware, dangerous browser plugins.Therefore, I advise you to check your PC for active and dormant malware. This can be done here in the forum in the next section. This must be done in any case. You can also download the free tool Emsisoft Emergency Kit yourself and check the computer. STOP Ransomware encrypts files of users in many countries due to the fact that they download and run hacked software (MS Windows, MS Office, other repacked or patched programs), from which someone removed the activation, making them free and dangerous at the same time due of this malicious code. Quote Share this post Link to post Share on other sites
Amigo-A 43 Report post Posted May 19 After checking the PC (or only folders with encrypted files), you can use the free tool to decrypt files - STOPDecrypter (link) This process should be approached with caution. Read the attached text file. Due to the nature of encryption, only files that are encrypted with offline keys can be decrypted. We recommend that you make a test decryption of a small number of encrypted files and make copies of them in advance. Quote Share this post Link to post Share on other sites
GT500 593 Report post Posted May 20 That is more than likely a variant of the STOP ransomware. ID Ransomware can confirm that, and can let you know if STOPDecrypter can recover your files. Here's a link to ID Ransomware:https://id-ransomware.malwarehunterteam.com/ If STOPDecrypter can't recover your files, then note that it can still be used to get information that may be able to help the creator of STOPDecrypter figure out your decryption key. Here's a link to instructions on how to get this information with STOPDecrypter:https://kb.gt500.org/stopdecrypter Quote Share this post Link to post Share on other sites