Virus .udjvu

Anonymous
2018-12-23T10:14:35+00:00

Yesterday I was using my computer normally then suddenly a popup showed telling me that there was updates installing and I knew that it's not from Microsoft  as when I opened the source from task manger I found that it's not related to Microsoft updates so I click on end task then I tried to open Windows defender but it showed this message " page not available Your IT administrator as limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information. Then I found that a program called windows powershell is installed by itself .. Then the screen blacked out showing only this message when I tried to open Task manger " Task manger has been disabled by your administrator" 

SO I tried to restart the my computer but couldn't open start...after managing to restart by pressing the  power button for awhile to restore windows from a restore points , there was three but all failed and also repair failed so click on reset my computer but keep my files ..when it finished I found all my files "pictures , programs , pdfs, doxc, " all of it ended with this extension

.udjvu

like in the picture attached 

So How can I get my files back and open them?

"when I tried to use snap tool I didn't find it"

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

52 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-12-24T19:27:53+00:00

    I see you added this new variant to the discussion, I'll try to be updated of any new articles on Bleeping computer

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2019-01-17T08:47:55+00:00

    The STOPDecrypter 2.0.0.0 for the .djvu* variants has been updated to support the following extentions: djvu, .djvuq, .djvur, .djvut, .djvuu, .pdff, .tfude, .tfudeq, .tro, .udjvu, .tfudet.

    STOP ransomware (.STOP, .SUSPENDED - !!! YourDataRestore !!! txt) Support Topic

    https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-suspended-yourdatarestore-txt-support-topic/?p=4667165

    ~bhringer

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2018-12-24T12:51:40+00:00

    As I noted previously, there is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

    Currently, the .udjvu variant is not decryptable. When or if a decryption solution is found, that information will be provided in the above support topic and victims will receive notification if subscribed to it. In addition, a news article most likely will be posted on the Bleeping Computer front page.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2018-12-23T13:08:44+00:00

    The infection you are dealing with appears to be the latest variant of STOP Ransomware. Amigo-A has updated his details page (Block of Updates) to include .djvu and .djvuu and should include the .udjvu variant soon.

    STOP Ransomware will leave files (ransom notes) named !!!YourDataRestore!!!.txt, !!!RestoreProcess!!!.txt, !!!INFO_RESTORE!!!.txt, !!RESTORE!!!.txt, !!!!RESTORE_FILES!!!.txt, !!!DATA_RESTORE!!!.txt, !!!RESTORE_DATA!!!.txt, !!!KEYPASS_DECRYPTION_INFO!!!.txt, !!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!SAVE_FILES_INFO!!!.txt, !readme.txt, _openme.txt.

    Dr.Web is able to decrypt some variants of STOP Ransomware (i.e. .DATAWAIT, .INFOWAIT) as indicated in Post #20 and Post #29 by Emmanuel_ADC-Soft. At this time Dr.Web cannot cannot decrypt other STOP Ransomware variants...see here

    If Dr.Web cannot assist with the STOP variant which infected your system, then unfortunately, there is no other known method at this time to decrypt files without paying the ransom and obtaining the private RSA keys from the criminals unless they are leaked or seized & released by authorities. Without the master private RSA key that can be used to decrypt your files, decryption is impossible. If feasible, your best option is to restore from backups, try file recovery software or backup/save your encrypted data as is and wait for a possible solution at a later time. Ignore all Google searches which provide links to bogus and untrustworthy removal/decryption guides.

    There is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

    When or if a decryption solution is found, that information will be provided in the above support topic and victims will receive notification if subscribed to it. In addition, a news article most likely will be posted on the Bleeping Computer front page.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. DaveM121 934.5K Reputation points Independent Advisor
    2018-12-23T10:24:30+00:00

    Hi moatazgamal34

    I am sorry to be the bearer of bad news, you have been hit with a ransomware attack

    Has a ransom notice popped up no your screen?

    There is currently no decrypter for this new variant of GandCrab, those files will not be currently recoverable . . .

    Your only option now is to backup your files to another drive, in the hope that in the future a decrypter will become available . ..

    You will need to wipe all drives attached to your PC to remove this malware and then clean install Windows 10 and all your applications . ..

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments