Stop/Djvu ransomware: file decryptor and virus removal

A new ransomware iteration is out that blemishes filenames with the .djvu or .djvuu extension, so read this tutorial to learn how to recover from this attack.

1. What is .djvu ransomware?
2. Djvu ransomware automated removal and data recovery
3. Djvu ransomware manual removal and file recovery
4. Ransomware Prevention Tips
5. FAQ

[October 2021 update]

What is Djvu (aka Stop) ransomware?

Whereas there are several different forms of Internet-borne extortion, ransomware is definitely at the forefront of this cybercrime area. Furthermore, most of the alternative blackmail techniques revolve around bluff, where the crooks dupe victims into believing some sensitive data has been compromised. With ransomware, the threat is real and tangible because one’s personal files are actually mutilated through the use of encryption. This is what happens in the .djvu virus attack scenario. The deleterious program competently leverages cryptography to lock down a victim’s important files, concatenates the .djvu or .djvuu extension to filenames, and drops a ransom message named _openme.txt, which explains what happened and provides the adversary’s contact details to proceed with recovery. Note that these indicators of compromise (IOCs) were inherent to the original variant of the threat, with dozens of new iterations having surfaced in the past three years or so (please see the table below for details on known releases as of 2021).

By the way, the .djvu file extension is probably a sort of an acronym for the term “déjà vu”, which might suggest that the user is dealing with something that already happened in the past. But what is it that should invoke such a sensation, in the attacker’s perspective? It could be the ransomware family this variant represents. Analysts have come to a conclusion that this edition is a spinoff of the so-called STOP ransomware, which emerged in February 2018 and has been barely backed by a large-scale distribution campaign until now. Back to the point, the currently active mod looks for potentially valuable data once it contaminates a Windows computer. The scan, which takes place in the background, touches both the local drive and external ones along with the network shares. Having located all files stored in popular formats, the Trojan employs asymmetric RSA-1024 cipher to encrypt them.

The crypto locking stage is accompanied by the above-mentioned changes of the filenames. The original values are appended with the .djvu string, therefore, a sample object Winter.jpg will turn into Winter.jpg.djvu. It’s noteworthy that a newer version is reportedly in the wild that uses the .djvuu extension instead. Obviously, such an approach makes it easy for the victim to do the math regarding which files have been hit by the culprit. Another essential element of the extortion raid is the document that provides a way for the victim to get in touch with the attackers. It’s named _openme.txt, and it can be found inside every encrypted folder as well as right on the desktop. Be advised that there are more than 10 versions of this recovery how-to file with different names and slightly different wording. A few recent ones are _readme.txt, !!!RESTORE_FILES!!!.txt, !!!RESTORE!!!.txt, and !!!INFO_RESTORE!!!.txt. The ransom note says the following or similar:

ALL YOUR FILES ARE ENCRYPTED
Don’t worry, you can return all your files!
All your files documents, photos, databases and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files.

This is a snippet of the message that contains the basics of how to get started on reinstating the ransomed data. The rest of it reassures the victim that the paid recovery will work by offering free decryption of one file that doesn’t bear particular value. Interestingly, the felons mention a 50% discount if they are contacted within 72 hours. This is hard to call a generous deal, though. The plagued user is also instructed to contact the villains at helpshadow@india.com or helpshadow@firemail.cc while indicating the personal ID from the ransom note. The more recent .djvuu variant lists different email addresses, namely restoredjvu@india.com and restoredjvu@firemail.cc. In response, the malefactors will send the exact amount of the ransom, which is payable in Bitcoin, and the BTC address for the buyout.

Unfortunately, as unsettling as it sounds, being submissive to the criminals and paying the ransom might be the only way to get the files back. The crypto implementation of the .djvu (.djvuu) ransomware is professional enough to prevent easy recovery. However, there are a few tips and tricks that may help you decode some data. The ransomware removal steps and applicable decryption mechanisms are covered in the sections below, so try this and hopefully rescue the files.

Djvu ransomware automated removal and data recovery

When faced with ransomware like Djvu, one of the best shortcuts in terms of removal is to use Combo Cleaner, a lightweight and incredibly effective application with PC security and optimization features under the hood. It detects and thoroughly deletes threats while giving you insights into the overall health of your computer.

This program’s protection power spans modules that forestall all known types of malware, including ransomware and browser hijackers, and take your online security to the next level by blocking phishing sites and other suspicious web pages. Follow these simple steps to eliminate the infection for good:

1. Download Combo Cleaner installer.

Download Djvu ransomware remover

^{Combo Cleaner scans your PC with no strings attached, but you’ll have to buy its fully functional version to remove the threats it detects. The disk optimization tools that find large files and duplicates are free to use.}

2. Open the CCSetup.exe file to get started. Several subsequent screens will allow you to make initial customizations so that the program works exactly as you need from the get-go.

3. The installation will be followed by an update of malware signatures. Once this process is through, click the Start Scan button in the left-hand sidebar.

4. Combo Cleaner will then check system locations that are most often polluted by Windows malware. The first scan can take a while to finish.

5. Combo Cleaner will display a system tray notification as soon as the scan is over. Click the Resolve found threats button to view the results.

6. The scan summary shows the names and types of the detected threats as well as their statuses and locations. Click the Remove all threats button and follow further on-screen prompts to get rid of these items.

Data recovery toolkit to the rescue

Some strains of ransomware are known to delete the original files after the encryption routine has been completed. As hostile as this activity appears, it can play into your hands. There are applications designed to revive the information that was obliterated because of malfunctioning hardware or due to accidental removal. The tool called Stellar Data Recovery features this type of a capability and therefore it can be applied in ransom attack scenarios to at least get the most important files back. So use the app to get an idea of what data can be restored and let it do the recovery job. Here is a step-by-step walkthrough:

1. Download and install Stellar Data Recovery.

Download Stellar Data Recovery

2. Open the application, select the types of recoverable files to look for, and click Next.

3. Choose the areas you want the tool to recover from and click the Scan button.

4. Having scanned the specified locations, the program will display a notification about the total amount of recoverable data. Close the dialog and click the Recover button. This will hopefully help you get some of your valuable files back.

Djvu ransomware manual removal and file recovery

Some ransomware strains terminate themselves after completing the encryption job on a computer, but some don’t. Furthermore, the Djvu virus may prevent victims from using popular antimalware tools in order to stay on board for as long as possible. Under the circumstances, it may be necessary to utilize the Safe Mode with Networking or System Restore functionality.

Be advised that even after the ransomware is removed, files will still be encrypted and inaccessible. The malicious code cleanup part, however, is important because it keeps a relapse of the infection from occurring further on and eliminates all opportunistic malware.

Ways of non-ransom recovery of .djvu / .djvuu files

Cracking the crypto used by this ransom Trojan is more of a science fiction thing rather than an attainable prospect for the masses. This is why the troubleshooting in predicaments of this sort is a matter of two approaches: one is to pay the ransom, which isn’t an option for many victims; and the other is to apply instruments that take advantage of the ransomware’s possible weaknesses. If the latter is your pick, the advice below is a must-try.

Ransomware Prevention Tips

To avoid Djvu ransomware and other file-encrypting infections in the future, follow several simple recommendations:

These techniques are certainly not a cure-all, but they will add an extra layer of ransomware protection to your security setup.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup. Another benefit of using the antimalware tool is that it will keep ransomware threats from intruding on your computer further on.

Download Djvu ransomware removal tool

FAQ