DIGIT-ARC read-only archive · snapshot: July 23, 2026

krusop ransomeware

28 posts · originally from https://geek.digit.in/community/threads/krusop-ransomeware.206610/

avichandana20000
avichandana20000 Original post #1
Aug 11, 2019 at 1:43 PM
today my system has been infected with KRUSOP RANSOMEWARE and all files have been encrypted with .krusop extension..
I have tried STOPDecrypter.....
krusop.JPG
BUT IN VAIN.

I have lost my daughter's all pic from her birth to till date when she is 10 years.
Nerevarine
Aug 11, 2019 at 6:40 PM
most likely there is very little you can do. I would suggest remove all the harddrives from it and keep it safe somewhere, maybe after a few months a fix for this ransomware would be found and you can restore your pics. I wouldnt hold too much hope though.

Are you using windows 7 or 10 ?
avichandana20000
Aug 11, 2019 at 6:52 PM
most likely there is very little you can do. I would suggest remove all the harddrives from it and keep it safe somewhere, maybe after a few months a fix for this ransomware would be found and you can restore your pics. I wouldnt hold too much hope though.

Are you using windows 7 or 10 ?
win 7
Nerevarine
Aug 11, 2019 at 7:02 PM
If you plan on using an outdated operating system, with no proper security updates or measures, then it is a good idea to follow best practices on how to use the internet, what to avoid and not let anyone plug in a flash drive into your system. Let this be a lesson, for the future on what to avoid atleast..
W
Aug 11, 2019 at 7:12 PM
If you plan on using an outdated operating system, with no proper security updates or measures, then it is a good idea to follow best practices on how to use the internet, what to avoid and not let anyone plug in a flash drive into your system. Let this be a lesson, for the future on what to avoid atleast..
Win 7 still gets regular security updates till 14th jan 2020.A good AV is must though for win 7(free like avira/avast or paid ones like kaspersky/bitdefender).
W
Aug 11, 2019 at 7:18 PM
I have lost my daughter's all pic from her birth to till date when she is 10 years.
That is why one must always keep backup of important data in at least two different places(an external hdd &/or an online storage like google drive/onedrive--look for Office 365 on amazon). Your data is gone & practically zero chances of rescue.
avichandana20000
Aug 11, 2019 at 7:33 PM
That is why one must always keep backup of important data in at least two different places(an external hdd &/or an online storage like google drive/onedrive--look for Office 365 on amazon). Your data is gone & practically zero chances of rescue.
Unfortunately two ext hdd were also attached to it at that time
W
Aug 11, 2019 at 7:55 PM
Unfortunately two ext hdd were also attached to it at that time
Another point to note is never to keep your backup ext hdd always connected to pc(same reason why you should never setup some kind of auto sync feature for online storage as it may also copy compromised data & delete the original data stored in online drive.Always upload important data to online drive manually using web interface). Btw which antivirus were you using.
W
Aug 12, 2019 at 2:14 AM
Latest version & regularly updated? Is win 7 regularly updated? Are the browsers used regularly updated(I hope you were not using IE)?
maheshn
maheshn #11
Aug 12, 2019 at 11:36 AM
On some other site it says malwarebytes can remove the infection. (not for recovering files though)


Remove Krusop Ransomware (.krusop File Decryption) - Virus Solution and Removal

It also says that if you had system restore enabled, and restore point before getting infected is available you may be able to recover the files.

alternate with more info

How to remove STOP Ransomware and decrypt .nvetud, .zatrov, .lotej or .kovasoh files | BugsFighter
avichandana20000
Aug 12, 2019 at 12:06 PM
mahesh...i have restored system to previous time...but that only restores c drive not the datas of d drive.

my files are encrypted with .krusop which is still unbreakable i think
W
Aug 12, 2019 at 12:47 PM
On some other site it says malwarebytes can remove the infection. (not for recovering files though)
Never trust a system which was once infected in a major way like this,always format & fresh install.
saswat23
saswat23 #14
Aug 12, 2019 at 1:46 PM
Also completely scan your system with AdwCleaner to detect and clean any leftovers of this ransomware.
Else proceed with fresh installation as @whitestar_999 suggested.
B
Aug 12, 2019 at 4:22 PM
today my system has been infected with KRUSOP RANSOMEWARE and all files have been encrypted with .krusop extension..
I have tried STOPDecrypter.....View attachment 18218 BUT IN VAIN.

I have lost my daughter's all pic from her birth to till date when she is 10 years.

Sad to hear that man. That sucks.
avichandana20000
Aug 13, 2019 at 12:07 PM
installed win10 in ssd....now some drivers like logitech G110 is 32 bit in the cd they provided.. how to gt a 64 bit ?
W
Aug 13, 2019 at 2:01 PM
Got it from logitech offiial site
From my link? Can you post the link from where you got drivers because on logitech official site thereis only link for software not driver for G110.
avichandana20000
Aug 14, 2019 at 11:54 PM
Logitech G110 Driver and Software Download
W
Aug 15, 2019 at 8:33 AM
That is not logitech official site(still looks ok),official driver is automatically installed via windows update also.
avichandana20000
Aug 15, 2019 at 5:05 PM
That is not logitech official site(still looks ok),official driver is automatically installed via windows update also.
win updt fails to do that first....then i tried from from the cd provided but that contains only 32 bit...hence need to search and landed up here. Now the driver is working


found this:

STOP Ransomware (.STOP, .Puma, .Djvu, .Promo, .Drume) Help & Support Topic - Page 430 - Ransomware Help & Tech Support
W
Aug 15, 2019 at 6:17 PM
Well you can always hope that may be a solution can be found in future.Keep checking that thread.
avichandana20000
Aug 17, 2019 at 8:30 PM
Well you can always hope that may be a solution can be found in future.Keep checking that thread.
"I was able to decrypt my files by changing my Personal ID on the computer and rename the infected files to the extension in which where the stopdecrypter version works. also edit the file and change the Personal ID inside before decrypting. Easy as that! "

-----what does this line mean?
and does it really work?
W
Aug 17, 2019 at 8:56 PM
"I was able to decrypt my files by changing my Personal ID on the computer and rename the infected files to the extension in which where the stopdecrypter version works. also edit the file and change the Personal ID inside before decrypting. Easy as that! "

-----what does this line mean?
and does it really work?
If it was that easy it would have already been posted as solution:
upload_2019-8-17_20-53-40.png


You also haven't posted any log info there.It may be helpful to any future possible solution but if your data is encrypted by an online key(future solution looks possible only for offline keys) then chances are almost zero.
Zangetsu
Zangetsu #28
Aug 19, 2019 at 11:51 AM
"I was able to decrypt my files by changing my Personal ID on the computer and rename the infected files to the extension in which where the stopdecrypter version works. also edit the file and change the Personal ID inside before decrypting. Easy as that! "

-----what does this line mean?
and does it really work?
This is not possible! The files are encrypted by the creator of Ransomware. And there is no guarantee it will be decrypted even after paying the ransom.