ID appears to be an online ID, decryption is impossible

[Varun79]

It has been around more than 6 months ever since my pc was infected with ransomware till now no proper solution is available online.

recently I tried decrypting files from Emsisoft from selected folders and it reported the following message

File: D:\Some_Documents\FORM-13_STSPL.pdf.piiq
Error: No key for New Variant online ID: PKcSXGNkzZGb6U653rxFszv43Lp0y0lMZNKY3r4x
Notice: this ID appears to be an online ID, decryption is impossible

I humbly urge the Emsisoft community to look into this matter seriously and provide some sort of solutions or approaches or even an attempt to solve this illegal encryption.

Regards

Varun

[David B.]

Unfortunately there is still nothing we can do about this newer STOP(Djvu), and I'm told there won't be for the foreseeable future. My prewritten yet pertinent information about it:

Unfortunately, STOP(Djvu) was updated, and we no longer have any method to decrypt this ransomware unless the encryption occurred some time ago, before the 29th of August 2019.

Please refer to this forum post for more information: https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

To summarize, an online ID is impossible to decrypt with current technology. An offline ID is decryptable if any one victim with the same ID pays for the encryption key and reports it to us, so we can add it to our decrypter.

You can try deleted file recovery software such as Revo from Piriform to see if you can recover older copies of some files, but this does not usually work well. With larger files such as movies or music, sometimes the files will still work if you just change the filenames back to original, since STOP(Djvu) only encrypts the first part of each file. There will of course still be part of the file that is encrypted and effectively corrupt.

For further questions please refer to bleepingcomputer.com forums: https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/

And thanks again for contacting Emsisoft.

[ShadowPuterDude]

Thread Closed