-2

My pc just got into a big problem all the file are changed their type to .verasto. I don't know how to get it back please help me, guy. I'm begging you. Please

migrated from rpg.stackexchange.com Aug 20 at 12:17

This question came from our site for gamemasters and players of tabletop, paper-and-pencil role-playing games.

1

Before answering any of this, this question should belong to https://security.stackexchange.com

You have been visited by a ransomware known as STOP, to be specific, the DJVU variant (dejavu anyone)

STOP is a ransomware by some group known as "gorentos". In case of your DJVU variant, there are also other encrypted extensions like

djvuu, uudjvu, blower, tfudet, promok, djvut, djvur, klope, charcl, doples, luces,
luceq, chech, proden, drume, tronas, trosak, grovas, grovat, roland, refols, 
raldug, etols, guvara, browec, norvas, moresa, verasto, hrosas, kiratos, todarius, 
hofos, roldat, dutan, sarut, fedasot, forasom, berost, fordan, codnat, codnat1, 
bufas, dotmap, radman, ferosas, rectot, skymap, mogera, rezuc, stone, redmat, 
lanset, davda, poret, pidon, heroset, myskle, boston, muslat, gerosan, vesad, 
horon, neras, truke, dalle, lotep, nusar, litar, besub, cezor, lokas, godes, budak, 
vusad, herad, berosuce, gehad, gusau, madek, tocue, darus, lapoi, todar, dodoc, 
novasof, bopador, ntuseg, ndarod, access, format, nelasod, mogranos, nvetud, 
cosakos, kovasoh, lotej, prandel, zatrov, masok, brusaf, londec, kropun, londec

Source: https://howtofix.guide/about-djvu-stop-ransomware/?cn-reloaded=1

However, you can easily solve this by downloading a certain Decrypter by Micheal Gillespie. It's free, but the downside is that you gotta provide an encrypted version of the file and a decrypted version in order to let it figure out the decryption key. After you run the program as administrator from desktop, be sure to never visit api.2ip.ua or morgem.ru ever again.

It's not really that bad even if you do not have a file pair. DJVU STOP only encrypts an approximate 5 MB of a file, and the rest of it is still readable, so not all of your data is lost.

Edit:

There's actually no way that...

You get yourself in a situation where you don't have a pair!

Yep! You heard me right. According to https://howtofix.guide/about-djvu-stop-ransomware , the _readme file says:

You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.

A while later in the _readme file:

To get this software you need write on our e-mail:
gorentos@bitmessage.ch

Reserve e-mail address to contact us:
gorentos@firemail.cc

Our Telegram Account(note from Aaron:what is that?):
@datarestore

Your personal ID:(note from Aaron:this is your own ID, unique for you in the _readme file)

So, find that _readme file, get an encrypted file with no sensitive information, and email it to gorentos@bitmessage.ch or gorentos@firemail.cc with that personal ID!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy