Tutorials

STOP Ransomware is devastating crypto-virus, that uses AES-256 asymmetrical encryption algorithm to restrict user access to their files without the key. Malware appends .meds, .kvag, .moka or .peta extensions to files, makes them unreadable and extorts ransom for decryption. Unfortunately, due to technical modifications in the newest version file recovery is impossible without backups. However, there are certain standard Windows features and tools, that may help you restore at least some files. File-recovery software may also be useful in this case. In the text box below, there is text message from _readme.txt file, called "ransom note". Even if you can afford the price of the decryption, there is no purpose to pay the ransom. Hackers rarely respond to victims and there is no method to track the payment as they use cryptocurrency, TOR-network websites and e-mails, and anonymous electronic wallets. There is a tool called STOPDecrypter, that was able to retrieve the key for older versions of STOP Ransomware. But according to its developers, it is practically useless against .meds, .kvag, .moka or .peta files.

Since September 2019, the criminals have modified the malware code in newer versions. Now they are using asymmetrical encryption and decryption with old proven methods is temporarily impossible. The article will be updated with an effective decryption guide once it appears. Currently, there are certain chances to recover your files using instructions below. If your files became unavailable, got weird icons and got either .seto, .shariz, .gero or .geno extension, that means your computer got hit by STOP Ransomware. This is extremely dangerous and harmful encryption virus, that encodes data on victim's computers and extorts ransom equivalent of $490/$960 in cryptocurrency to be paid on an anonymous electronic wallet. If you didn't have backups before the infection, there are only a few ways to return your files with a low probability of success. However, they are worth trying and we describe them all in the following article. In the text box below, you can get acquainted with the contents of _readme.txt file, that is called "ransom note" among security specialists and serves as one of the symptoms of infection.

STOP Ransomware is a plague of 2019, tenacious virus based on encryption technology. Ransomware uses the AES encryption algorithm to encode important files and extorts a ransom in BitCoins for decryption. This malware aims western countries mostly, but there've been thousands of infections detected in other parts of the world. STOP Ransomware uses the same patterns but adds different extensions to modify the files. For example, version that we observe today appends .carote, .hese, .stare or .cetori extensions. The crypto-virus affects the user's valuable data: photos, videos, documents, it takes hostage potentially important files. Malefactors demand $980 for the decryption tool. The are mockingly offer a 50% discount if users pay fast. There is no reason to trust the developers of computer viruses. In the entire history of the activity of STOP Ransomware, there were no cases, when they sent decryption tool to the people who paid. On the contrary, there are chances to return the files using instructions and tools featured in this article. For example, computer security enthusiasts developed STOPDecrypter, that can help in 5-10% of cases. Full decryption is the only possible if there your computer or ransomware servers were offline during the process of encryption.

The epidemy of STOP Ransomware still goes on. This nasty virus hits thousands of computers all over the world, mostly targeting USA, Europe and Australia. The most recent version uses .vesrato, .masodas, .nuksus or .pedro extensions, that it adds to the end of encrypted files. As DJVU Ransomware uses AES encryption algorithm, probability of decryption is low, but exists. STOP Ransomware damages user's important data: photos, videos, documents and other types of information, victims are ready to pay ransom for. At the same time, it doesn't touch system files to keep Windows operable. Latest generation of this virus creates ransom note file called _readme.txt. The ransom note is typical. Malefactors let victims get acquainted with the conditions and price of the ransom, which is $980 and disclose e-mail addresses for contact gorentos@bitmessage.ch and gorentos2@firemail.cc. Although, developers affirm, that there is not possible to recover files without paying the ransom, the objective situation is different. The virus code has bugs, that allows security specialists to retrieve the key in some cases. Particularly, if the PC is disconnected from the web during encryption process, or hackers servers are unavailable - STOP Ransomware generates an offline key. This key, can be found with special decryption tool called STOPDecrypter. Below we provide you with download links and instruction to use this utility.

New wave of STOP Ransomware infection continues with .nacro, .mtogas, .coharos and .nasoh variations. Those extensions are added to encrypted files in the middle of August of 2019. This tricky virus uses AES encryption algorithm to encode user's important information. As a rule, STOP Ransomware attacks photos, videos and documents - data, that people value. The malware developers extort ransom and promise to provide decryption key in return. In the ransom note, we can see, that malefactors demand $980 (amount can be reduced if paid within the first 72 hours). Hackers offer victims to contact them via e-mails: gorentos@bitmessage.ch and gorentos2@firemail.cc. In most cases algorithms of STOP Ransomware are unbreakable. But virus code has its flaws. Particularly, if attacked PC lost internet connection during ransomware activity or hackers servers experienced some sort of malfunction, there are high chances to recover your files. In this case, STOP Ransomware generates an offline key, that can be retrieved by special decryption tool - STOPDecrypter.