English
Arabic
The idea behind ransomware, a form of malicious software, is simple: Lock and encrypt a victim’s computer or device data, then demand a ransom to restore access.
In many cases, the victim must pay the cybercriminal within a set amount of time or risk losing access forever. And since malware attacks are often deployed by cyberthieves, paying the ransom doesn’t ensure access will be restored.
Ransomware holds your personal files hostage, keeping you from your documents, photos, and financial information. Those files are still on your computer, but the malware has encrypted your device, making the data stored on your computer or mobile device inaccessible.
While the idea behind ransomware may be simple, fighting back when you’re the victim of a malicious ransomware attack can be more complex. And if the attackers don’t give you the decryption key, you may be unable to regain access to your data or device.
Knowing the types of ransomware out there, along with some of the dos and don’ts surrounding these attacks, can go a long way toward helping protect yourself from becoming a victim of ransomware.
This topic is the primary support topic for assistance with STOP (DJVU) Ransomware. It includes an updated summary of this infection, it’s variants and possible decryption solutions with instructions.
Any files that are encrypted with older STOP (DJVU) Ransomware variants will have the
.STOP, .SUSPENDED, .WAITING, .PAUSA, .CONTACTUS, .DATASTOP, .STOPDATA, .KEYPASS, .WHY, .SAVEfiles, .DATAWAIT, .INFOWAIT, .puma, .pumax, .pumas, .shadow, .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur,.djvut .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promoks, .promorad,, promorad2, .kroput, .kroput1, .charck, .pulsar1, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden, .drume, .tronas, .trosak, .grovas, .grovat, .roland, .refols, .raldug, .etols, .guvara, .browec, .norvas, .moresa, .verasto, .hrosas, .kiratos, .todarius, .hofos, .roldat, .dutan, .sarut, .fedasot, .forasom, .berost, .fordan, .codnat, .codnat1, .bufas, .dotmap, .radman, .ferosas, .rectot, .skymap, .mogera, .rezuc, .stone, .redmat, .lanset, .davda, .poret, .pidon, .heroset, .myskle, .boston, .muslat, .gerosan, .vesad, .horon, .neras, .truke, .dalle, .lotep, .nusar, .litar, .besub, .cezor, .lokas, .godes, .budak, .vusad, .herad, .berosuce, .gehad, .gusau, .madek, .tocue, .darus, .lapoi, .todar, .dodoc, .bopador, .novasof, .ntuseg, .ndarod, .access, .format, .nelasod, .mogranos, .cosakos, .nvetud, .lotej, .kovasoh, .prandel, .zatrov, .masok, .brusaf, .londec, .krusop, .mtogas, .nasoh, .nacro, .pedro, .nuksus, .vesrato. .masodas, .stare, .cetori or .carote extension appended to the end of the encrypted data filename as explained here by Amigo-A (Andrew Ivanov).
Any files that are encrypted with newer STOP (DJVU) Ransomware variants after August 2019 will have the
.coharos, .shariz, .gero, .hese, .xoza, .seto, .peta, .moka, .meds, .kvag, .domn, .karl, .nesa, .boot, .noos, .kuub, .reco, .bora, .leto, .nols, .werd, .coot, .derp, .nakw, .meka, .toec, .mosk, .lokf, .peet, .grod, .mbed, .kodg, .zobm, .rote, .msop, .hets, .righ, .gesd, .merl, .mkos, .nbes, .piny, .redl, .nosu, .kodc, .reha, .topi, .npsg, .btos, .repp, .alka, .bboo, .rooe, .mmnn, .ooss, .mool, .nppp, .rezm, .lokd, .foop, .remk, .npsk, .opqz, .mado, .jope or .mpaj
extension appended to the end of the encrypted data filename as explained here by Amigo-A (Andrew Ivanov). With the release of the .gero variant, the malware developers have been consistent on using 4-letter extensions since switching to the New STOP Djvu variants.
STOP Ransomware will leave files (ransom notes) named !!!YourDataRestore!!!.txt, !!!RestoreProcess!!!.txt, !!!INFO_RESTORE!!!.txt, !!RESTORE!!!.txt, !!!!RESTORE_FILES!!!.txt, !!!DATA_RESTORE!!!.txt, !!!RESTORE_DATA!!!.txt, !!!KEYPASS_DECRYPTION_INFO!!!.txt, !!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!SAVE_FILES_INFO!!!.txt and !readme.txt. The .djvu* and newer variants will leave ransom notes named _openme.txt, _open_.txt or _readme.txt
***IMPORTANT: @ ALL VICTIMS….
STOP Djvu Ransomware has two versions.
1. Old Version: Most older extensions, starting with .djvu (v013) up to .carote (v154)…decryption for most of these versions was previously supported by STOPDecrypter ONLY if infected with an OFFLINE KEY. That same support has been incorporated into the new Emsisoft Decryptor/submission method for these old Djvu variants…the decrypter will only decrypt your files without submitting file pairs if you have an OFFLINE KEY.
2. New Version: The newest extensions released around the end of August 2019 AFTER the criminals made changes….this includes .coharos, .shariz, .gero, .hese, .xoza, .seto, peta, .moka, .meds, .kvag, .domm, .karl, .nesa, .boot, .etc. All of these new versions were never supported by STOPDecrypter. However, OFFLINE KEYS for some newer variants have been obtained by Emsisoft and uploaded to their server. This is possible after a victim pays the ransom, receives a key from the criminals and shares that key with the Emsisoft Team..ONLINE KEYS are UNIQUE for each victim…scroll down to see the update list under the section about online & offline key.
As a result of the changes made by the criminals, STOPDecrypter is no longer supported…it has been discontinued AND replaced with the Emsisoft Decryptor for STOP Djvu Ransomware developed by Emsisoft and Demonslay335 (Michael Gillespie).
WARNING NOTE: Please DO NOT use or share download links for decrypter_2.exe. This was the shoddy decrypter written by the criminals which victims were using as a LAST RESORT. With the release of Emsisoft’s decryptor. there is no need for victims to use this use this decrypter any more…the Emsisoft decryptor does everything it can do and more safely. All the download lin
ks for decrypter_2.exe have been removed and if anyone post
s a new download link, that too will be removed.
USING EMSISOFT DECRYPTOR FOR STOP DJVU RANSOMWARE:
Emsisoft Decryptor for STOP Djvu <- official authorized download link
