unlockdata@foxmail.com .Stun ransomware virus (Restore .stun files)

If your documents, photos and music does not open normally, [unlockdata@foxmail.com].stun file extension added at the end of their name then your PC system is infected with malware called ‘.Stun ransomware virus’. Once opened, it encrypts all files stored on personal computer drives and attached network drives.

Immediately after the launch, the .Stun ransomware scans all available drives, including network and cloud storage, to determine which files will be encrypted. The ransomware uses the file name extension, as a method to define a group of files that will be subjected to encrypting. Encrypted almost all types of files, including common as:

.wav, .css, .w3x, .xlsx, .zdb, .dba, .xxx, .xyw, .hkdb, .pdd, .m2, .sav, .wbc, .pfx, .jpg, .hkx, .wpa, .webdoc, .webp, .mdbackup, .wdp, .vpp_pc, .itdb, .asset, .lrf, .wn, .xx, .p7b, .itl, .db0, .x3f, .cdr, .xyp, .docm, .re4, .fsh, .crw, .sql, .1st, .wmd, .xls, .doc, .ntl, .yal, .bsa, .ibank, .pem, .0, .wsc, .xf, .rb, .qdf, .litemod, .sb, .p12, .bkf, .wbz, .ybk, .bc7, .apk, .csv, .epk, .sr2, .zw, .cas, .wbm, .cer, .orf, .odb, .mrwref, .odm, .p7c, .xbplate, .mdb, .sie, .pef, .ai, .bay, .1, .iwd, .sidd, .blob, .ncf, .wp, .xlsx, .yml, .wpb, .js, .kdb, .xll, .fpk, .wpd, .iwi, .vtf, .wotreplay, .zip, .ff, .rim, .mlx, .upk, .menu, .wsd, .ltx, .srf, .bar, .xml, .sidn, .r3d, .wp7, .wbmp, .dwg, .tor, .avi, .d3dbsp, .wri, .psd, .flv, .wp5, .xpm, .layout, .svg, .x, .rwl, .esm, .wpw, .vpk, .mdf, .icxs, .xbdoc, .pkpass, .xar, .itm, .qic, .jpe, .zi, .sum, .fos, .x3d, .wsh, .forge, .wmo, .wmv, .crt, .tax, .rar, wallet, .mov, .dcr, .xy3, .mddata, .mpqge, .m3u, .hplg, .wgz, .3fr, .wbk, .m4a, .wm, .wpt, .wire, .wp4, .desc, .dbf, .xlsm, .xmind, .kf, .z3d, .syncdb, .txt, .arch00, .odt, .accdb, .wma, .lbf, .x3f, .rofl, .xdl, .wb2, .map, .2bp, .wp6, .das, .raw, .pak, .xld, .bkp, .ptx, .pptm, .docx, .snx, .der, .xlsb, .jpeg, .bc6, .dmp, .cr2, .wps, .big, .zip, .wmv, .wpl, .dxg, .erf, .z, .t12, .zabw, .wma, .wmf, .vdf, .wpd, .mef, .pptx, .rgss3a, .py, .wpg, .xlgc, .rtf, .kdc, .xlk, .eps, .3ds, .ztmp, .ysp, .wps

When the ransomware encrypts a file, it will add the [unlockdata@foxmail.com].stun extension to every encrypted file. Once the ransomware finished enciphering of all documents, photos and music, it will create a file called “FILES ENCRYPTED.txt” with ransom demanding message on how to decrypt all personal files. You can see an one of the variants of the ransom instructions below:

all your data has been locked us
You want to return?
write email unlockdata@foxmail.com

Unfortunately, there is no way for victim’s to decrypt photos, documents and music for free. In the tutorial below, I have outlined few methods that you can use to remove .Stun ransomware virus from your computer and restore .stun files from a shadow volume copies or using file recover programs.

Table of contents

1. How to remove .Stun ransomware
2. How to decrypt .stun files
3. How to restore .stun files
4. How to protect your machine from .Stun ransomware?
5. To sum up

How to remove .Stun ransomware

There are not many good free anti-malware programs with high detection ratio. The effectiveness of malware removal tools depends on various factors, mostly on how often their virus/malware signatures DB are updated in order to effectively detect modern worms, trojans, ransomware and other malware. We advise to run several programs, not just one. These programs that listed below will help you delete all components of the .Stun ransomware virus from your disk and Windows registry.

How to remove .Stun ransomware with Zemana Anti-malware

We advise using the Zemana Anti-malware. You can download and install Zemana Anti-malware to search for and remove .Stun ransomware virus from your computer. When installed and updated, the malware remover will automatically scan and detect all threats exist on the PC.

1. Zemana AntiMalware (ZAM) can be downloaded from the following link. Save it directly to your MS Windows Desktop.
   
   

   Zemana AntiMalware
   165033 downloads
   Author: Zemana Ltd
   Category: Security tools
   Update: July 16, 2019
   
2. At the download page, click on the Download button. Your web-browser will open the “Save as” prompt. Please save it onto your Windows desktop.
3. When downloading is done, please close all applications and open windows on your PC system. Next, launch a file named Zemana.AntiMalware.Setup.
4. This will launch the “Setup wizard” of Zemana Anti-Malware (ZAM) onto your computer. Follow the prompts and don’t make any changes to default settings.
5. When the Setup wizard has finished installing, the Zemana Free will start and open the main window.
6. Further, click the “Scan” button . Zemana AntiMalware (ZAM) application will scan through the whole computer for the .Stun ransomware and other malicious software and PUPs. A system scan may take anywhere from 5 to 30 minutes, depending on your system. While the utility is checking, you can see how many objects and files has already scanned.
7. Once Zemana Free has finished scanning, Zemana AntiMalware will produce a list of undesired programs adware.
8. Review the scan results and then press the “Next” button. The utility will remove .Stun ransomware virus and other security threats and move threats to the program’s quarantine. After finished, you may be prompted to restart the computer.
9. Close the Zemana Anti Malware and continue with the next step.

Run MalwareBytes AntiMalware (MBAM) to remove Stun ransomware

Manual Stun ransomware removal requires some computer skills. Some files and registry entries that created by the ransomware can be not fully removed. We recommend that run the MalwareBytes AntiMalware that are completely free your PC system of ransomware. Moreover, this free program will allow you to remove malware, trojans, adware and worms that your computer can be infected too.

1. Visit the following page to download the latest version of MalwareBytes for Windows. Save it to your Desktop so that you can access the file easily.
   
   

   Malwarebytes Anti-malware
   327261 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: April 15, 2020
   
2. When downloading is complete, close all programs and windows on your system. Open a folder in which you saved it. Double-click on the icon that’s named mb3-setup.
3. Further, click Next button and follow the prompts.
4. Once installation is finished, press the “Scan Now” button to perform a system scan for the Stun ransomware virus related files, folders and registry keys. During the scan MalwareBytes Anti Malware will detect threats exist on your machine.
5. As the scanning ends, MalwareBytes will display you the results. In order to remove all items, simply click “Quarantine Selected”. Once the procedure is finished, you can be prompted to restart your PC system.

The following video offers a few simple steps on how to remove hijackers, adware and other malicious software with MalwareBytes Anti-Malware (MBAM).

Run KVRT to remove .Stun ransomware

If MalwareBytes anti-malware or Zemana antimalware cannot remove this ransomware virus, then we recommends to run the KVRT. KVRT is a free removal utility for ransomware viruses, trojans, PUPs and worms.

Download Kaspersky virus removal tool (KVRT) from the following link.

After downloading is complete, double-click on the KVRT icon. Once initialization procedure is finished, you will see the Kaspersky virus removal tool screen as shown on the image below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button . Kaspersky virus removal tool tool will begin scanning the whole computer to find out .Stun ransomware and other known infections. A system scan can take anywhere from 5 to 30 minutes, depending on your system. During the scan KVRT will search for threats present on your personal computer.

After the system scan is complete, Kaspersky virus removal tool will open a list of found items as on the image below.

Once you have selected what you wish to get rid of from your PC press on Continue to begin a cleaning task.

How to decrypt .stun files

The encryption method is so strong that it’s practically impossible to decrypt .stun files without the actual encryption key. The bad news is that the only way to get your files back is to pay ($300-1000 in Bitcoins) developers of the .Stun ransomware for a copy of the private (encryption) key.

Should you pay the ransom? A majority of cyber security researchers will reply immediately that you should never pay a ransom if affected by ransomware! If you choose to pay the ransom, there is no 100% guarantee that you can decrypt all personal files!

Free malware removal tools listed in this post has the ability to scan for and remove ransomware and prevent any further damage. After that you can restore encrypted documents, photos and music from their Shadow Copies or using file restore utility.

How to restore .stun files

In some cases, you can restore files encrypted by .Stun ransomware. Try both methods. Important to understand that we cannot guarantee that you will be able to restore all encrypted files.

Recover .stun encrypted files using Shadow Explorer

The Windows has a feature called ‘Shadow Volume Copies’ that can help you to recover .stun files encrypted by the .Stun ransomware virus. The solution described below is only to recover encrypted files to previous versions from the Shadow Volume Copies using a free tool called the ShadowExplorer.

Download ShadowExplorer on your computer by clicking on the following link.

When the downloading process is complete, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as displayed in the following example.

Run the ShadowExplorer utility and then choose the disk (1) and the date (2) that you wish to restore the shadow copy of file(s) encrypted by the .Stun ransomware as on the image below.

Now navigate to the file or folder that you wish to recover. When ready right-click on it and click ‘Export’ button as displayed in the figure below.

Restore .stun files with PhotoRec

Before a file is encrypted, the .Stun ransomware makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to restore your files using file recover programs like PhotoRec.

Download PhotoRec on your computer by clicking on the link below.

After downloading is done, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as displayed on the screen below.

Double click on qphotorec_win to run PhotoRec for Windows. It will show a screen as shown on the screen below.

Choose a drive to recover as shown in the figure below.

You will see a list of available partitions. Choose a partition that holds encrypted files as shown in the figure below.

Click File Formats button and specify file types to restore. You can to enable or disable the restore of certain file types. When this is done, click OK button.

Next, press Browse button to choose where restored personal files should be written, then press Search.

Count of restored files is updated in real time. All recovered photos, documents and music are written in a folder that you have chosen on the previous step. You can to access the files even if the recovery process is not finished.

When the recovery is finished, click on Quit button. Next, open the directory where recovered files are stored. You will see a contents as shown in the figure below.

All recovered documents, photos and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you’re searching for a specific file, then you can to sort your recovered files by extension and/or date/time.

How to protect your machine from .Stun ransomware?

Most antivirus apps already have built-in protection system against the ransomware virus. Therefore, if your PC system does not have an antivirus application, make sure you install it. As an extra protection, run the HitmanPro.Alert.

Run HitmanPro.Alert to protect your system from .Stun ransomware

All-in-all, HitmanPro.Alert is a fantastic tool to protect your computer from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of Windows operating system from MS Windows XP to Windows 10.

Download HitmanPro Alert by clicking on the following link.

Once the downloading process is finished, open the directory in which you saved it. You will see an icon like below.

Double click the HitmanPro Alert desktop icon. After the tool is launched, you will be shown a window where you can select a level of protection, as displayed in the following example.

Now click the Install button to activate the protection.

To sum up

Now your personal computer should be free of the .Stun ransomware. Remove Kaspersky virus removal tool and MalwareBytes. We recommend that you keep Zemana Anti Malware (ZAM) (to periodically scan your PC for new malware). Probably you are running an older version of Java or Adobe Flash Player. This can be a security risk, so download and install the latest version right now.

If you are still having problems while trying to delete .Stun ransomware virus from your system, then ask for help here.