The STOP/Djvu ransomware codifies the users’ data with the AES-256 algorithm (CFB mode). However, it does not encrypt the entire file, but rather approximately 5 MB in its beginning. Subsequently, it asks for a ransom that amounts to $980 in Bitcoin equivalent to restore the files.
The authors of the malware have Russian roots. The frauds use the Russian language and Russian words written in English and the domains registered through Russian domain-registration companies. The crooks most likely have allies in other countries.
DJVU Ransomware Technical Info
Many users indicate that the cryptoware is injected after downloading repackaged and infected installers of popular programs, pirated activators of MS Windows and MS Office (such as KMSAuto Net, KMSPico, etc.) distributed by the frauds through popular websites. This relates to both legitimate free applications and illegal pirated software.
The cryptoware may also be spread through hacking using poorly protected RDP configuration via email spam and malicious attachments, misleading downloads, exploits, web injectors, faulty updates, and repackaged and infected installers.
The list of file extensions subject to encryption:
- MS Office or OpenOffice documents
- PDF and text files
- Databases
- Photos, Music, Video or Image files
- Archives
- Application files, etc.
STOP/DJVU Ransomware drop files (ransom notes) named !!!YourDataRestore!!!.txt, !!!RestoreProcess!!!.txt, !!!INFO_RESTORE!!!.txt, !!RESTORE!!!.txt, !!!!RESTORE_FILES!!!.txt, !!!DATA_RESTORE!!!.txt, !!!RESTORE_DATA!!!.txt, !!!KEYPASS_DECRYPTION_INFO!!!.txt, !!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!SAVE_FILES_INFO!!!.txt and !readme.txt. The .djvu* and newer variants: _openme.txt, _open_.txt, or _readme.txt
Stages of cryptoware infection
- Once launched, the cryptoware executable connects to the Command and Control server (С&C). Consequently, it obtains the encryption key and the infection identifier for the victim’s PC. The data is transferred under the HTTP protocol in the form of JSON.
- If С&C is unavailable (when the PC is not connected to the server’s Internet does not respond), the cryptoware applies the directly specified encryption key concealed in its code and performs the autonomous encryption. In this case, it is possible to decrypt the files without paying the ransom.
- The cryptoware uses rdpclip.exe to replace the legitimate Windows file and implement the computer network attack.
- Upon successful file encryption, the cipherer is autonomously removed using the delself.bat command file.
Associated Items
C:\Users\Admin\AppData\Local\3371e4e8-b5a0-4921-b87b-efb4e27b9c66\build3.exe C:\Users\Admin\AppData\Local\Temp\C1D2.dll C:\Users\Admin\AppData\Local\Temp\19B7.exe C:\Users\Admin\AppData\Local\Temp\2560.exe Tasks: "Azure-Update-Task" Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper
Network Traffic
clsomos.com.br o36fafs3sn6xou.com rgyui.top starvestitibo.org pelegisr.com furubujjul.net api.2ip.ua morgem.ru winnlinne.com
Antivirus detection
- Trojan:Win32/Tnega!MSR Removal
- Win32:Adware-DNA [Adw] Virus Removal
- Win32:Secat [Trj] Virus Removal
- Trojan:MSIL/FormBook.PRY!MTB Virus Removal
- Trojan:Win32/Cerber.MR!MTB Virus Removal
- Trojan:Win32/Phonzy.B!ml Virus Removal
- Trojan:Win32/ButeRat!pz Virus Removal
- Win32/TrojanDownloader.Busky.AZ Virus Removal
- NSIS/TrojanDownloader.Agent.OBN Virus Removal
- Ransom:Win32/Conti.ZCI!dha Virus Removal
In addition to encrypting a victim’s files, the DJVU family has also install the Azorult Spyware to steal account credentials, cryptocurrency wallets, desktop files, and more.
How to decrypt STOP/DJVU Ransomware files?
Djvu Ransomware essentially has two versions.
- Old Version: Most older extensions (from “.djvu” up to “.carote (v154)”) decryption for most of these versions was previously supported by STOPDecrypter tool in case if infected files with an offline key. That same support has been incorporated into the new Emsisoft Decryptor for these old Djvu variants. The decrypter will only decode your files without submitting file pairs if you have an OFFLINE KEY.
- New Version: The newest extensions were released around the end of August 2019 after the ransomware was changed. This includes .nury, nuis, tury, tuis, etc….these new versions were supported only with Emsisoft Decryptor.
What is a “file pair”?
This is pair of files that are identical (as in they are the same precise data), except one duplicate is encrypted, and the other is not.
How to identify offline or online key?
The SystemID/PersonalID.txt file created by STOP (DJVU) on your C drive contains all of the IDs used in the encryption process.
Almost every offline ID ends with “t1”. Encryption by an OFFLINE KEY can be verified by viewing the Personal ID in the _readme.txt note and the C:\SystemID\PersonalID.txt file.
The quickest way to check if you were infected with an OFFLINE or ONLINE KEY is to:
- Find the PesonalID.txt file located in the folder C:\SystemID\ on the infected machine and check to see if there is only one or multiple IDs.
- If the ID ends with “t1” there is a chance that some of your files were encrypted by the OFFLINE KEY and are recoverable.
- If none of the IDs listed end with “t1”, then all of your files were most likely encrypted with an ONLINE KEY and are not recoverable now.
Online & offline keys – What does it mean?
OFFLINE KEY indicates that the files are encrypted in offline mode. After discovering this key, it will be added to the decryptor and that files can be decrypted.
ONLINE KEY – was generated by the ransomware server. It means that the ransomware server generated a random set of keys used to encrypt files. Decrypt such files is not possible.
Encryption with the RSA algorithm used in the latest DJVU variants does not allow to use of a pair of “encrypted + original” files to train the decryption service. This certain type of encryption is resistant to cracking, and it is impossible to decrypt files without a private key. Even a supercomputer will need 100`000 years to calculate such a key.
Encrypted files extension
I. STOP group
STOP, SUSPENDED, WAITING, PAUSA, CONTACTUS, DATASTOP, STOPDATA, KEYPASS, WHY, SAVEfiles, DATAWAIT, INFOWAIT
II. Puma group
puma, pumax, pumas, shadow
III. Djvu group
djvuu, uudjvu, blower, tfudet, promok, djvut, djvur, klope, charcl, doples, luces, luceq, chech, proden, drume, tronas, trosak, grovas, grovat, roland, refols, raldug, etols, guvara, browec, norvas, moresa, verasto, hrosas, kiratos, todarius, hofos, roldat, dutan, sarut, fedasot, forasom, berost, fordan, codnat, codnat1, bufas, dotmap, radman, ferosas, rectot, skymap, mogera, rezuc, stone, redmat, lanset, davda, poret, pidon, heroset, myskle, boston, muslat, gerosan, vesad, horon, neras, truke, dalle, lotep, nusar, litar, besub, cezor, lokas, godes, budak, vusad, herad, berosuce, gehad, gusau, madek, tocue, darus, lapoi, todar, dodoc, novasof, bopador, ntuseg, ndarod, access, format, nelasod, mogranos, nvetud, cosakos, kovasoh, lotej, prandel, zatrov, masok, brusaf, londec, kropun, londec, krusop, mtogas, nasoh, coharos, nacro, pedro, nuksus, vesrato, cetori, masodas, stare, carote, shariz,
IV. Gero group (RSA)
gero, hese, xoza, seto, peta, moka, meds, kvag, domn, karl, nesa, boot, noos, kuub, mike, reco, bora, leto, nols, werd, coot, derp, nakw, meka, toec, mosk, lokf, peet, grod, mbed, kodg, zobm, rote, msop, hets, righ, gesd, merl, mkos, nbes, piny, redl, kodc, nosu, reha, topi, npsg, btos, repp, alka, bboo, rooe, mmnn, ooss, mool, nppp, rezm, lokd, foop, remk, npsk, opqz, mado, jope, mpaj, lalo, lezp, qewe, mpal, sqpc, mzlq, koti, covm, pezi, zipe, nlah, kkll, zwer nypd, usam, tabe, vawe, moba, pykw, zida, maas, repl, kuus, erif, kook, nile, oonn, vari, boop, geno, kasp, .ogdo, .npph .kolz, .copa, .lyli, .moss, .foqe, .mmpa, .efji, .iiss, .jdyi, .vpsh, .agho, .vvoa, .epor, .sglh, .lisp, .weui, .nobu, .igdm, .booa, .omfl, .igal, .qlkm, .coos, .wbxd, .pola .cosd, .plam, .ygkz, .cadq, .ribd, .tirp, .reig, .ekvf, .enfp, .ytbn, .fdcz, .urnb, .lmas, .wrui, .rejg or .pcqq, .igvm, nusm, ehiz, .paas, .pahd, .mppq, .qscx, .sspq, .iqll, .ddsg, .piiq, .neer, .miis, .leex, .zqqw, .lssr, .pooe, .zzla, .wwka, .gujd, .ufwj, .moqs, .hhqa, .aeur, .guer, .nooa, .muuq, .reqg, .hoop, .orkf, .iwan, .lqqw, .efdc, .wiot, .koom, .rigd, .tisc, .nqsq, .irjg, .vtua, .maql, .zaps, .rugj, .rivd, .cool, .palq, .stax, .irfk, .qdla, .qmak, .utjg, .futm, .iisa, .pqgs, .robm, .rigj, .moia, .yqal, .wnlu, .hgsh, .mljx, .yjqs, .shgv, .hudf, .nnqp, .xcmb, .sbpg, .miia, .loov, .dehd, .vgkf, .nqhd, .zaqi, .vfgj, .fhkf, .maak, .qqqw, .yoqs, .qqqe, .bbbw, .maiv, .bbbe, .bbbr, .qqqr, .avyu, .cuag, .iips, .ccps, .qnty, .naqi, .ckae, .eucy, .gcyi, .ooii, .rtgf, .jjtt, .fgui, .vgui, .fgnh, .sdjm, .dike, .xgpr, .iiof, .ooif, .vyia, .qbaa, .fopa, .vtym, .ftym, .bpqd, .xcbg, .kqgs, .iios, .vlff, .eyrv, .uigd, .rguy, .mmuz, .kkia, .hfgd, .ssoi, .pphg, .wdlo, .kxde, .snwd, .mpag, .voom, .gtys, .udla, .tuid, .uyjh, .qall, .qpss, .hajd, .ghas, .dqws, .nuhb, .dwqs, .ygvb, .msjd, .dmay, .jhdd, .jhbg, .dewd, .jhgn, .ttii, .mmob, .hhjk, .sijr, .bbnm, .xcvf, .egfg, .mine, .kruu, .byya, .ifla, .errz, .hruu, .dfwe, .fdcv, .fefg, .qlln, .nnuz, .zpps, .ewdf, .zfdv, .uihj, .zdfv, .rryy, .rrbb, .rrcc, .eegf, .bnrs, .bbzz, .bbyy, .bbii, .efvc, .hkgt, .eijy, .lloo, .lltt, .llee, .llqq, .dkrf, .eiur, .ghsd, .jjyy, .jjll, .jjww, .hhwq, .hhew, .hheo, .hhyu, .ggew, .ggyu, .ggeo, .ggwq, .hhye, .ooxa, .oori, .vveo, .vvwq, .vvew, .vveq, .vvyu, .dnet, .qstx, .ccew, .ccyu, .cceq, .ccwq, .cceo, .ccza, .qqmt, .qqlo, .qqlc, .oxva, .qqri, .qqjj, .qqkk, .qqpp, .xbtl, .oopu, .oodt, .oovb, .mmpu, .mmvb, .mmdt, .eewt, .eemv, .enus, .eeyu, .epub, .eebn, .stop, .aamv, .aawt, .aayu, .aabn, .oflg, .ofww, .ofoq, .adlg, .adoq, .adww, .tohj, .towz, .powz, .pohj, .tury, .tuis, .tuow, .nury, .nuis, .nuow, .nury, .powd, .pozq, .bowd, .bozq, .zatp, .zate, .fatp, .fate, .tcvp, .tcbu, .kcvp, .kcbu, .uyro, .uyit, .mppn, .mbtf, .manw, .maos, .matu, .btnw, .btos, .bttu, .isal, .iswr, .isza, .znsm, .znws, .znto, .bpsm, .bpws, .bpto, .zoqw, .zouu, .poqw, .pouu, .mzqw, .mztu, .mzop, .assm, .erqw, .erop, .vvmm, .vvoo, .hhmm, .hhee, .hhoo, .iowd, .ioqa, .iotr, .qowd, .qoqa, .qotr, .gosw, .goaq, .goba, .cosw, .coaq, .coba, craa, .qazx, .qapo, .qarj, .dazx, .dapo, .darj, .tycx, .tywd, .typo, .tyos, .jycx, .jywd, .jypo, .jyos, .nifr, .nitz, .niwm, .kiop, .kifr, .kitz, .kiwm, .boty, .boza, .coty, .coza, .fofd, .foty .foza, .sato, .saba, .qopz, .qore, .gash, .gatz, .xash, .xatz, .xaro, .gaze, .gatq, .gapo, .vaze, .vatq, .vapo, .werz, .weqp, .weon, .nerz, .neqp, .neon, .ahtw, .ahgr, .ahui, .bhtw, .bhgr, .bhui, .tghz, .tgpo, .tgvv, .aghz, .agpo, .agvv, .wazp, .waqq, .wayn, .gazp, .gaqq, .gayn, .miza, .mitu, .miqe, .kizu, .kitu, .kiqu, .wsaz, .wspn, .wsuu, .poaz, .popn, .pouu, .yyza, .yytw, .yyza, .tasa, .taqw, .taoy, .jasa, .jaqw, .jaoy, .wzqw, .wzer, .wzoq, .wztt, .nzqw, .nzer, .nzoq, .nztt, .teza, .rzkd, .rzfu, .rzew, .rzml, .hgkd, .hgfu, .hgew, .hgml, .oopl, .ooty, .oohu, .ooza, .wwpl, .wwty, .wwhu, .wwza, .azqt, .azre, .azop, .azhi, .mzqt, .mzre, .mzop, .mzhi, .ttwq, .ttza, .ttap, .ttrd, .mlwq, .mlza, .mlap, .mlrd, .ptqw, .ptrz, .pthh, .itqw, .itrz, .ithh, .zpas, .zpww, .zput, .ppvs, .ppvw, .ppvt, .yzaq, .yzqe, .yzoo, jzeq, .jzie, .eqew, .eqza, .iicc, .gyew, .gyca, .gycc, .jazi, .jawr, .nbzi, .nbwr, .hhuy, .hhaz, .ljuy, .ljaz, .loqw, .lomz, .cdqw, .cdmx, .cdwe, .cdaz, .cdpo, .cdtt, .cdcc, .cdxx, .ldhy.
.btos (V0618) Dec 2022 <- used previously .btos (V0202) Jan 2020
.mzqw (V0635) Jan 2023 <- used previously .mzqw (V0625) Jan 2023
.pouu (V0755) Jul 2023 <- used previously .pouu (V0634) Jan 2023
.mzop (V0796) Sep 2023 <- used previously .mzop (V0637) Jan 2023
The list of known DJVU e-mail:
support@fishmail.top, datarestorehelp@airmail.cc, manager@mailtemp.ch, helprestoremanager@airmail.cc, helpteam@mail.ch, helpdatarestore@firemail.cc, helpmanager@mail.ch, helpmanager@firemail.cc, helpmanager@iran.ir, datarestorehelp@firemail.cc, datahelp@iran.ir, restorefiles@firemail.cc, salesrestoresoftware@firemail.cc, salesrestoresoftware@gmail.com, amundas@firemail.cc, gerentosrestore@firemail.cc, gerentoshelp@firemail.cc
The list of latest STOP(DJVU) Ransomware
- SAGE Virus File — How to Decrypt & Remove Ransomware
- HELD Virus File — How to Decrypt & Remove Ransomware
- How to Remove and Decrypt Hlas Virus Files
- QUAL Virus File — How to Decrypt & Remove Ransomware
- SARUT Virus File — How to Decrypt & Remove Ransomware
- WATZ Virus File — How to Decrypt & Remove Ransomware
- WAQA Virus File — How to Decrypt & Remove Ransomware
- VEZA Virus File — How to Decrypt & Remove Ransomware
- PAAA Virus File — How to Decrypt & Remove Ransomware
- VEPI Virus File — How to Decrypt & Remove Ransomware
User Review
( votes)
German 
Japanese 
Spanish 
Portuguese (Brazil) 
French 
Turkish 
Chinese (Traditional) 
Korean 
Indonesian 
Hindi 
Italian
my pc is infected with budak ransomware i formatted my pc but when i look my 2nd hard drive its infected too,i downloaded grindsoft at stop decrypter but i cant decrypt any files the button is not highlighted it cant be click
I can recommend you to save the ID (use STOPDecrypter on the infected computer) and MAC addresses. Then make “Full scan” with GridinSoft Anti-Malware on infected system.
Next, backup all encrypted files via CryptoSearch (Link for download http://bit.ly/2JAvbyE)
If a solution will found in the future, You will able to decrypt your files even using another computer.
Don’t forget change all your passwords on infected PC! Read more why you need: https://howtofix.guide/azorult-spyware-comes-with-djvu-ransomware/.
I am infected with STOP DJVU, renaming all my files to .dotmap. Sad to say that the recommended decrypter is useless.
No keys were found for the following IDs: [*] ID: zWjJfBbOOI18hC5PG4UupND2E80pCXLmj6Y0Z2Y7 (.nasoh ) Please archive these IDs and the following MAC addresses in case of future decryption: [*] MACs: 50:46:5D:09:A8:A5 ————————————————-THIS IS WHAT SAY MY STOPdescrypter !! P.s – i have 1 original file too if it will help with something.. i sent to them and they descrypted this 1 file.. so i can send if need. NASOH <> inganebieradze@yahoo.com
I have been infected with the STOP Djvw ransomware. All my files are have the extension with ” hese “. I try the decryptor program but he din’d found the keys for decryption. Is there some solution for thisd decrypting this ? It Seems that this variant is a new one.
Hello Mark,
At 5 Nov 2019 Emsisoft Decryptor was updated with support: .gero, .hese, .seto, .peta, .moka, .meds, .kvag, .karl, .nesa, .noos, .kuub, .reco, .bora, .coot, .derp extensions.
You can find Decryptor here: https://howtofix.guide/how-to-decrypt-djvu-ransomware-files/
my pc is infected .meds plz elp
Try to use Emsisoft decryptor.
You can find it here: https://howtofix.guide/how-to-decrypt-djvu-ransomware-files/
Hello markos ,
Try to use this tool: https://howtofix.guide/how-to-decrypt-djvu-ransomware-files/
I am not able to decrypt using EMSISOFT and I have error: Unable to decrypt file with ID:Ajiv6q2E1FLmpED4mTjWuH1Dp1Gu4GT0g2YC3J
and All my files are have the extension with ‘.mosk ‘
Please, verify offline or online key do you have.
You will be able to recover files by the offline key when the private key for this variant will recovered.
I will write about the update here: https://howtofix.guide/how-to-decrypt-djvu-ransomware-files/
My computer is infected by djvu and all my files have turned into BOOT files i deleted the virus and the program that encrypts the files i believe its an online key my ID is :LXRjJXgcmUfZjVjSEuV15Z9ElHzCzLkMBrITaeLk I hope you can help me in the future since there is no helping me at this point of time i guess.
I have been infected with STOP .DERP ransomware. All my files have the extension with ” .derp“. Give me a decrypt software. thanks
My laptop was infected by the STOP Djvu. it has a .MOSK extension and from what i read above its new and it was infected by an online key.what i want now is a notification when a decrypter becomes available
My PC is intected by .peet i need your help, thanks
My ID:
0182Asd374y5iuhld52A0f2XklNeAVCJ9rtaE9n3cuVyitT8NIgGMtC3B
Error: Unable to decrypt file with ID: dN8zNEGUn6vNb1SCk4qoBdAltFLSqWD1Nl0cS6kY
This is what I get and I am infected with .grod
sir,
.peet virus accatck my laptop & it’s look my all file,
i used decrypt using EMSISOFT, but it’s not working, it’s show (decrypt error, skip file)
my parsonal id:- 0182Asd374y5iuhldLpxMtLqPqJub0VlnccDiAHlcfkq2ghCxKKBjtaMj
i need, .peet decrypt tools, please, sir help me.
my email:- djranarony4@gmail.com
My PC is is infected with Zobm – Ransomware
Is it there any tools how to decrypt .zobm ?
All my files are blocked.
Thanks a lot !
Hi, Did you find solution, I get infected with the same and can not descript the files. Thanks
Error: Unable to decrypt file with ID: e366ourl3OXCRQLmBMs7IyAMk8zXv7aAQne3jZib
I have the same error. did you solve it?
My PC is intected by .noos i need your help, thanks
My ID:
fnolkcepCAnpUwqrVBxbuTM173fPmvhVRYJlajMX
My PC is is infected with .GESD – Ransomware
Is it there any tools how to decrypt .GESD ?
All my files are blocked.
Thanks a lot !
Please help .. all my files encrypted with .gesd extension, emsisoft is unable to decrypt these files.
necesito ayuda, mis archivos están infectados por .ZOBM, formatee la maquina, y respalde mis archivos infectados en un disco duro, como y que puedo hacer para desinfectarlos…..
The ZOBM offline key was uploaded to the server. Try to decrypt.
Error: Unable to decrypt file with ID: esAuVPDINznnJdJcSJny7vFqhpPx0Y6dfeYg055X
mi pc esta infectada con ransomware .peet y mi id: XtD97AB7KMWNTHbHSpYOkdQfFPtUFqBJBIM2tTUY
alguna solucion?? muchas gracias
Please help… ransomware GROD.
Personal ID in the _readme.txt note and the C:\SystemID\PersonalID.txt file: 4TLM5qAxLgxdow9SRGNbjI0y1MkrjtsTam7eVlFF
My pc infected by .kodc tell me how to decrypt the files to back
My PC is infected with .kodc I have found key but what to do? Malwarebytes is useless against malware, spybot is efficient but ask for money…Help!
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-26O6Irjllx
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
gorentos@bitmessage.ch
Reserve e-mail address to contact us:
varasto@firemail.cc
Our Telegram account:
@datarestore
Your personal ID:
108bTddSKjbwIIeevgVMtalO66q9PVKGfAIw4zp8xpIiqFG0NS
My Files Infected with .nbes extension. A lot of trials done using Emsisoft Decryptor. The Filed is not decrypted. Please help me If any other tools available to Decrypt .nbes ransomware attacked filed.
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-7cpJN3gq4f
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
restoredatahelp@firemail.cc
Reserve e-mail address to contact us:
gorentos@bitmessage.ch
Your personal ID:
0181jYgs9f6s2dtHwFeNncD3A3Pk9nhqZPAqimosK9ycY00moh2R
No key for New Variant online ID: UAFLknMshpsJvvU4Q9TWd27sVXMX1va4SWlxklWH
Notice: this ID appears to be an online ID, decryption is impossible
Same problem with me..
No key for new variant online ID.
PLEASE help
hey my lap top got infected by .mzlq ransomware
is there any help can be done for now or we just wait?
i closed it and wont open it again till I find a solution
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-7m8Wr997Sf
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpdatarestore@firemail.cc
Reserve e-mail address to contact us:
helpmanager@mail.ch
Your personal ID:
0212Asd4a7d631oSTKQsgl8UKgyYbYTniP4ugHclMkMrAPabWelr
Hello sir, My laptop is infected by nlah ransomware virus. All files are encrypted with .nlah extension. I got really very much depressed to recover files. Please help me what should i do. How can i decrypt my data.
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-WJa63R98Ku
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpdatarestore@firemail.cc
Reserve e-mail address to contact us:
helpmanager@mail.ch
Your personal ID:
0205a7d6a8sdaW29dLJFzt0qdWDD3Bub9WoSKdEFLr7V3pXpbVuFq
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-qZxIk8SQDp
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Your personal ID:
0233yiuduy6S5dEsNWjQ9HCkg5hodCAHd3Mr1ZpSCpU19daYnMCzIf
Please find the decryption for the .repl virus. My computer is unfortunately infected. Please help
all my files encrypted with .kuus
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-UfvM0gtUDw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
restoremanager@airmail.cc
Your personal ID:
0241regyjnkjddrtqkSvTr9HpjK9kgMpQK9in46i8yDe6hC755Fx9mYd
ZIDA Extension files affected for all files
System ID is – 1amj2zyR32ZJGzVMFBDnjEzGw919euh4cEd5Aj65
Please help
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
helpdatarestore@firemail.cc
Your personal ID:
0219OIWojlj48ATH8pIhmNa2nDzlSPncFQmf15NMGh14jJtv9mAcC
Hallo my friends, any chance to help with *.geno files please?
They are asking to pay 490USD and SEND SCAN OF PERSONAL ID, which really …. me off and I write them, that case was recorded and submitted to local police department.
I back up all crypted data (its really a lof of critical data, I can not restore them, non of recovery software is working, I did not have external hdd as back up, nor window restore point.) I am literally in big problem, as there is zero way to get my data back. I tried like everything, but I have online ID… so.. . Is there any chance that in feature like 1 year or so, I will be able to decrypt it with your tool? thank you
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-ZLZ4pVnuS4
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
restoremanager@airmail.cc
Your personal ID:
0248Oowhu34MotlcrBeN3G9zW2diRtxnwz9A3CXPixZegSU7G4m
Any help, please? Thank you.
Hi, is it safe, to pay external company to decrypt it? on fb there is group ransomware virus and they offer me price 150 EUR and will surely decryt my files with .geno extensions. Is it fraud? Seems like a lot happy customers there (faked?). looks real.
ATTENTION!
Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-6tYZko8NMj
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
gorentos@bitmessage.ch
Reserve e-mail address to contact us:
gorentos2@firemail.cc
Your personal ID:
151hTdLhhGIeARKYGAhAbmhGFkCll5exREsRYvrfjSjVyo215h
Buenos días, mi pc se infectó con esos virus y mis archivos tiene la exension. efji he tratado de descrifrar con el descryptor pero sale error en casa archivo que quiere desencriptar. ayuda
I have got an online key, is there something I can do? Or I’ve lost all my data? (It renamed the files with “.mmpa”) Pls help😭😭😭
My pc is encrypted with .jdyi extension . Emsisoft decryptor is not working. It saying encrypted with online keys. Decryption not possible. Please help
looks like people with jdyi and other new online encrypted files will still have to wait some time. Its been 5 months and who knows, maybe we need to wait another 5 months.
My system was encrypted with “.vpsh” . I tried a decryption program but it didn’t work.
My files infected with REZUC ransomware. plz help me.
My file was encrypted with “.vvoa” . I tried a decryption Emsisoft Decryptor for STOP djvu but it didn’t work.
Error: No key for New Variant online ID: uiTdAla2HSJCFW65wriwFdB23WljXTdvez7p6XIb
please help me.
Any luck in decrypting “.agho” virus ransomware?
Any luck in decrypting “.sqpc” virus ransomware?
my PC infected by ransomware .sglh. Perhaps you can help me? tengkyu
Please help .. all my files encrypted with .hese extension, emsisoft is unable to decrypt these files.
can .weui be decripted? All my files have a .weui extension. i got an online id and i have been searching all night for the solution. i finally decided to shut down my pc and go to sleep although its 7:30 in the morning.
i am curious tho. if they send me the key, what program would i use to decript my files?
merhaba benım pc kodc uzantılı virus bulastı .çözüm bulundumu bu virüse
Hello, I found a virus with pc kodc extension. I found solution for this virus
ATTENTION!
Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-NPRyOqtXtl
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
restoremanager@airmail.cc
Your personal ID:
0275aSjeeJ9UN4oZZHYh9Rfj9tmuoG9YbHGgwwCGiXi2rDRMF
You wrote well and that the info I have read in many other sites while looking for a solution. Encryption keys used for my system are online. What is the update? How can I restore them? Any solution yet? The extension for my files is .coos.
I can rename and access only SOME of my media files.
Tệp của tôi đã được mã hóa bằng “.reqg”. Tôi đã thử giải mã Emsisoft Decryptor cho STOP djvu nhưng nó không hoạt động.
Lỗi: Không có khóa cho ID trực tuyến Biến thể mới: o6R9OCwUwLsTwIwRH5AMBTCQ0SVmLdcDnzfEbtXY,
vui lòng giúp tôi.
The key for REQG ransomware has not yet been received. Now available for decryption only: gero, hese, geno, seto, peta, moka, meds, kvag, domn, karl, nesa, noos, kuub, reco, bora, nols, werd, coot, derp, meka, toec, mosk, lokf, peet, grod, mbed, kodg, zobm, rote, msop, hets, righ, mkos, nbes, nosu, reha, topi, repp, alka, nppp, remk, npsk, opqz, mado, covm, usam, tabe, vawe, maas, nile, geno, omfl, sspq, iqll, ddsg.At the moment, the key for this ransomware has not yet been received. Now available for decryption only: gero, hese, geno, seto, peta, moka, meds, kvag, domn, karl, nesa, noos, kuub, reco, bora, nols, werd, coot, derp, meka, toec, mosk, lokf, peet, grod, mbed, kodg, zobm, rote, msop, hets, righ, mkos, nbes, nosu, reha, topi, repp, alka, nppp, remk, npsk, opqz, mado, covm, usam, tabe, vawe, maas, nile, geno, omfl, sspq, iqll, ddsg.
I have being suffering from nooa file extension virus. It is a online variant of virus. Used so, many encryption tool but cant get succeeded. Please provide solution as I had been suffering from 2 month.
The concerned had asked me for the money or bitcoin. I am not in place to do that since, it is huge amount for me.
Looking forward for your earliest response.
how decrypt files lqqw online id?
my id key is online
WXz4zxGOPXRmHCwHIiuzEDI7KD7VmAAGLbHbzDCD
file _readme.txt content
ATTENTION!
Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-VCW326HODa
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
manager@mailtemp.ch
Reserve e-mail address to contact us:
managerhelper@airmail.cc
Your personal ID:
0330gDrgoWXz4zxGOPXRmHCwHIiuzEDI7KD7VmAAGLbHbzDCD
MEUS ARQUIVOS FORAM INFECTADOS COM RANSOMWARE.ZAQI. VI VARIOS VIDEOS. FIZ VARIOS PROCEDIMENTOS E NENHUM RESULTADO POSITIVO. ALGUEM + COM ESSE MESMO PROBLEMA ?
Meu PC foi criptografado com “.rtgf”.
PersonalID.txt n3GWi7wRkHgP4gcuHrY6mwbVVUMvJK3J7jqHvepn
La extension “voom”
Ayuda: Puede recuperarse los archivos, cómo?
mon pc est infecté par l’extension .moqs que dois-je faire ?
My files have been infected with pohj extension. Please somebody can help?
I have been infected with the STOP Djvu ransomware. All my files are have the extension with ”.fate“. I try the decryptor program but It didn’t found the keys for decryption. Is there some solution for decrypting my files? It Seems that this variant is a new one.
Fui infectado com o ransomware ZATP. ID: CK2g4GfVxddYfc3KS8w19BXPXgRg8dNXZM4Ctvt3
anyone who can decrypt latest zpww online key
My PC is infected with .yzqe and is there a solution when it reports the key online. Its key is: 0819ASdwoSdBZkIigu9Heu06nvHQfsiPHxTTe2PPga3pONle. Please help me!
Help , my PC is infected with onlaine stos dijvu , and emsisoft can not decrypt it, my key is 0373UIhfSd8oJJVpn9NfbqjAqtvHKiaiOxFRcsHDEueNOghtGO
thanks a lot
my pc is infected .sijr plz help
My pc was infected back in October 23 with the variant of adww, is there any decrypion software that can decode this? Every file now has the adww as the extension this has online keys.
Can you help me, with the RANSOMWARE .QEZE