My pc just got into a big problem all the file are changed their type to .verasto. I don't know how to get it back please help me, guy. I'm begging you. Please
Before answering any of this, this question should belong to https://security.stackexchange.com
You have been visited by a ransomware known as STOP, to be specific, the DJVU variant
STOP is a ransomware by some group known as "gorentos". In case of your DJVU variant, there are also other encrypted extensions like
djvuu, uudjvu, blower, tfudet, promok, djvut, djvur, klope, charcl, doples, luces, luceq, chech, proden, drume, tronas, trosak, grovas, grovat, roland, refols, raldug, etols, guvara, browec, norvas, moresa, verasto, hrosas, kiratos, todarius, hofos, roldat, dutan, sarut, fedasot, forasom, berost, fordan, codnat, codnat1, bufas, dotmap, radman, ferosas, rectot, skymap, mogera, rezuc, stone, redmat, lanset, davda, poret, pidon, heroset, myskle, boston, muslat, gerosan, vesad, horon, neras, truke, dalle, lotep, nusar, litar, besub, cezor, lokas, godes, budak, vusad, herad, berosuce, gehad, gusau, madek, tocue, darus, lapoi, todar, dodoc, novasof, bopador, ntuseg, ndarod, access, format, nelasod, mogranos, nvetud, cosakos, kovasoh, lotej, prandel, zatrov, masok, brusaf, londec, kropun, londec Source: https://howtofix.guide/about-djvu-stop-ransomware/?cn-reloaded=1
However, you can easily solve this by downloading a certain Decrypter by Micheal Gillespie. It's free, but the downside is that you gotta provide an encrypted version of the file and a decrypted version in order to let it figure out the decryption key. After you run the program as administrator from desktop, be sure to never visit
morgem.ru ever again.
It's not really that bad even if you do not have a file pair. DJVU STOP only encrypts an approximate 5 MB of a file, and the rest of it is still readable, so not all of your data is lost.
There's actually no way that...
You get yourself in a situation where you don't have a pair!
Yep! You heard me right. According to https://howtofix.guide/about-djvu-stop-ransomware , the
_readme file says:
You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information.
A while later in the
To get this software you need write on our e-mail: firstname.lastname@example.org Reserve e-mail address to contact us: email@example.com Our Telegram Account(note from Aaron:what is that?): @datarestore Your personal ID:(note from Aaron:this is your own ID, unique for you in the _readme file)
So, find that
_readme file, get an encrypted file with no sensitive information, and email it to
firstname.lastname@example.org with that personal ID!