Virus .udjvu

Anonymous
2018-12-23T10:14:35+00:00

Yesterday I was using my computer normally then suddenly a popup showed telling me that there was updates installing and I knew that it's not from Microsoft  as when I opened the source from task manger I found that it's not related to Microsoft updates so I click on end task then I tried to open Windows defender but it showed this message " page not available Your IT administrator as limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information. Then I found that a program called windows powershell is installed by itself .. Then the screen blacked out showing only this message when I tried to open Task manger " Task manger has been disabled by your administrator" 

SO I tried to restart the my computer but couldn't open start...after managing to restart by pressing the  power button for awhile to restore windows from a restore points , there was three but all failed and also repair failed so click on reset my computer but keep my files ..when it finished I found all my files "pictures , programs , pdfs, doxc, " all of it ended with this extension

.udjvu

like in the picture attached 

So How can I get my files back and open them?

"when I tried to use snap tool I didn't find it"

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

52 answers

Sort by: Newest
Most helpful Newest Oldest
  1. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2018-12-23T13:08:44+00:00

    The infection you are dealing with appears to be the latest variant of STOP Ransomware. Amigo-A has updated his details page (Block of Updates) to include .djvu and .djvuu and should include the .udjvu variant soon.

    STOP Ransomware will leave files (ransom notes) named !!!YourDataRestore!!!.txt, !!!RestoreProcess!!!.txt, !!!INFO_RESTORE!!!.txt, !!RESTORE!!!.txt, !!!!RESTORE_FILES!!!.txt, !!!DATA_RESTORE!!!.txt, !!!RESTORE_DATA!!!.txt, !!!KEYPASS_DECRYPTION_INFO!!!.txt, !!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!SAVE_FILES_INFO!!!.txt, !readme.txt, _openme.txt.

    Dr.Web is able to decrypt some variants of STOP Ransomware (i.e. .DATAWAIT, .INFOWAIT) as indicated in Post #20 and Post #29 by Emmanuel_ADC-Soft. At this time Dr.Web cannot cannot decrypt other STOP Ransomware variants...see here

    If Dr.Web cannot assist with the STOP variant which infected your system, then unfortunately, there is no other known method at this time to decrypt files without paying the ransom and obtaining the private RSA keys from the criminals unless they are leaked or seized & released by authorities. Without the master private RSA key that can be used to decrypt your files, decryption is impossible. If feasible, your best option is to restore from backups, try file recovery software or backup/save your encrypted data as is and wait for a possible solution at a later time. Ignore all Google searches which provide links to bogus and untrustworthy removal/decryption guides.

    There is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

    When or if a decryption solution is found, that information will be provided in the above support topic and victims will receive notification if subscribed to it. In addition, a news article most likely will be posted on the Bleeping Computer front page.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. DaveM121 934.5K Reputation points Independent Advisor
    2018-12-23T10:54:46+00:00

    Hi moatazgamal34

    I m sorry this has happened to you but there is rarely any coming back from this type of attack.

    You need to wipe your drive(s) and clean install Windows . . .

    Was this answer helpful?

    0 comments
  3. Anonymous
    2018-12-23T10:46:35+00:00

    version 1803

    I have some files uploaded to the cloud but most of the files aren't stored anywhere

    Was this answer helpful?

    0 comments
  4. DaveM121 934.5K Reputation points Independent Advisor
    2018-12-23T10:42:38+00:00

    Hi moatazgamal34

    Do you have a backup of your files stored anywhere?

    Open the Settings App, go to System - About, what version (1703, 1803 . . . etc.) of Windows 10 is installed on your PC?

    Was this answer helpful?

    0 comments
  5. Anonymous
    2018-12-23T10:36:04+00:00

    No no no, why just why :(

    No ransom notice popped up

    Was this answer helpful?

    0 comments