How to remove STOP Ransomware and decrypt .KEYPASS, .WHY or .SAVEfiles files

Standard

In this article we descrbe third generation of STOP Ransomware, previous two versions were described by our team earlier. This variation was actively spreaded in August and September, 2018. Virus already attacked users from 25 countries including Brazil, Chile, Vietnam, USA, United Arab Emirates, Egypt, Algeria, Indonesia, India, Iran, Poland, Belarus, Ukraine. This variation uses uses symmetric and asymmetric cryptography and adds .KEYPASS, .WHY or .SAVEfiles extensions to the files after encryption. Intruders demand $300 ransom for decryption. They offer to decrypt up to 3 random files for free, to prove that decryption is possible. Hackers also warn, that if amount is not paid within 72 hours data restoration will be impossible.

How to remove STOP Ransomware and decrypt .PAUSA, .CONTACTUS, .DATASTOP or .STOPDATA files

Standard

Updated version of STOP Ransomware ransomware appends .PAUSA, .CONTACTUS, .DATASTOP or .STOPDATA suffixes to encrypted files. Virus still uses RSA-1024 encryption algorithm. All versions, except .STOPDATA, demand $600 ransom in BTC (BitCoin cryptocurrency), last one offers decryption for $200. Still malefactors offer to decrypt from 1 to 3 files for free to prove, that decryption is possible. This can be used to attempt decoding in future. At the moment, unfortunately, the only way to restore your files is from backups.

How to remove STOP Ransomware and decrypt .STOP, .SUSPENDED or .WAITING files

Standard

STOP Ransomware is dangerous file-encrypting virus. It uses AES/RSA-1024 encryption algorithm. Depending on version, ransomware adds .STOP, .SUSPENDED or .WAITING extensions to encrypted files. First variant of STOP Ransomware creates !!!YourDataRestore!!!.txt files, second !!!RestoreProcess!!!.txt, third !!!INFO_RESTORE!!!.txt. In this files, malware demands $600 ransom, that has to be paid in 72 hours, in BitCoins. It also contains user personal id and e-mail addresses for contacting.

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close