What happened to my files?
A strange extension "FGNH" has been added to your files, and you can't open your
files.
So, you think your files are locked ?!.
No,the real fact is ... your files are totally encrypted by a Ransomware
affect, which generate a new variant belong to some types of malwares.
These types of attack can lock /encrypt/ damage your private files
(videos, images, documentations) and whatever you think. Then your
files' name will end by a new extension, So you can’t obtain access to
them at all.
By adding its own extension to all the encrypted data. For
example, the file “timesheet.xls and video.mp4” will be titled as
“timesheet.xls.fgnh and video.mp4.fgnh”.
When the encryption is accomplished, it will put
text document (_readme.txt) inside each folder that contains the
encrypted files.
The used technique for file's encryption will release a unique
decryption key, it is different for each computer system.
The needed decryption key is hosted on a special server under the
total control by the attacker who have actually launched the
ransomare virus into the internet joined by each the victim id,
the users are told to contact the attackers through e-mail or by
telegram to pay the ransom in the quantity of $980 and this
quantity will have 50% discount rate, that mean the ransom amount
falls to $490 if the victim pay for them within 72 hours.
We highly recommend that you do not pay the ransom, There is no
warranty that these online cyber criminals will keep their promises, the victims may lose
their money for nothing.
Also, It's not recommended to contact the scammers as they
instruct. Do not send them your money.
Malware ID :
- Type of : Ransomware
- Family: STOP/DJVU
- Description: Locks all the data stored on your system and
requires a money ransom to be paid on your part supposedly to recover
your important files.
- Encryption: File encryption is performed by means of the AES-1024 algorithm encryption. Once the
encryption is completed, to adds its special extension to all the
files modified by it.
- Distribution Method: Adware bundles and
software cracks.
The Web is now loaded with infections comparable to
the virus. It's recommended for you to frequently make
backups of all your essential documents to an external storage.
like, the USB Flash Drive, external hard disk drive, or using the
cloud data storage services. Keeping the backups on your system
drive is very risky.
📌 Table of Content
How did Fgnh reach My computer system?
This type can hit your system by a method from
these:
1- freeware third-party programs, cracks.
2- spam e-mails ;
3- free hosting websites;
4- torrent software.
Opening these types or clicking on the harmful links might
harm the system.
How to Protect our systems from the fgnh Cyber attack?
1. Do not open any suspicious e-mail attachments, specifically if
the sender is unknown for you .
2. Do not install unsecured freeware.
3. install an anti malware or an anti virus with last update
even if free, to check every file you downloaded it from the web
before opening it.
Is there a way for FGNH Removal?
fgnh method in Mango School Channel will show you how to get rid of this.
After you successfully remove it, install an antivirus to protect your files.
-
If you are not yet able to remove the virus, scan your pc with any
malware protection and remove the virus or install a new
Windows to avoid any new data encryption.
-
If you have an activated shadow copy, you will be able to recover
your files from it.
-
You have to Change all your passwords used on the infected device
because the ransomware or virus will pull the passwords stored in
your browser and send them to the gangs.
Since switching to the New STOP Djvu variants (and the release of
.fgnh) the malware developers have been consistent on using 4-letter
extensions.
STOP / DJVU will leave files (ransom notes) named _readme.txt.
How to Decrypt fgnh files that are encrypted By STOP/DJVU
Ransomware?
STOP (Djvu) has two versions.
1. Oldest Version: ...decryption for most of these versions was
previously supported by STOPDecrypter if infected with an OFFLINE
KEY (and some of ONLINE KEYS), then updated to a new Emsisoft
Decryptor method for these old Djvu variants...the decrypter will
only decrypt your files without submitting file pairs if you have
an OFFLINE KEY. For ONLINE KEY infection... I have made a tutorial in (English and Arabic languages) for victims who got their files encrypted with some old STOP/DJVU variants .
2. New Version: The newest extensions released around the end of
August 2019 AFTER the criminals made changes.... OFFLINE
IDs/KEYS for some newer variants have been obtained by Emsisoft and
uploaded to their server. This is possible after a victim pays the
ransom, receives a private key from the criminals and shares
(donates) that key with the Emsisoft Team. ONLINE KEYS are UNIQUE
for each victim and just like older versions, they are randomly
generated in a secure manner and are impossible to decrypt without
paying the ransom which is not advisable.
Run the decrypter on some of your encrypted files. It will tell you
the status of those files.
If you have an OFFLINE ID and its key is loaded in Emsisoft servers
you can download Emsisoft decrypt tool to decrypt your files
that are encrypted with the same type.
-
In case you have ONLINE ID:
-
for videos and mp3 files, you can download disktuna, but for
the video, you will need to have a video filmed with the same
camera working or a video with the same settings.
-
for PDF files, you can try ilovePDF site that can fix the files
partially.
-
for recover tools in general, they are not very effective with
this type of infection, but if you want to try, you can use these
free programs:
The important thing is that when you come to retrieve anything, you
have to restore it to an external hard drive, not to the same hard
drive.
Is there any Recovery tools used for fgnh Online encryption ID ?
Yes, you can use any of these tools according to your encryption
status.
-
Photorec
-
Get data back
-
for non-free programs, you can try
-
Disk Drill, Stellar data recovery, Easeus data recovery.
