levskyy Posted July 13, 2021 ID:1469099 Share Posted July 13, 2021 Hello, my friend downloaded virus and it changed all files extension to ufwj. I downloaded malwarebytes and removed all viruses but files is still the same. I know its ransomware and tried decrypting it but with no luck. Can you help me with file decryption of these files, is this even possible? Here is Personal ID: S8V466xXgqfeKHDu5mJO0w6gZ6i8w4oouiFHwPcZ Can't upload file on forum so here is example file (in zip) https://we.tl/t-sjBVbq0mZl Link to post Share on other sites More sharing options...
Porthos Posted July 13, 2021 ID:1469101 Share Posted July 13, 2021 I would suggest you review the following site as well. They are the ransomware experts. Ransomware Help & Tech Support at Bleeping Computerhttps://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/ Thank you Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 13, 2021 ID:1469144 Share Posted July 13, 2021 @levskyy Some added remarks & information. I am sorry to read of anyone getting victimized by any encrypting ransomware. Malwarebytes has NO decryptor. New variants of the STOP/djvu ransomware family ( plus, other ransomware) keep being generated all the time. There are no known cures to fix files, documents, other files encrypted. ( except for some selected OLD generations ) The best way to recover is from Backups made from before the incident. Backup is your best friend. As far as "removing" the ransomware ....most all ransomwares delete themselves once they have done their deed. Q: Did your friend very recently download some sort of "freebie" thing and then open that file ? if so, what was it ? where from ? Q: Does your friend have a offline backup of your system ? I would suggest to study resources at BleepingComputer about ransomwares. That forum is a community storehouse of current information. STOP Ransomware (.STOP, .Puma, .Djvu, .Promo, .Drume) Help & Support Topic - Ransomware Help & Tech Support (bleepingcomputer.com) Link to post Share on other sites More sharing options...
levskyy Posted July 13, 2021 Author ID:1469180 Share Posted July 13, 2021 2 hours ago, Maurice Naggar said: @levskyy Some added remarks & information. I am sorry to read of anyone getting victimized by any encrypting ransomware. Malwarebytes has NO decryptor. New variants of the STOP/djvu ransomware family ( plus, other ransomware) keep being generated all the time. There are no known cures to fix files, documents, other files encrypted. ( except for some selected OLD generations ) The best way to recover is from Backups made from before the incident. Backup is your best friend. As far as "removing" the ransomware ....most all ransomwares delete themselves once they have done their deed. Q: Did your friend very recently download some sort of "freebie" thing and then open that file ? if so, what was it ? where from ? Q: Does your friend have a offline backup of your system ? I would suggest to study resources at BleepingComputer about ransomwares. That forum is a community storehouse of current information. STOP Ransomware (.STOP, .Puma, .Djvu, .Promo, .Drume) Help & Support Topic - Ransomware Help & Tech Support (bleepingcomputer.com) Yes, i connected with im on teamviewer and he showed me some websties where he downloaded files. One of these was definitly suspicious. He have some files on external drive so we done a format and thats end of story. Maybe this will teach him that 95% of "free premium" is virus. Thanks for help guys :) Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 14, 2021 ID:1469258 Share Posted July 14, 2021 Pass on to your friend these safety tips on this link Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 14, 2021 ID:1469259 Share Posted July 14, 2021 Since this issue is resolved the topic will now be closed to prevent others from posting here. If you need assistance please start your own new topic and someone will be happy to assist you. Thanks Link to post Share on other sites More sharing options...
Recommended Posts