cgsecurity.org

Posted: **18 Aug 2020, 14:42**

Hello,

My PC was attacked by STOP ransomware. I lost all files due to .erif encryption. By mistake one partition was formatted and I stored 1 GB of word pdf files. Now I am unable to access the deleted files . Has my data overwritten? is there away to get erif files dencrypted? I have lost my Phd research data if some one can help ASAP it will be a great favor.

Posted: **18 Aug 2020, 17:58**

aimen wrote: 18 Aug 2020, 14:42 Hello,

My PC was attacked by STOP ransomware. I lost all files due to .erif encryption. By mistake one partition was formatted and I stored 1 GB of word pdf files.

word files or pdf files?

Now I am unable to access the deleted files .

Which files have been "deleted"? How?
Has my data overwritten?
[/quote]Which data?

is there away to get erif files dencrypted?

There are some many ransomware algorithms - please check a search engine on that matter.

I have lost my Phd research data if some one can help ASAP it will be a great favor.

Help is only possible based on a comprehensible problem description.
Unprecise descriptions trigger a negative mood of helping people and diminishes their motivation.

Posted: **19 Aug 2020, 15:28**

DJvu family ransomware I guess. It left a note of providing 980$ to get my data back. All of the data is lost; word docs, pdf, images etc. As a partition was formatted and all the data is lost. on the same partition after formatting I saved 3 word documents, and a few other files. So this disk which was formatted and now contains 1GB data can it be recovered?
I have tried Photorec and some files recovered but these are text files or images and are not functional. Most of these are broken as the photorec manual described named with ''b'' . My Phd research data is also word or pdf files. All files are renamed as .erif and cant be opened.

I used testdisk for one file it gave this response

SHA256: f7b99de336dd928d3e026b8854baf45e89ec64297a009bd41cb8265e8b782d2a
File size: 281421

PhotoRec has recovered:
f0000512.txt - size=482

WARNING: filesize doesn't match.

Feel free to contact the developper if you think that PhotoRec should be able to recover this file. Don't forget to provide this URL.

The ransom note is as follows:
ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-mrns3LJpCF
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
helpmanager@mail.ch

Reserve e-mail address to contact us:
restoremanager@airmail.cc

Your personal ID:
0242regyjnkjdd

Posted: **19 Aug 2020, 17:05**

aimen wrote: 19 Aug 2020, 15:28 DJvu family ransomware I guess. It left a note of providing 980$ to get my data back. All of the data is lost; word docs, pdf, images etc. As a partition was formatted and all the data is lost. on the same partition after formatting I saved 3 word documents, and a few other files. So this disk which was formatted and now contains 1GB data can it be recovered?
I have tried Photorec and some files recovered but these are text files or images and are not functional. Most of these are broken as the photorec manual described named with ''b'' . My Phd research data is also word or pdf files. All files are renamed as .erif and cant be opened.

I used testdisk for one file it gave this response
SHA256: f7b99de336dd928d3e026b8854baf45e89ec64297a009bd41cb8265e8b782d2a
File size: 281421

PhotoRec has recovered:
f0000512.txt - size=482

WARNING: filesize doesn't match.

Feel free to contact the developper if you think that PhotoRec should be able to recover this file. Don't forget to provide this URL.

The ransom note is as follows:
ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-mrns3LJpCF
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
helpmanager@mail.ch

Reserve e-mail address to contact us:
restoremanager@airmail.cc

Your personal ID:
0242regyjnkjdd

Posted: **19 Aug 2020, 17:06**

aimen wrote: 19 Aug 2020, 15:28 DJvu family ransomware I guess. It left a note of providing 980$ to get my data back. All of the data is lost; word docs, pdf, images etc. As a partition was formatted and all the data is lost. on the same partition after formatting I saved 3 word documents, and a few other files. So this disk which was formatted and now contains 1GB data can it be recovered?

I still don't get.
Who formatted the partition? When?
Please file a precise report.
Use a timeline. State what your disk has been before, partition layout etc.
State what it's layout was after.
There are two things, a ransomware attack and formatted partition. That does not fit together.
I won't ask you a third time.

Please contact your local police station. If you were here in Germany local police would tell you if they aware of a decoding tool.
Ask a professional recovery company or your antivirus software provider if you have one.

cgsecurity.org

DJVU files lost- Partition formatted and a few new files created

DJVU files lost- Partition formatted and a few new files created

Re: DJVU files lost- Partition formatted and a few new files created

Re: DJVU files lost- Partition formatted and a few new files created

Re: DJVU files lost- Partition formatted and a few new files created

Re: DJVU files lost- Partition formatted and a few new files created