Ravinder

My all files are encrypted by .npsk extension

Recommended Posts

Respected Sir/Madam,

I salute u for helping all the world for free.

I am Ravinder Singh, and few days ago i was attacked by a ransomware for the first time in my life, all my files (.mp4, .jpg, .txt, .xls, .doc etc) are encrypted by .npsk extension.

I have two different hard disks ,one for OS (C:) and another for my data (D:), i have formatted drive C and now there is no virus in drive C:, but the problem in drive D is that the extensions of the files such as.jpg, .mp4, .xls, .txt, .pdf etc are changed to .npsk and are not opening or working, i was shocked and all my hopes were in bin, then i searched the web for a solution and i came in touch with you, all my hardwork is turned to dust.

I would rather donate the ransom money to your cause at "EMSISOFT" than to the attackers.Please, I am in need of immediate help.Please please please i beg i beg i beg i beg i beg

Share this post


Link to post
Share on other sites

nothing mate you can do now, you can only wait and save that data for future, especially if you had been ransomed with online key as I am. Maybe someone will solve it. I tried everything

Share this post


Link to post
Share on other sites
18 hours ago, Ravinder said:

I am Ravinder Singh, and few days ago i was attacked by a ransomware for the first time in my life, all my files (.mp4, .jpg, .txt, .xls, .doc etc) are encrypted by .npsk extension.

This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

Share this post


Link to post
Share on other sites

INFO REGARDING .NPSK EXTENSION

I had been attacked by the.npsk ransomware & experimenting since 14 April 2020.

I have found something useful that I think you should know

I had tried renaming every extension file that got locked by the .npsk ransomware and out of those, when I renamed the .mp3.npsk files , i.e. when i removed the .npsk from the name,
the all mp3 files started working again.

I thought you should know this as this can be helpful to other people as well.

A KIND REQUEST TO EMSISOFT to help me how to decrypt other extension files.

Share this post


Link to post
Share on other sites
16 hours ago, Ravinder said:

I had tried renaming every extension file that got locked by the .npsk ransomware and out of those, when I renamed the .mp3.npsk files , i.e. when i removed the .npsk from the name,
the all mp3 files started working again.

The ransomware only encrypts part of the beginning of each file. There are some file formats that are tolerant of corrupt data at the beginning of a file, and thus you can recover them this way, or with file repair software.

Unfortunately most file formats are not tolerant of corrupted data at the beginning of files, and most files will not be recoverable this way.

 

16 hours ago, Ravinder said:

A KIND REQUEST TO EMSISOFT to help me how to decrypt other extension files.

I would need to know your ID before I can tell you whether or not your files are decryptable.

Share this post


Link to post
Share on other sites

Sorry for late reply
This is the ID i got from the ransomware .txt file

"Your personal ID:
0215Asd4a7d6rV30MafXcIWlamcysYcPzoln5JjpCal9B1XjQzGw"

Share this post


Link to post
Share on other sites
3 hours ago, Ravinder said:

Your personal ID:
0215Asd4a7d6rV30MafXcIWlamcysYcPzoln5JjpCal9B1XjQzGw

That's an online ID, so unfortunately it's not decryptable.

Share this post


Link to post
Share on other sites

A KIND REQUEST IS THERE ANY SOLUTION TILL DATE TO .npsk online ID DECRYPTION

PLEASE HELP I BEG I BEG I BEG YOU

I AM ALSO READY TO PAY EMSISOFT RATHER THAN TO ATTACKERS

Share this post


Link to post
Share on other sites
16 hours ago, Ravinder said:

A KIND REQUEST IS THERE ANY SOLUTION TILL DATE TO .npsk online ID DECRYPTION

We would need the private key for your ID in order to decrypt your files, and only the criminals have the private keys.

Share this post


Link to post
Share on other sites

hello sir,

i have also been attacked with .npsk  type ransomware.

the readme files says:

"Your personal ID:
0215Asd4a7d6PUYef3QgyNaY7l8zzvWo4yIuFfw9blf3NZjYd3t1"

Can it be decrypted. please help sir.

thank you.

 

Share this post


Link to post
Share on other sites
16 hours ago, ALTAF AHMED said:

Your personal ID:
0215Asd4a7d6PUYef3QgyNaY7l8zzvWo4yIuFfw9blf3NZjYd3t1

This is a newer variant of STOP/Djvu. We do have the private key for .npsk's offline ID, so as long as all of your files have this ID then they should be decryptable.

There is more information at the following link, including a link to the decrypter download page:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

Share this post


Link to post
Share on other sites
On 6/26/2020 at 1:45 PM, GT500 said:

We would need the private key for your ID in order to decrypt your files, and only the criminals have the private keys.

Respected Sir/Mam,
I am honored by your truthful answers and helping me and the entire world for free.
You said "We would need the private key for your ID in order to decrypt your files, and only the criminals have the private keys."
My last question is should i keep hope of ever recovering my files in future to .npsk online ID DECRYPTION.
Kindly guide
Thanking you.

Share this post


Link to post
Share on other sites

I tried to contact them and they sent me this mail

You need to purchase an decrypt software and unique private key.
After you will get software, start it and decrypt all your data.
You can download video overview decrypt tool:
https://fromsmash.com/NjXCXq9NDq-dt

Price of private key and decrypt software is 0.06 bitcoin with 50% discount.
0.06 bitcoin ~ 490 usd.

Before paying you can send 1 file for free decryption.
Send us your personal ID too.
Please note that files must NOT contain valuable information.

After payment we answer all your questions about server safety.

The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller by payment method and price.
Video manual:
1 - You need register localbitcoins account:
https://www.youtube.com/watch?v=uRGMWGir-3Y

2 - Buy bitcoins in localbitcoins video:
https://www.youtube.com/watch?v=hzHLeeU1tFE

3 - Send your bitcoins to our wallet video manual:
https://www.youtube.com/watch?v=u6CTDz7SXEU


Any bitcoin exchangers:
Binance.com
BuyBitcoin
CoinMonitor.io
CoinMama
Changelly.com
PAYEER
CEX.IO
Coinbase.com
Paxful.com
Coincafe.com
Giottus.com

Share this post


Link to post
Share on other sites
17 hours ago, Ravinder said:

My last question is should i keep hope of ever recovering my files in future to .npsk online ID DECRYPTION.

If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back.

Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future.

We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:
https://www.bleepingcomputer.com/

If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:
https://www.bleepingcomputer.com/feed/

Share this post


Link to post
Share on other sites
14 hours ago, Jayeh said:

I tried to contact them and they sent me this mail

The information they gave you is fairly typical. Most ransoms like this are expected to be paid in bitcoins.

Obviously we don't recommend paying the ransom, however we also understand that you have to do what you feel is necessary. Just be sure to ask them to decrypt one file for you to demonstrate that they can do it, that way you know in advance that their decrypter works before you pay them anything. If they can't decrypt one file for you then it's best to assume it's a scam, and cease all contact with them.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.