dm7 Posted January 15, 2021 Report Share Posted January 15, 2021 Hello my pc files was encrypted by STOP DJVU ransomware(.pidon)and one of my personal ids ends in t1 so with the help of your gerat decryptor i started to upload file pairs in emisoft website and the decryptor works great for me and i uploaded a couple more files and i downloaded a couple of decryptors but all of a sudden at some point the decryptor stopped working and it didnt show me any kind of error and the decryptor produce unplayable clone of my decrypted files that looks like encrypted but they weren't. I've read some forums about this problem in emisoft website and i've tried disabling my antivirus, excluding the decryptor and even deleting my antivirus but none of them works and now none of the decryptors works on my files even on that particular single files that i have both encrypted and decrypted version of them. I would really appreciate it if you could help me solve my problem. Link to comment Share on other sites More sharing options...
GT500 Posted January 16, 2021 Report Share Posted January 16, 2021 Can you copy the output from the decrypter and paste it into a reply? 1 Link to comment Share on other sites More sharing options...
dm7 Posted January 17, 2021 Author Report Share Posted January 17, 2021 Starting... File: F:\New folder\Vega-Quartet-2013-concept-phone-3.jpg.pidon Finished! Link to comment Share on other sites More sharing options...
GT500 Posted January 19, 2021 Report Share Posted January 19, 2021 On 1/17/2021 at 7:19 AM, dm7 said: Starting... File: F:\New folder\Vega-Quartet-2013-concept-phone-3.jpg.pidon Finished! That usually means the decrypter was able to decrypt the file. Was there any other output? 1 Link to comment Share on other sites More sharing options...
dm7 Posted January 19, 2021 Author Report Share Posted January 19, 2021 no none as said before the output is a file that looks like its decrypted but its not and about the output that i copied for you ,it is missing a line that wrote decrypted(i know it cause i was able to decrypt some files before) i attach the encrypted file for you but i dont know why i cannot attach the corruptedoutput file that the web site show me this error Sorry, an unknown server error occurred when uploading this file. (Error code: imagecreatefromstring(): Couldn't create GD Image Stream out of Data) OK Vega-Quartet-2013-concept-phone-3.jpg.pidon Link to comment Share on other sites More sharing options...
dm7 Posted January 19, 2021 Author Report Share Posted January 19, 2021 and this is the original file i used to download the decryptor Link to comment Share on other sites More sharing options...
GT500 Posted January 20, 2021 Report Share Posted January 20, 2021 I'll ask the developer who wrote the decrypter if he can find anything wrong with the file. 1 Link to comment Share on other sites More sharing options...
dm7 Posted January 20, 2021 Author Report Share Posted January 20, 2021 Ok thanks ... Link to comment Share on other sites More sharing options...
GT500 Posted January 21, 2021 Report Share Posted January 21, 2021 There is no issue with decrypting the file. It's probably something preventing the decrypter from accessing the file, and since we removed all I/O errors from the output (people didn't understand what they meant) the decrypter just isn't displaying an error that it is unable to access the file. Try adding the decrypter to the exclusions in your Anti-Virus software. 1 Link to comment Share on other sites More sharing options...
dm7 Posted January 21, 2021 Author Report Share Posted January 21, 2021 i did add the decryptor to exclusion before (i even uninstalled my Anti-Virus once) i think better to change windows ... one last question, Is it possible for a encrypted file(offline key) to be encrypted again with online key? Link to comment Share on other sites More sharing options...
DJSteve Posted January 21, 2021 Report Share Posted January 21, 2021 please help in decrypt my file its .coos extension with on offline key please help ASAP Link to comment Share on other sites More sharing options...
DJSteve Posted January 22, 2021 Report Share Posted January 22, 2021 please let me know if there any decrypter for coos file Link to comment Share on other sites More sharing options...
GT500 Posted January 22, 2021 Report Share Posted January 22, 2021 18 hours ago, dm7 said: one last question, Is it possible for a encrypted file(offline key) to be encrypted again with online key? I don't think STOP/Djvu will usually double-encrypt files, however it's still technically possible because the ransomware is known to be buggy and sometimes it just does weird and unexplainable things. It's best to get it off of the system and then avoid any pirated software, movies, music, etc. after that to help prevent it from happening again. 1 Link to comment Share on other sites More sharing options...
GT500 Posted January 22, 2021 Report Share Posted January 22, 2021 18 hours ago, DJSteve said: please help in decrypt my file its .coos extension with on offline key please help ASAP This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you should be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ Link to comment Share on other sites More sharing options...
dm7 Posted January 22, 2021 Author Report Share Posted January 22, 2021 huge thanks sir ... Link to comment Share on other sites More sharing options...
GT500 Posted January 23, 2021 Report Share Posted January 23, 2021 You're welcome. Link to comment Share on other sites More sharing options...
Soorya Posted March 9, 2021 Report Share Posted March 9, 2021 Im not being able to install emsisoft djvu stop decryptor in my pc. whenever i run the the application it says emsisoft decryptor for stopdjvu has stopped working. please help. Link to comment Share on other sites More sharing options...
GT500 Posted March 10, 2021 Report Share Posted March 10, 2021 19 hours ago, Soorya said: Im not being able to install emsisoft djvu stop decryptor in my pc. whenever i run the the application it says emsisoft decryptor for stopdjvu has stopped working. please help. Windows 7? If so, then please install the latest version of the Microsoft .NET Framework (version 4.8 was the latest when I posted this). Link to comment Share on other sites More sharing options...
Amigo-A Posted March 13, 2021 Report Share Posted March 13, 2021 You can even install .NET Framework 4.7 / from the same link provided. Link to comment Share on other sites More sharing options...
Shaurya Posted May 28, 2021 Report Share Posted May 28, 2021 Hi mu djvu is not working it's day close the program I have windows 7 32 bit so can't able to install NETframe work 4.8 please as all my data is valuable Link to comment Share on other sites More sharing options...
Amigo-A Posted May 28, 2021 Report Share Posted May 28, 2021 If your OS receives updates, then it can install the updated version .NET Framework 4.8 automatically. If updates were not downloaded manually or automatically, then installation of a newer version .NET Framework is not possible until special updates are downloaded. This is a whim of Microsoft. They started blocking some installations after the end of support. The list of updates for Windows 32-bit, after the installation of which you can install .NET Framework 4.7-4.8: windows6.1-kb2670838-x86.msu windows6.1-kb2729094-v2-x86.msu windows6.1-kb2731771-x86.msu windows6.1-kb2786081-x86.msu windows6.1-kb2834140-v2-x86.msu IE11-Windows6.1-x86 - *** .exe - under *** your language windows6.1-kb4019990-x86.msu windows6.1-kb4474419-v3-x86.msu Link to comment Share on other sites More sharing options...
Vishnu Posted August 23, 2021 Report Share Posted August 23, 2021 Sir please help me .my pc infected with .Reqg virus , please help me to decrypt my file Link to comment Share on other sites More sharing options...
Amigo-A Posted August 24, 2021 Report Share Posted August 24, 2021 First, you need to determine the type of ID that was used. Read this guide. Download and run the Emsisoft Decryptor. Take a screenshot or copy what he says as a result of the check. Link to comment Share on other sites More sharing options...
Limon Hassan Posted August 26, 2021 Report Share Posted August 26, 2021 Sir, Please help me my laptop infected with .orkf . I am try emsisoft but my laptop can not be run with emsisoft decryptor. see it --- https://prnt.sc/1qiz7ul Link to comment Share on other sites More sharing options...
Amigo-A Posted August 26, 2021 Report Share Posted August 26, 2021 You need to download and run the Emsisoft Decryptor in order for it to determine if decryption is possible. https://www.emsisoft.com/ransomware-decryption-tools/stop-djvu The general guide: Link to comment Share on other sites More sharing options...
Amigo-A Posted August 26, 2021 Report Share Posted August 26, 2021 4 hours ago, Limon Hassan said: see it --- https://prnt.sc/1qiz7ul This site does not open for me. Link to comment Share on other sites More sharing options...
cybermetric Posted August 26, 2021 Report Share Posted August 26, 2021 8 hours ago, Amigo-A said: This site does not open for me. 1 Link to comment Share on other sites More sharing options...
Amigo-A Posted August 26, 2021 Report Share Posted August 26, 2021 This may indicate other problems with the system, including those related to other malware. Link to comment Share on other sites More sharing options...
cybermetric Posted August 26, 2021 Report Share Posted August 26, 2021 Also, from the Emsisoft decrypter FAQ: Why won't the decrypter run? The decrypter requires version 4.5.2 or newer of the Microsoft .NET Framework, so this could mean your version of the .NET Framework is out of date. We recommend installing the latest version of the .NET Framework (4.8 at the time of writing this), and then trying the decrypter again. Make sure Windows has been completely updated. Link to comment Share on other sites More sharing options...
Amigo-A Posted August 27, 2021 Report Share Posted August 27, 2021 @cybermetric Yes. And that too. It seems to me that it has a system freeze. I am confused by the screenshot of the screen with the number 7. Any other design? Updating the system can be problematic or impossible. Link to comment Share on other sites More sharing options...
cybermetric Posted August 27, 2021 Report Share Posted August 27, 2021 25 minutes ago, Amigo-A said: @cybermetric Yes. And that too. It seems to me that it has a system freeze. I am confused by the screenshot of the screen with the number 7. Any other design? Updating the system can be problematic or impossible. Windows 7 operating system. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted August 27, 2021 Report Share Posted August 27, 2021 Is that system up to date? Windows 7 also requires the KB4474419 SHA 2 update.https://www.catalog.update.microsoft.com/Search.aspx?q=KB4474419 Link to comment Share on other sites More sharing options...
sukuna Posted August 31, 2021 Report Share Posted August 31, 2021 On 1/16/2021 at 10:18 AM, GT500 said: Can you copy the output from the decrypter and paste it into a reply? Starting... File: C:\$SysReset\Logs\PushButtonReset.etl.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\SessionID.xml.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\setupact.log.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\setuperr.log.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\Timestamp.xml.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\diagerr.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\diagwrn.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\setupact.log Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\setuperr.log Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\windlp.state-old.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\windlp.state.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\LDPlayer\LDPlayer4.0\dnrepairer.exe Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\LDPlayer\LDPlayer4.0\dnrepairer.exe.lqqw Link to comment Share on other sites More sharing options...
sukuna Posted August 31, 2021 Report Share Posted August 31, 2021 On 1/16/2021 at 10:18 AM, GT500 said: Can you copy the output from the decrypter and paste it into a reply? Starting... File: C:\$SysReset\Logs\PushButtonReset.etl.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\SessionID.xml.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\setupact.log.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\setuperr.log.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$SysReset\Logs\Timestamp.xml.lqqw Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\diagerr.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\diagwrn.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\setupact.log Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\setuperr.log Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\windlp.state-old.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\$Windows.~WS\Sources\Panther\windlp.state.xml Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\LDPlayer\LDPlayer4.0\dnrepairer.exe Error: No key for New Variant online ID: ePixmSatKdEfHnivHLU9AScBOylIOWQn86ymhNGm Notice: this ID appears to be an online ID, decryption is impossible File: C:\LDPlayer\LDPlayer4.0\dnrepairer.exe.lqqw HELP ME Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted September 1, 2021 Report Share Posted September 1, 2021 Hello @sukuna, Welcome to the Emsisoft Support Forums. I understand it is frustrating, but currently, we are not aware of any ways to decrypt files with Online-ID and some recent forms of STOP(DJVU). Please read this Topic. It contains information about your situation and whether or not your files can be decrypted.https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/ Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted September 7, 2021 Report Share Posted September 7, 2021 Thread Closed Link to comment Share on other sites More sharing options...
Recommended Posts