MY PC INFECTED *.FORDAN RANSOMWARE

[sunny parmar 0]

sir

my pc infect fordan malware (ransomeware) please solve my problem

[Amigo-A 40]

If your files are encrypted and now have an .fordan  extension, then this is the result of an attack from the STOP Ransomware. 

STOP Ransomware encrypts files of users in many countries due to the fact that they download and run hacked software (MS Windows, MS Office, other repacked or patched programs), from which someone removed the activation, making them free and dangerous at the same time due of this malicious code. 

Before you decrypt the files, you need to make sure that there is neither this infection nor any other infection on the PC. We have seen cases when those who suffered from previous versions STOP Ransomware successfully decrypted files, but then they were attacked by the same encryptor, which encrypted files with a different extension, and used an encryption key that cannot be calculated. In punishment for haste and complacency, the user lost his files a second time and, possibly, forever.

As experience shows, very often after encryption on a PC, this or another infection remains, which you could get together with the encryptor.
Malicious programs often work in groups: trojans of a different type, password hijackers, backdoors, dormant malware, dangerous browser plugins.

 If you need help checking your PC for malware, you can make a request  in the next section.

You can also download the free tool Emsisoft Emergency Kit yourself and check the computer.

[Amigo-A 40]

After checking the PC and folders with encrypted files, you can use the free tool to decrypt files - STOPDecrypter (link)

This process should be approached with caution. Read the attached text file.
Due to the nature of encryption, only files that are encrypted with offline keys can be decrypted.
We recommend that you make a test decryption of a small number of encrypted files and make copies of them in advance.

[GT500 585]

That is more than likely a variant of the STOP ransomware. ID Ransomware can confirm that, and can let you know if STOPDecrypter can recover your files. Here's a link to ID Ransomware:
https://id-ransomware.malwarehunterteam.com/

If STOPDecrypter can't recover your files, then note that it can still be used to get information that may be able to help the creator of STOPDecrypter figure out your decryption key. Here's a link to instructions on how to get this information with STOPDecrypter:
https://kb.gt500.org/stopdecrypter

[sunny parmar 0]

not solve my problem

[sunny parmar 0]

a.txt.fordan

[Amigo-A 40]

Dear sunny parmar

The solution is possible, but not immediately. You can view other topics to familiarize yourself with the process.

First, the Ransomware is created, then it is distributed through the sites, then the user downloads something, starts it.., then malware infects the PC and encrypts the files. After that, the user discovers that the files are encrypted. Then he turns for help ...

How to help him if the files are his PC and encryption occur on his side?
Specialists are ready to help, but they need to examine the encrypted files and get the keys for decrypt in order to make decryption possible and more simple. 

This is a more complicated process than to smear an injured finger with antiseptic, iodine and cure it.

[Amigo-A 40]

Dear sunny parmar

Above, GT500 wrote you what need to do according to his instructions. This can help to developer of STOPDecrypter, and you, of course.

Quote

If STOPDecrypter can't recover your files, then note that it can still be used to get information that may be able to help the creator of STOPDecrypter figure out your decryption key. Here's a link to instructions on how to get this information with STOPDecrypter:
https://kb.gt500.org/stopdecrypter

 

[shoaib 0]

i have same problem

my files encrypted with fordan

how can i know is key offline or online?

[GT500 585]

16 hours ago, sunny parmar said:

not solve my problem

Yes, that was expected. First we need your ID and MAC addresses from the infected computer, and they there's a possibility that the creator of STOPDecrypter may be able to figure out your decryption key. Or you could get lucky and have an offline ID, so that when support for the variant of STOP/Djvu that encrypted your files is added to STOPDecrypter it will be able to decrypt them on its own.

 

49 minutes ago, shoaib said:

how can i know is key offline or online?

Attach a copy of the ransom note to a reply and I'll let you know if it looks like an offline ID.

You can also follow the instructions at the link below for getting your ID and MAC addresses with STOPDecrypter, which may help in figuring out your decryption key if you don't have an offline ID:
https://kb.gt500.org/stopdecrypter

[GT500 585]

FYI: While most ransomwares will automatically delete themselves after they finish encrypting files, some are now leaving behind components on computers they infect that will encrypt any new files saved and will encrypt any files you manage to decrypt. It's best to check and make sure that no such components have been left behind, so I recommend following the instructions at the link below to get us logs from FRST so that one of our experts can make sure there is nothing malicious still on your computer (please attach the log files FRST saves to a reply to this topic on the forums):
https://help.emsisoft.com/en/1738/how-do-i-run-a-scan-with-frst/

Note: If anything that appears suspicious is found in your logs, then your post will be moved into a new topic to facilitate better communication between you and whoever is assisting you. We'll also try to make sure that you are following the new topic so that you receive e-mail notifications when someone replies to it.

[sunny parmar 0]

sir

I send my files details

Decrypted 0 files!
Skipped 5 files.

[!] No keys were found for the following IDs:
[*] ID: qOYn1VNGsvBEwqldLg6QzqQVTpWLpN9U0xdyJC4n (.teamxpart )
[*] ID: qOYn1VNGsvBEwqldLg6QzqQVTpWLpN9U0xdyJC4n (.fordan )
[*] ID: qOYn1VNGsvBEwqldLg6QzqQVTpWLpN9U0xdyJC4n (.txt )
Please archive these IDs and the following MAC addresses in case of future decryption:
[*] MACs: 00:11:22:98:76:54, 0C:9D:92:80:F0:3E
This info has also been logged to STOPDecrypter-log.txt

[GT500 585]

13 hours ago, sunny parmar said:

I send my files details

OK, I've forwarded your information to the creator of STOPDecrypter, and he will archive it in case he is able to figure out your key at some point in the future.

[sunny parmar 0]

ok sir

[sunny parmar 0]

please solve my problem sir.....

[Amigo-A 40]

sunny parmar

Please, be patient. Support specialists  may not respond during the weekend. This is indicated in the forum rules.
The solution of the problem may come not very quickly.
Do not depart from the topic, it is important for you, wait for the answer of the specialist and the final decision.

[GT500 585]

19 hours ago, sunny parmar said:

please solve my problem sir.....

No one has an immediate solution for this. If you can give the analysts a little time, they may be able to come up with a way for you to decrypt your files.

[sunny parmar 0]

ok sir....

[sunny parmar 0]

please help sir

I again send you

[!] No keys were found for the following IDs:
[*] ID: qOYn1VNGsvBEwqldLg6QzqQVTpWLpN9U0xdyJC4n (.teamxpart )
[*] ID: qOYn1VNGsvBEwqldLg6QzqQVTpWLpN9U0xdyJC4n (.fordan )
[*] ID: qOYn1VNGsvBEwqldLg6QzqQVTpWLpN9U0xdyJC4n (.txt )
Please archive these IDs and the following MAC addresses in case of future decryption:
[*] MACs: 00:11:22:98:76:54, 0C:9D:92:80:F0:3E

1.ai.fordan

[GT500 585]

On 6/1/2019 at 12:49 AM, sunny parmar said:

I again send you

There's no need to send the information again. It's already been archived.

[sunny parmar 0]

ok

 

[GT500 585]

Just hold on a bit longer, and we'll come up with a solution for you.

[sunny parmar 0]

thanks sir☺️

[sunny parmar 0]

sir my problem not solve...please help me...

[sunny parmar 0]

sorry for late

_readme.txt 006.jpg.fordan

[GT500 585]

18 hours ago, sunny parmar said:

sir my problem not solve...please help me...

Just give us some time, and we'll come up with a solution for you.

[sunny parmar 0]

sir please solve my problem

[GT500 585]

12 hours ago, sunny parmar said:

sir please solve my problem

It's not possible to speed up the process. Figuring out decryption keys is random, so we just have to wait.

[sunny parmar 0]

ok😟

[GT500 585]

We have a new decryption service for STOP/Djvu available. There's more information and instructions on how to use it at the following links:
https://www.bleepingcomputer.com/news/security/stop-ransomware-decryptor-released-for-148-variants/
https://blog.emsisoft.com/en/34375/emsisoft-releases-new-decryptor-for-stop-djvu-ransomware/