Ransomware Tutorials

How to decrypt DJVU Ransomware files? Emsisoft Decryptor

Written by Brendan Smith
Note!

You need to delete the malware from your PC first of all, otherwise, it will lock your device or cipher your data several times. In case your current anti-virus tool does not delete this malware, it can be deleted with the help of GridinSoft Anti-Malware.

In case your system was infected by means of the Windows Remote Desktop function, we also strongly advise that you change all the passwords of all available users that are permitted to log in on a remote basis and inspect the local user accounts for the availability of other extra accounts that the online frauds could possibly generate.

Warning: This application needs to be connected to the web while it is active in order to get the decryption guidelines from the server.

Updated 9 Nov 2019

Decryptor v.1.0.0.1 by Emsisoft currently can decrypt NEW Stop/Djvu variant with file extension:

.gero
.hese
.seto
.peta
.moka
.meds
.kvag
.karl
.nesa
.noos
.kuub
.reco
.bora
.coot
.derp

Terms: Files encrypted with OFFLINE KEY.

There are certain limitations regarding what files can be restored. Speaking of all versions of STOP Djvu, the information can be properly decrypted if they were ciphered by means of an offline key that is available with the developers of the Emsisoft Decryptor. As for Old Djvu, the files can be also decrypted by means of encrypted/original file pairs provided to the STOP Djvu Submission portal. Keep in mind that this is not applicable to New Djvu that was elaborated after August 2019.

What is a “file pair”?

This is pair of files that are identical (as in they are the precise same data), except one duplicate is encrypted and the other is not. STOP Djvu Submission portal can analyze the differences between an encrypted file and an original copy of the same file, allowing it to determine how to decrypt that file. For most victims with an older variant of STOP/Djvu, submitting file pairs will be the only way they will get their files back.

How to restore your files?

  1. Start downloading the decryption tool through the same website that developed this “How To” guide.
  2. Make sure to launch the decryption utility as an administrator. You need to agree with the license terms that will come up. For this purpose, click on the “Yes” button:Emsisoft Decryptor - license terms
  3. As soon as you accept the license terms, the main decryptor user interface comes up:Emsisoft Decryptor - user interface
  4. Based on the default settings, the decryptor will automatically populate the available locations in order to decrypt the currently available drives (the connected ones), including the network drives. Extra (optional) locations can be selected with the help of the “Add” button.
  5. Decryptors normally suggest several options considering the specific malware family. The currently possible options are presented in the Options tab and can be activated or deactivated there. You may locate a detailed list of the currently active Options below.
  6. As soon as yo add all the desired locations for decryption into the list, click on the “Decrypt” button in order to initiate the decryption procedure. Note that the main screen may turn you to a status view, letting you know of the active process and the decryption statistics of your data:Emsisoft Decryptor - the decryption statistics
  7. The decryptor will notify you as soon as the decryption procedure is completed. If you need the report for your personal papers, you can save it by choosing the “Save log” button. Note that it is also possible to copy it directly to your clipboard and to paste it into emails or forum messages if you need to do so.

DJVU Decryptor options

The decryptor at this moment performs the following options:

  • Keep encrypted files
    Considering the fact that the ransomware does not store any data regarding the unencrypted documents, the decryptor does not guarantee that the decrypted file will be identical to the one that was initially encrypted. Hence, the decryptor, based on the default settings, will for safety reasons not delete any encrypted documents after they have been decrypted. In case you would like the decryptor to delete any ciphered documents once they have been decrypted, it is possible to deactivate this feature. Note that this may be applicable if the space on your hard drive is limited.
Sending
User Review
4.6 (5 votes)
Comments Rating 5 (2 reviews)

About the author

Brendan Smith

Journalist, researcher, web content developer, grant proposal editor. Efficient and proficient on multiple platforms and in diverse media. Computer technology and security are my specialties.

13 Comments

  1. toshi November 10, 2019
  2. pradeep bebarta November 11, 2019
  3. Morezz November 12, 2019
    • Vincci November 12, 2019
  4. RIFQI November 13, 2019
  5. Ilman November 13, 2019
  6. Isabella November 15, 2019
  7. hedi November 15, 2019
  8. Efrain November 15, 2019
  9. key November 16, 2019
  10. ilterish yasin November 16, 2019
  11. Ashutosh Buyre November 17, 2019
    • Rano November 19, 2019

Leave a Reply

Sending

This site uses Akismet to reduce spam. Learn how your comment data is processed.