My pc just got into a big problem all the file are changed their type to .verasto. I don't know how to get it back please help me, guy. I'm begging you. Please
2
-
2If they files are encrypted the only way other than decryption is a restore– RamhoundAug 20, 2019 at 12:35
-
2Possible duplicate of How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?– MoabAug 20, 2019 at 17:48
Add a comment
|
1 Answer
Before answering any of this, this question should belong to https://security.stackexchange.com
You have been visited by a ransomware known as STOP, to be specific, the DJVU variant (dejavu anyone)
STOP is a ransomware by some group known as "gorentos". In case of your DJVU variant, there are also other encrypted extensions like
djvuu, uudjvu, blower, tfudet, promok, djvut, djvur, klope, charcl, doples, luces,
luceq, chech, proden, drume, tronas, trosak, grovas, grovat, roland, refols,
raldug, etols, guvara, browec, norvas, moresa, verasto, hrosas, kiratos, todarius,
hofos, roldat, dutan, sarut, fedasot, forasom, berost, fordan, codnat, codnat1,
bufas, dotmap, radman, ferosas, rectot, skymap, mogera, rezuc, stone, redmat,
lanset, davda, poret, pidon, heroset, myskle, boston, muslat, gerosan, vesad,
horon, neras, truke, dalle, lotep, nusar, litar, besub, cezor, lokas, godes, budak,
vusad, herad, berosuce, gehad, gusau, madek, tocue, darus, lapoi, todar, dodoc,
novasof, bopador, ntuseg, ndarod, access, format, nelasod, mogranos, nvetud,
cosakos, kovasoh, lotej, prandel, zatrov, masok, brusaf, londec, kropun, londec
Source: https://howtofix.guide/about-djvu-stop-ransomware/?cn-reloaded=1
However, you can easily solve this by downloading a certain Decrypter by Micheal Gillespie. It's free, but the downside is that you gotta provide an encrypted version of the file and a decrypted version in order to let it figure out the decryption key. After you run the program as administrator from desktop, be sure to never visit api.2ip.ua or morgem.ru ever again.
It's not really that bad even if you do not have a file pair. DJVU STOP only encrypts an approximate 5 MB of a file, and the rest of it is still readable, so not all of your data is lost.
Edit:
There's actually no way that...
You get yourself in a situation where you don't have a pair!
Yep! You heard me right. According to https://howtofix.guide/about-djvu-stop-ransomware , the _readme file says:
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
A while later in the _readme file:
To get this software you need write on our e-mail:
[email protected]
Reserve e-mail address to contact us:
[email protected]
Our Telegram Account(note from Aaron:what is that?):
@datarestore
Your personal ID:(note from Aaron:this is your own ID, unique for you in the _readme file)
So, find that _readme file, get an encrypted file with no sensitive information, and email it to [email protected] or [email protected] with that personal ID!