Ruman Afzal

Encrypted files

Recommended Posts

Hello Ruman,

Thank you for contacting Emsisoft Support.

Let's make sure of what we're dealing with.

 

Please visit the following website and upload both an encrypted file (between 256KB and 2MB in size would be best) and a ransom note simultaneously for proper identification, and send me the information it provides:

 

https://www.emsisoft.com/ransomware-decryption-tools/

 

Please be sure to read the information link on the results page, as whether we have a decrypter or not, sometimes someone else's decrypter is listed, or other information is available that might be useful for recovery.

 

You might try undelete software such as Recuva from Piriform, or if your files are very important, it may be worth talking to a company that specializes in negotiating with the criminals that created the ransomware, such as Coveware, at https://www.coveware.com/. They are one of the few companies that do this completely transparently and honestly.

 

If the identification process shows a ransomware that is not decryptable, there is nothing else we can do. We do not recommend paying the ransom unless there is absolutely no other choice.

Share this post


Link to post
Share on other sites
10 hours ago, Kevin Zoll said:

 

We have identified "STOP (Djvu)". This ransomware may be decryptable under certain circumstances.

Please refer to the appropriate guide for more information.

Identified by:

  • sample_extension: .gesd
  • sample_bytes: [0x14BC - 0x14E2] 0x7B33364136393842392D443637432D344530372D424538322D3045433542313442344446357D

Click here for more information about STOP (Djvu).

Case number: ac0ea6947dbf2568ac18fca65937c03e84df67661576298065

sir this is what the decryptor says.sir not every file is important only the images were importan

_readme.txt images (1).jpg.gesd

Share this post


Link to post
Share on other sites

It's possible that law enforcement may catch the criminals eventually, and release their database of keys for use in decrypters. I recommend keeping a backup of your encrypted files in case this happens.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.