Virus .udjvu

Anonymous
2018-12-23T10:14:35+00:00

Yesterday I was using my computer normally then suddenly a popup showed telling me that there was updates installing and I knew that it's not from Microsoft  as when I opened the source from task manger I found that it's not related to Microsoft updates so I click on end task then I tried to open Windows defender but it showed this message " page not available Your IT administrator as limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information. Then I found that a program called windows powershell is installed by itself .. Then the screen blacked out showing only this message when I tried to open Task manger " Task manger has been disabled by your administrator" 

SO I tried to restart the my computer but couldn't open start...after managing to restart by pressing the  power button for awhile to restore windows from a restore points , there was three but all failed and also repair failed so click on reset my computer but keep my files ..when it finished I found all my files "pictures , programs , pdfs, doxc, " all of it ended with this extension

.udjvu

like in the picture attached 

So How can I get my files back and open them?

"when I tried to use snap tool I didn't find it"

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

52 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2019-01-14T18:22:23+00:00

    Update: Demonslay335 (aka Michael Gillespie), a ransomware researcher/analyst with the MalwareHunterTeam, advises victims of the newer .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut, .djvup, .djuvq,.pdff, .tro and .tfude STOP Ransomware variants to send their ransom note, personal ID found in the ransom note, MAC address and an encrypted and original file pair to member kNN for possible future decryption of their data (see here). Victims need to follow these instructions when sending messages to kNN...be aware that time is an important factor and this is not a guarantee of decryption. You can use a third-party sharing site (Google Drive, OneDrive, DropBox SendSpace, Mega, etc.) to send the file pair and provide a link in your PM.

    .

    QUOTE by kNN

    "Send only what is neccesary and send it as soon as possible. A lot of you won't be able to decrypt your files because the time has passed and there is no way to recover the encryption key. Time is VERY important.

    Was this answer helpful?

    0 comments
  2. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2019-01-14T12:07:24+00:00

    When dealing with ransomware, recovering one of two encrypted files by renaming them is not uncommon but in most cases doing so does not work...it typically results in additional problems with file corruption and complicates possible decryption should a future free solution become available.

    Was this answer helpful?

    0 comments
  3. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2019-01-14T12:04:04+00:00

    You're welcome.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2019-01-14T10:43:07+00:00

    Hi , did you fix it , have same probleme , i just rename fils and it s look fine , remove .udjvu keep the other

    Was this answer helpful?

    0 comments
  5. Anonymous
    2019-01-14T09:43:37+00:00

    Thank you very very much... Really appreciate your advice..

    Was this answer helpful?

    0 comments