Virus .udjvu

Anonymous
2018-12-23T10:14:35+00:00

Yesterday I was using my computer normally then suddenly a popup showed telling me that there was updates installing and I knew that it's not from Microsoft  as when I opened the source from task manger I found that it's not related to Microsoft updates so I click on end task then I tried to open Windows defender but it showed this message " page not available Your IT administrator as limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information. Then I found that a program called windows powershell is installed by itself .. Then the screen blacked out showing only this message when I tried to open Task manger " Task manger has been disabled by your administrator" 

SO I tried to restart the my computer but couldn't open start...after managing to restart by pressing the  power button for awhile to restore windows from a restore points , there was three but all failed and also repair failed so click on reset my computer but keep my files ..when it finished I found all my files "pictures , programs , pdfs, doxc, " all of it ended with this extension

.udjvu

like in the picture attached 

So How can I get my files back and open them?

"when I tried to use snap tool I didn't find it"

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

52 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. DaveM121 934.5K Reputation points Independent Advisor
    2018-12-23T10:54:46+00:00

    Hi moatazgamal34

    I m sorry this has happened to you but there is rarely any coming back from this type of attack.

    You need to wipe your drive(s) and clean install Windows . . .

    Was this answer helpful?

    0 comments
  2. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2018-12-23T13:08:44+00:00

    The infection you are dealing with appears to be the latest variant of STOP Ransomware. Amigo-A has updated his details page (Block of Updates) to include .djvu and .djvuu and should include the .udjvu variant soon.

    STOP Ransomware will leave files (ransom notes) named !!!YourDataRestore!!!.txt, !!!RestoreProcess!!!.txt, !!!INFO_RESTORE!!!.txt, !!RESTORE!!!.txt, !!!!RESTORE_FILES!!!.txt, !!!DATA_RESTORE!!!.txt, !!!RESTORE_DATA!!!.txt, !!!KEYPASS_DECRYPTION_INFO!!!.txt, !!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!SAVE_FILES_INFO!!!.txt, !readme.txt, _openme.txt.

    Dr.Web is able to decrypt some variants of STOP Ransomware (i.e. .DATAWAIT, .INFOWAIT) as indicated in Post #20 and Post #29 by Emmanuel_ADC-Soft. At this time Dr.Web cannot cannot decrypt other STOP Ransomware variants...see here

    If Dr.Web cannot assist with the STOP variant which infected your system, then unfortunately, there is no other known method at this time to decrypt files without paying the ransom and obtaining the private RSA keys from the criminals unless they are leaked or seized & released by authorities. Without the master private RSA key that can be used to decrypt your files, decryption is impossible. If feasible, your best option is to restore from backups, try file recovery software or backup/save your encrypted data as is and wait for a possible solution at a later time. Ignore all Google searches which provide links to bogus and untrustworthy removal/decryption guides.

    There is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

    When or if a decryption solution is found, that information will be provided in the above support topic and victims will receive notification if subscribed to it. In addition, a news article most likely will be posted on the Bleeping Computer front page.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2018-12-24T11:11:15+00:00

    Hi Moataz,

    I had attacked too  with the same .udjvu which paralyze all my files ,pdf , doc , jpg

    Kindly , if you get any results to solve this problem keep me online with you  ,  I am from Egypt and I will do the same for you , who arrive first help other .

    Thanks  and all the best of Good luck

    Amany Abdelaziz

    Was this answer helpful?

    0 comments
  4. quietman7 MVP Alumni 19,830 Reputation points Volunteer Moderator
    2018-12-24T12:51:40+00:00

    As I noted previously, there is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

    Currently, the .udjvu variant is not decryptable. When or if a decryption solution is found, that information will be provided in the above support topic and victims will receive notification if subscribed to it. In addition, a news article most likely will be posted on the Bleeping Computer front page.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. Anonymous
    2018-12-24T19:15:39+00:00

    Hi Amany,

    Strangely, I'm from Egypt too, yesterday morning there was just one result on google about this variant of virus, after a lot of search on other variants like .djvu not ( .udjvu) I found all sites try to remove the virus but not decrypt and very few forms that actually have been decrypted so, I think the right move to do right now is to backup your important files to external hard drive then rest your windows from scratch in the hope there will be a decrypter in the future as said above. Try upload your important files from now and then to the cloud. Also don't forget to cover your web-camera. In the future if I managed to decrypt any of the files I will contact you.

    Was this answer helpful?

    0 comments