How to remove STOP Ransomware and decrypt .kodg, .mbed, .grod or .peet files
STOP Ransomware is an elaborate encryptor virus, that encrypts user's files and makes them inaccessible. Malware uses unbreakable AES (Salsa20) encryption algorithm and decryption is only possible in 2-3% of cases. Recent versions of STOP (DJVU) Ransomware add suffixes or extensions: .kodg, .mbed, .grod or .peet. Сorresponding virus variations received names: Kodg Ransomware, Mbed Ransomware, Grod Ransomware and Peet Ransomware. STOP Ransomware utilizes similar techniques through all versions: it encrypts files, adds a new extension to them and places a ransom note on the infected machine (it demands $490, and if not paid within 72 hours amount doubles to $980). As a rule, the virus does not affect essential system files and encrypts only data that can be potentially valuable for users: videos, photos, documents, local e-mails, archives. The good news is, that Emsisoft (antivirus vendor) released special utilities called Emsisoft Decryptor for STOP Djvu and Emsisoft Decryptor for STOP Puma, that can decrypt near 150 variations of the threat. In some cases, you will need a pair of the original and encrypted files, in most cases, data can be restored only if an offline key was used by malware (this happens due to malfunction or internet connection loss during the encryption process).
How to remove Phobos Ransomware and decrypt .adame, .caley, .caleb or .octopus files
Phobos Ransomware is a virus, that encrypts user files using AES encryption algorithm and demands ~$3000 for decryption. Ransomware adds .phobos, .mamba, .phoenix, .actin, .actor, .blend, .adage .acton, .com, .adame, .acute, .karlos or .Frendi extensions to encoded files and makes them inaccessible. In order to confuse users and researchers Phobos Ransomware uses file-modification patterns and ransom notes similar to very wide-spread Dharma Ransomware. Especially after design change in January 2019, when they started to look like identically. However, there are certain differences in file-markers and appearance. After contacting the developers via one of the provided e-mails, they demand $3000 in BitCoins for decryption to be paid in 6 hours. Otherwise, the cost of decryption will increase up to $5000. At the moment automated decryptors for Phobos Ransomware do not exist. There is no proof, that malefactors send decryptors to the victims, that is why we do not recommend paying the ransom. Instead, try using instructions on this page to recover encrypted files. File-recovery software can restore some files from your hard-drive.
How to remove STOP Ransomware and decrypt .mosk, .lokf, .meka or .toec files
STOP Ransomware is a sophisticated encryption virus, that uses the Salsa20 algorithm to encode sensitive personal data, such as photos, videos, and documents. The latest appeared versions in November add .mosk, .lokf, .meka or .toec extensions to files and make them unreadable. To date, the family includes about 180 representatives, and the total number of affected users is approaching a million. Most of the attacks are in Europe and South America, India and Southeast Asia. The threat also affected the United States, Australia, and South Africa. Although the STOP virus is less known than GandCrab, Dharma, and other ransomware trojans, it is this year that accounts for more than half of the detected attacks. Moreover, the next rating participant, the aforementioned Dharma, lags behind him by this indicator by more than four times.
How to remove Paradise Ransomware and decrypt .paradise, .2ksys19, .p3rf0rm4 or .FC files
Paradise Ransomware is file-encryption virus, that encrypts user's files using RSA-1024 encryption algorithm. Latest versions of this threat append .VACv2, .CORP or .xyz extensions. Previously, Paradise Ransomware used .paradise, .sell, .ransom, .logger, .prt and .b29. Among all variations, only last one can be decrypted. Ransomware has many similarities with Dharma Ransomware, as it has very look-a-like design and uses similar patterns for file modifications. Authors of the virus offer e-mail to contact them for decryption negotiation: admin@prt-decrypt.xyz. They demand several thousand dollars for decryption, that have to be paid in BitCoins. It is also stated, that 1-3 useless files can be decrypted for free as a prove, that decryption is possible. However, malefactors cannot be trusted. Instead, we recommend you to try instructions below to restore files encrypted by Paradise Ransomware.
How to remove STOP Ransomware and decrypt .derp, .nakw, .coot or .nols files
STOP Ransomware (a.k.a Djvu Ransomware) encrypts victim's files with Salsa20 (stream encryption system) and appends one of the hundreds of possible extensions including latest discovered .derp, .nakw, .coot or .nols. STOP is one of the most active ransomware today, but they hardly talk about it. The prevalence of STOP is also confirmed by the extremely active forum thread on Bleeping Computer, where victims seek help. The fact is that this malware attacks mainly fans of pirated content, visitors to suspicious sites and is distributed as part of advertising bundles. There is a possibility for successful decryption, however, to date, there are more than 174 STOP variants that are known to researchers, and such a variety significantly complicates the situation.
How to remove Muhstik (QNAPCrypt) Ransomware and decrypt .muhstik files
Muhstik Ransomware is nasty cipher virus, that encrypts user data on QNAP NAS network drives using AES-256 (CBC mode) + SHA256 algorithms, and then requires a ransom of 0.045 - 0.09 BTC (currently ~$700) to return the files. According to researchers, this program is not directly related to eCh0raix Ransomware, although there is a certain external similarity. After finishing encryption procedure, malware adds .muhstik extension to affected files. The malware first checks the system language and does not start encryption on systems with Russian, Belorus or Ukranian languages. At the moment, there is a public decryption tool called EmsiSoft Decrypter for Muhstik available. It is able to decrypt files encrypted by most versions of this virus. If it is unable to recover the data, full recovery is only possible with the help of backups.
