Windows 10: .domn extension STOP DJVU ransomware

My pc is infected with this new version of STOP DJVU virus which has changed the extension of all my files: photo, video, doc, iso etc. with .domn extension. I don't have any backup... I am getting frustrated as i am not able to find any solution to decrypt my important files back. Please help!


* Moved from Win 10/Files

:)

 

.domn extension STOP DJVU ransomware

My pc is infected with this new version of STOP DJVU virus which has changed the extension of all my files: photo, video, doc, iso etc. with .domn extension. I don't have any backup... I am getting frustrated as i am not able to find any solution to decrypt
my important files back. Please help!

 

.domn extension STOP DJVU ransomware

That's a variant of STOP ransomware which is sadly not decryptable for free right now.

Please read:
#1 [STOP Ransomware (.STOP, .Puma, .Djvu, .Promo, .Drume) Help & Support Topic: post #1]


All further questions please post in that above support forum.

FYI:

quietman7 - MVP recently

posted:

QUOTE

Any files that are encrypted with STOP (DJVU) Ransomware will have the
.STOP, .SUSPENDED, .WAITING,
.PAUSA, .CONTACTUS,
.DATASTOP, .STOPDATA,
.KEYPASS,
.WHY,
.SAVEfiles,
.DATAWAIT,
.INFOWAIT,
.puma,
.pumax,
.pumas,
.shadow,
.djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut

.pdff,
.tro,
.tfude, .tfudeq,
.tfudet,
.rumba,
.adobe,
.adobee,
.blower, .promos,
.promoz,
.promock, .promoks,
.promorad, .promorad2,

.kroput,
.kroput1,
.charck,
.pulsar1,
.klope,
.kropun,
.charcl,
.doples,
.luces,
.luceq,
.chech,
.proden,
.drume,
.tronas,
.trosak,
.grovas,
.grovat,.roland,

.refols,
.raldug,
.etols,
.guvara,
.browec,
.norvas,
.moresa,
.verasto,
.hrosas,
.kiratos,
.todarius,
.hofos,
.roldat,
.dutan,
.sarut,
.fedasot,
.forasom,
.berost,
.fordan,
.codnat,
.codnat1,
.bufas,
.dotmap,
.radman,
.ferosas,
.rectot,
.skymap,
.mogera,
.rezuc,
.stone,
.redmat,
.lanset,
.davda,
.poret,
.pidon,
.heroset,
.myskle,
.boston,
.muslat,
.gerosan,
,vesad,
.horon,
.neras,
.truke,
.dalle,
.lotep,
.nusar,
.litar,
.besub,
.cezor,
.lokas,
.godes,
.budak,
.vusad,
.herad,
.berosuce,
.gehad,
.gusau,
.madek,
.tocue,
.darus,
.lapoi,
.todar,
.dodoc,
.bopador,
.novasof,
.ntuseg,
.ndarod,
.access,
.format,
.nelasod,
.mogranos,
.cosakos,
.nvetud,
.lotej,
.kovasoh,
prandel,
.zatrov,
.masok,
.brusaf,
londec,
.krusop,
.mtogas,
.coharos,
.nasoh,
.nacro,
.pedro,
.nuksus,
.vesrato,
.masodas,
.stare, .cetori,
.carote,
.shariz,
.gero,
.hese,
.geno, .seto,
.peta,
.moka, .meds,
.kvag or
.domn extension appended to the end of the encrypted data filename as explained
here by
Amigo-A (Andrew Ivanov).



STOP Ransomware will leave files (ransom notes) named !!!YourDataRestore!!!.txt, !!!RestoreProcess!!!.txt, !!!INFO_RESTORE!!!.txt, !!RESTORE!!!.txt, !!!!RESTORE_FILES!!!.txt, !!!DATA_RESTORE!!!.txt, !!!RESTORE_DATA!!!.txt, !!!KEYPASS_DECRYPTION_INFO!!!.txt,
!!!WHY_MY_FILES_NOT_OPEN!!!.txt, !!!SAVE_FILES_INFO!!!.txt and !readme.txt. The .djvu* and newer variants will leave ransom notes named

_openme.txt,
_open_.txt or
_readme.txt



Please read the first page of the

STOP Ransomware (.STOP, .Puma, .Djvu, .Promo, .Drume) Support Topic and
Final Frequently Asked Questions (FAQs) for
a summary of this infection, it's variants, any updates and
possible decryption solutions.

You need to post any questions in the above support topic. If you have followed those instructors and need further assistance, then you still need to ask for help in that support topic.
If there is no OFFLINE KEY available for the variant you are dealing with OR it is one of the newer variants
(.gero, .hese, .geno, .seto, peta, .moka, .meds, .kvag, .domm)
released after the criminals made changes, then we cannot help you at this time since there is no way to gain access to the criminal's command server and reproduce or retrieve these KEYs.

Quote

This means...there no longer is any method to get OFFLINE KEYS for these newer variants and no way to decrypt files if infected with an ONLINE KEY without paying the ransom and obtaining the private
keys from the criminals who created the ransomware. However, experts are working on ways to obtain OFFLINE KEYS and if they are able to do so, that information will be provided in this support topic. For now all you can do is back up (save) your data
and wait.

UNQUOTE

 

Ransomware attack

AFAIK,
Demonslay335 (aka Michael Gillespie) is working on it... >

https://twitter.com/demonslay335/status/1156259022686830598

>
https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/page-50#entry4682102

Again, read (especially
this) and subscribe to and if needed ask for help here:
https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/