Tutorials Archives | BugsFighter

Recently, experts have observed the epidemic of the virus STOP Ransomware (also known as DJVU Ransomware). It is encryption virus, that uses strong AES-256 encryption algorithm to encrypt user files and makes them unavailable for the uses without decryption key. Latest versions of this pest add .vesad or .horon extensions to affected files. STOP Ransomware creates special text file, that is called “ransom note” and named _readme.txt. In this text file, malefactors provide contact details, overall information about encryption and options for decryption. Virus copies it on the desktop and in the folders with encrypted files.

June 12, 2019 James Kramer 0

How to remove Dharma-Html Ransomware and decrypt .html files

Standard

Dharma-Html Ransomware is one of the types of encryption viruses based on the code of the family of Crysis-Dharma-Cezar ransomware. Version, that is under review today has certain differences. It adds .html extension to encrypted files and uses other e-mail addresses for communication. Dharma-Html Ransomware, as well as other latest Dharma variations, doesn’t have decryptor, that can automatically decrypt encoded data. However, using instructions below can help you recover some files. Dharma-Html Ransomware creates suffix, that consists of several parts: prefix “id-“, identification number (alphanumeric and unique for each computer), developer’s e-mail address and .html extension. The pattern of the filename after encryption looks like this: file called 1.doc will be converted to 1.doc.id-{8-digit-id}.[{email-address}].html.

June 11, 2019 James Kramer 0

How to remove STOP Ransomware and decrypt .myskle, .gerosan, .muslat or .boston files

Standard

If your files recently got .myskle, .gerosan, .muslat or .boston extensions, that means your PC is infected with encryption virus called STOP Ransomware (alternative name is DJVU Ransomware, because first versions of virus of this type appended .djvu extension). This is very wide-spread and actively distributed malware. Ransomware initially used AES-256 encryption algorithm, and there was no way for decryption. However, if during encryption process infected PC was out of internet, or connection with remote server of hackers was interrupted your files can be decrypted using methods provided below. STOP Ransomware has a ransom note called _readme.txt. In this text file malefactors give contact information and details on how to make a payment. Virus copies it on the desktop and in the folders with encrypted files.

June 8, 2019 James Kramer 0

How to remove Jamper (Jumper) Ransomware and decrypt .jamper, .jumper or .SONIC files

Standard

Jamper Ransomware is a nasty file-encryption virus, that uses AES algorithm to encrypt your files and extorts a ransom of 1 to 3 BTC (Bitcoins). This malware is the successor of VegaLocker (Vega Ransomware) and predecessor of Buran Ransomware. Jamper Ransomware, depending on the version, may add .jamper, .jumper or .SONIC extensions to files it affects. After ransomware activity, your files become inaccessible and unreadable. Malware creates ransom note file called —README—.TXT after it finishes. Jamper Ransomware removes shadow copies of files (VSS), disables recovery features of Windows, which makes it difficult to recover encrypted files.

June 7, 2019 James Kramer 0

How to remove Buran Ransomware and decrypt your files

Standard

Buran Ransomware is harmful crypto-virus, that uses AES encryption algorithm to encode your files and demands ransom in BTC (Bitcoins) afterwards. Technically, it is successor of VegaLocker (Vega Ransomware) and Jamper (Jumper) Ransomware. Buran Ransomware adds complex extension to affected files and uses special template: randomly generated 8-4-4-4-12 letters alphanumerical sequence. For example: .1C81A230-7B5F-4AE4-6F71-EB3958F83XXX, .62E93854-821C-3F0E-7556-D0F4F2E6E1C2. Files become inaccessible and unreadable. After successful encryption virus creates ransom note file: !!! YOUR FILES ARE ENCRYPTED !!!.TXT. Tips and tricks featured on this page will help you to recover at least some of the files encrypted by Buran Ransomware.