Tutorials Archives | BugsFighter

STOP Ransomware (aliases: DJVU Ransomware, Dalle Ransomware, Lotep Ransomware) is extremely dangerous file-encrypting virus, that extorts money in exchange for decrypter. Ransomware utilizes strong AES-256 encryption algorithm and makes files unusable without decryption master key. Particular malware in this review appends .dalle or .lotep extensions to files. As a result file example.jpg converts to example.jpg.dalle or example.jpg.lotep. STOP Ransomware creates special text file, that is called _readme.txt, where hackers give contact details, overall information about encryption and options for decryption. Threat places it on the desktop and in the folders with encrypted files. In most cases, STOP Ransomware decrypts files of each victim wit unique key, however, sometimes when computer is not connected to internet (or lost connection) or hacker’s server is not responding malware creates “offline key”. In this situation, utility called STOPDecrypter, developeped by Michael Gillespie may be able to decode your data for free.

June 21, 2019 James Kramer 0

How to remove STOP Ransomware and decrypt .vesad, .truke, .neras or .horon files

Standard

Recently, experts have observed the epidemic of the virus STOP Ransomware (also known as DJVU Ransomware). It is encryption virus, that uses strong AES-256 encryption algorithm to encrypt user files and makes them unavailable for the uses without decryption key. Latest versions of this pest add .vesad, .truke, .neras or .horon extensions to affected files. STOP Ransomware creates special text file, that is called “ransom note” and named _readme.txt. In this text file, malefactors provide contact details, overall information about encryption and options for decryption. Virus copies it on the desktop and in the folders with encrypted files.

June 12, 2019 James Kramer 0

How to remove Dharma-Html Ransomware and decrypt .html files

Standard

Dharma-Html Ransomware is one of the types of encryption viruses based on the code of the family of Crysis-Dharma-Cezar ransomware. Version, that is under review today has certain differences. It adds .html extension to encrypted files and uses other e-mail addresses for communication. Dharma-Html Ransomware, as well as other latest Dharma variations, doesn’t have decryptor, that can automatically decrypt encoded data. However, using instructions below can help you recover some files. Dharma-Html Ransomware creates suffix, that consists of several parts: prefix “id-“, identification number (alphanumeric and unique for each computer), developer’s e-mail address and .html extension. The pattern of the filename after encryption looks like this: file called 1.doc will be converted to 1.doc.id-{8-digit-id}.[{email-address}].html.

June 11, 2019 James Kramer 0

How to remove STOP Ransomware and decrypt .myskle, .gerosan, .muslat or .boston files

Standard

If your files recently got .myskle, .gerosan, .muslat or .boston extensions, that means your PC is infected with encryption virus called STOP Ransomware (alternative name is DJVU Ransomware, because first versions of virus of this type appended .djvu extension). This is very wide-spread and actively distributed malware. Ransomware initially used AES-256 encryption algorithm, and there was no way for decryption. However, if during encryption process infected PC was out of internet, or connection with remote server of hackers was interrupted your files can be decrypted using methods provided below. STOP Ransomware has a ransom note called _readme.txt. In this text file malefactors give contact information and details on how to make a payment. Virus copies it on the desktop and in the folders with encrypted files.

June 8, 2019 James Kramer 0

How to remove Jamper (Jumper) Ransomware and decrypt .jamper, .jumper or .SONIC files

Standard

Jamper Ransomware is a nasty file-encryption virus, that uses AES algorithm to encrypt your files and extorts a ransom of 1 to 3 BTC (Bitcoins). This malware is the successor of VegaLocker (Vega Ransomware) and predecessor of Buran Ransomware. Jamper Ransomware, depending on the version, may add .jamper, .jumper or .SONIC extensions to files it affects. After ransomware activity, your files become inaccessible and unreadable. Malware creates ransom note file called —README—.TXT after it finishes. Jamper Ransomware removes shadow copies of files (VSS), disables recovery features of Windows, which makes it difficult to recover encrypted files.