Nikon RAW NEF and STOP DJVU ransomware

By | May 18, 2020

It turns out, RAW Nikon files (NEF) are easier to ‘repair’ even than RAW Canon files.

I will expand this post this week, and add a video, but full resolution JPEGs can be extracted from corrupt NEF files affected by STOP DJVU without the trickery required to repair Canon CR2 files. It appears the full res preview survives the encryption due to not being within the first 150 KB of the file. Full resolution JPEG inside a CR2 file is partially encrypted (header + portion of image data), in NEF it is not affected.

I’ll also be updating JPEG-Repair to accommodate easier selection of the corrupt files (all files with extensions below are ignored and not available for selection).

Steps to recover full resolution JPEG data from (any) STOP/DJVU affected Nikon RAW (NEF) file

  1. Select the Extract tool
  2. Click folder button to select file(s)
  3. Select the file(s)
  4. Set minimum resolution to 3.0 MP (Mega Pixels)
  5. Click OK
  6. Click Repair

JPEGs will be saved to the folder containing the NEF files.

.STOP, .SUSPENDED, .WAITING, .PAUSA, .CONTACTUS, .DATASTOP, .STOPDATA, .KEYPASS, .WHY, .SAVEfiles, .DATAWAIT, .INFOWAIT,.djvut .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promoks, .promorad, .promorad2, .kroput, .kroput1, .charck, .pulsar1, .puma, .pumax, .pumas, .shadow, .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden, .drume, .tronas, .trosak, .grovas, .grovat, .roland, .refols, .raldug, .etols, .guvara, .moresa, .verasto, .hrosas, .kiratos, .todarius, .hofos, .roldat, .dutan, .sarut, .fedasot, .browec, .norvas, .ferosas, .rectot, .skymap, .mogera, .rezuc, .stone, .redmat, .lanset, .davda, .poret, .pidon, .heroset, .myskle, .boston, .muslat, .gerosan, ,vesad, .horon, .neras, .dalle, .lotep, .nusar, .litar, .truke, .besub, .cezor, .lokas, .godes, .budak, .vusad, .herad, .berosuce, .gehad, .gusau, .madek, .tocue, .darus, .lapoi, .todar, .dodoc, .bopador, .novasof, .ntuseg, .nelasod, .mogranos, .cosakos, .nvetud, .lotej, .kovasoh, prandel, .zatrov, .masok, .ndarod, .access, .format, .brusaf, londec, .krusop, .nasoh, .nacro, .pedro, .mtogas, .coharos, .nuksus, .vesrato, .masodas, .stare, .cetori, .carote, .shariz, .gero, .hese, .geno, .seto, .peta, .moka, .meds, .kvag, .domn, .karl, .nesa, .boot, .kuub, .noos, .reco, .xoza, .bora, .leto, .werd, .nols, .coot, .derp, .nakw, .toec, .mosk, .lokf, .peet, .grod, .kodg, .mbed, .zobm, .rote, .msop, .hets, .righ, .gesd, .merl, .nbes, .mkos, .redl, .piny, .kodc, .nosu, .reha, .topi, .npsg, .btos, .repp, .alka, .bboo, rooe – Source: https://geeksadvice.com/remove-djvu-ransomware-virus/

 

Leave a Reply

Your email address will not be published.