• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

My AntiSpyware

Free antispyware software, Online Scanners, Instructions on how to remove spyware and malware.

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools
Home › Virus › Restorefiles@firemail.cc ransomware virus (Removal and Decryption)

Restorefiles@firemail.cc ransomware virus (Removal and Decryption)

Myantispyware team November 15, 2019     No Comment    

Restorefiles@firemail.cc is an email address that cyber criminals use to contact victims of STOP (DJVU) ransomware. Ransomware is a type of malware that blocks access to files by encrypting them, until the victim pays a ransom.

Restorefiles@firemail.cc

Screenshot of the contents of the ‘_readme.txt’ file (ransom demand message)

Restorefiles@firemail.cc virus locks up the files using AES-RSA technology, that makes it impossible to unlock the encrypted data by the victim without obtaining a key and a decryptor, which is the only way to decrypt affected files. It can be obtained only in the case of payment of the required ransom through cryptocurrency wallet. The ransomware virus encrypts almost of database, videos, documents, music, web application-related files, archives and images, including common as:

.xll, .vcf, .hkx, .ltx, .py, .bkf, .mcmeta, .wgz, .wot, .xlgc, .jpg, .yal, .pst, .mddata, .wsd, .sb, .ztmp, .fos, .psd, .syncdb, .wpa, .1st, .jpeg, .xx, .re4, .png, .sidd, .hvpl, .xbplate, .xyp, .xf, .arw, .ppt, .icxs, .2bp, .wmv, .itm, .wpd, .rim, .xyw, .wma, .zdc, .docm, .xlsx, .rwl, .m4a, .wpw, .flv, .bar, .epk, .iwi, .odp, .m2, .mpqge, .zip, .odt, .cas, .xy3, .m3u, .pfx, .menu, .sr2, .cdr, .pef, .mef, .dcr, .pkpass, .snx, .vtf, .x3f, .wbd, .yml, .bik, .pdd, .3ds, .forge, .wcf, .upk, .xpm, .wpg, .odb, .vpp_pc, .3dm, .ws, .xlsx, .z3d, .bc6, .big, wallet, .css, .xxx, .nrw, .dmp, .ibank, .p12, .xlsm, .pak, .wmo, .sav, .p7b, .wri, .bc7, .ntl, .wps, .wpt, .crw, .mdb, .cfr, .ods, .jpe, .zi, .rtf, .lbf, .xar, .kdb, .xlk, .db0, .wire, .sis, .odc, .webdoc, .wpe, .crt, .psk, .vpk, .zw, .wpl, .y, .wdb, .3fr, .accdb, .dxg, .gdb, .esm, .eps, .0, .wbmp, .bay, .arch00, .xls, .pptm, .docx, .tor, .dbf, .cer, .mp4, .wp7, .dazip, .ncf, .map, .txt, .ptx, .mdbackup, .ybk, .xbdoc, .doc, .litemod, .bkp, .xmind, .vfs0, .wbm, .das, .wp4, .hplg, .zif, .pem, .ai, .itdb, .webp, .xml, .mrwref, .wdp, .hkdb, .xlsm, .odm, .srf, .iwd, .bsa, .xdl, .tax, .wbk, .itl, .wotreplay, .raw, .z, .ff, .x3f, .xwp, .r3d, .pdf, .wpb, .rar, .dwg, .fpk, .raf, .ysp, .wmd, .xls, .kf, .gho, .fsh, .sum, .wav, .p7c, .rw2, .sie, .cr2, .rgss3a, .csv, .wbz, .wsh, .wmf, .wb2, .apk, .avi, .vdf, .js, .d3dbsp, .x, .dba, .wma, .zabw, .xmmap, .svg, .indd, .wbc, .layout, .desc, .w3x, .kdc, .xdb, .sql, .1, .asset, .wsc, .wps, .wp6, .zdb, .mdf, .wm, .erf, .orf, .srw, .slm, .wp5, .wp, .x3d, .pptx, .blob

With the encryption process is finished, all encrypted files will now have a new extension appended to them. In every directory where there are encrypted files, Restorefiles@firemail.cc virus drops a file called ‘_readme.txt’. This file contains a ransom note that is written in the English. The ransom message directs victims to make payment in exchange for a key needed to unlock personal files.

Summary

Email address Restorefiles@firemail.cc
Related ransomware STOP (DJVU) family
Variants of STOP (Djvu) that use this address Peet, Grod
Ransom note _readme.txt
Ransom amount $980/$490
Removal Free Malware Removal Tools
Decryption Free STOP Djvu Decryptor

 

Text presented in “_readme.txt”:

ATTENTION!

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-7YSRbcuaMa
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
restorefiles@firemail.cc

Reserve e-mail address to contact us:
gorentos@bitmessage.ch

Your personal ID:

If you find files called ‘_readme.txt’, then your computer is the victim of ransomware attack. First you need to find and remove Restorefiles@firemail.cc virus. We recommend using free malware removal tools. Only after you are completely sure that the virus has been removed, start decrypting the files.

How to decrypt files encrypted by Restorefiles@firemail.cc virus

Using the STOP decryptor is not difficult, just follow the few steps described below.
 

STOP Djvu decryptor

STOP Djvu decryptor

  • Download STOP Djvu decryptor from here (scroll down to ‘New Djvu ransomware’ section).
  • Run decrypt_STOPDjvu.exe.
  • Add the directory or disk where the encrypted files are located.
  • Click the ‘Decrypt’ button.
Virus

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

Leave a Reply Cancel reply




New Guides

All FILES ENCRYPTED RSA1024
Admin@sectex.net ransomware. Recover Encrypted Files.
All FILES ENCRYPTED RSA1024
Nmode@tutanota.com ransomware. Recover Encrypted Files.
unwanted ads
How to remove CentralHere app (Virus removal guide)
unwanted ads
How to remove SearchPrimary app (Virus removal guide)
unwanted ads
How to remove ResultSync app (Virus removal guide)

Follow US

Search

Useful Guides

adwcleaner
AdwCleaner – Review, How to use, Comments
ads by adware
How to remove Adware from Windows 10 (Virus removal guide)
How to reset Google Chrome settings to default
Best free malware removal tools
Best Free Malware Removal Tools 2019
Files encrypted by ransomware become useless
How To Recover Encrypted Files (Ransomware file recovery)

Recent Posts

Files encrypted with .grod extension
.Grod file extension. Remove Grod virus. Restore, Decrypt .grod files.
system.99-safe-redirects.xyz
How to remove System.99-safe-redirects.xyz pop-ups (Virus removal guide)
Monetizer.good-today.com
How to remove Monetizer.good-today.com pop-ups (Virus removal guide)
Hernclinicsfun.info
How to remove Hernclinicsfun.info pop-ups (Virus removal guide)
Aptaniale.club
How to remove Aptaniale.club pop-ups (Virus removal guide)

MYANTISPYWARE.COM

  • About Us
  • Contact Us

NEED A HELP ?

If you're seeing unwanted pop-ups or ads in your web-browser, you might have an adware installed on your computer. Use the following guide to stop pop-up ads and remove malicious software. Or ask for help here.

Links

  • Downloads
  • Instructions
  • Questions and Answers
  • Free Malware Removal Tools
Copyright © 2004 - 2019 My AntiSpyware - Free antispyware programs and Spyware Removal Instructions.