Online qscx ransomware decryption

Status
Not open for further replies.

Zanne

New Member
Thread author
Jun 20, 2021
1
My system got infected with a STOP Djvu ransomware that encrypted all my files with qscx extension, I spent a lot of time online looking for a solution and I couldn't because it is online encryption with an ID of PEkuCwzHhIAUpZc58QNSfWeTQEqZYQlPXyvuK0GI.
I have tried all the currently available solutions like recovery, etc, and nothing seems to work. I know that there is currently no way to decrypt the files with an online ID and we need to wait for an official decryption tool for this new ransomware, however, my question is if the official decryption tool will be able to decrypt the online IDs or I should just give up on my files?
 
  • Like
Reactions: Nevi

struppigel

Moderator
Verified
Staff Member
Well-known
Apr 9, 2020
656
Hello Zanne

I am Karsten and will help you with any malware-related problems.

Please familiarize yourself with the following ground rules before you start.
  • Read my instructions thoroughly, carry out each step in the given order.
  • Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.
  • If you are unsure about anything or if you encounter any problems, please stop and inform me about it.
  • Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.
  • Back up important files before we start.
  • Note: On weekends I might be slow to reply
-------------------------------------------------------------------

Your files have been encrypted by STOP/DJVU ransomware. Variants after August 2019 are only decryptable if an offline key was used. For variants with an online key you cannot decrypt files.

my question is if the official decryption tool will be able to decrypt the online IDs
You definitely should not count on this to happen.
You can still keep your encrypted files and store them in an external drive for this case.

Your options without a backup:

1) Recovery: In rare cases ransomware fails to delete shadow volume copies or fails to delete the original files properly. You can try to recover files via shadow volume copies and file recovery software.
2) Repair: Certain file types, mainly video and audio files, can possibly be repaired with tools like MediaRepair. But these files will loose some data.
3) Wait: Backup encrypted files and a ransom note and wait in case a solution comes up later. Maybe law enforcement gets hands on the keys or the criminals publish the keys as it happened with, e.g., GandCrab. I suggest reading the news on this. Emsisoft will update their decrypter if that happens.
4) Pay: There is the option of paying the criminals, but we highly recommend against this step. You will just fund later attacks. You may also pay without getting your files back. These are criminals and as such not trustworthy.

Please let me know if you want help with the steps 1) or 2)
Please let me know if you need assistance in cleaning your system.
 
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top