DECRYPT VPSH FILES

Fix and open large VPSH files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

1. Create a copy of encrypted file to a separate folder using Copy > Paste commands.
2. Now, right-click the created copy and choose Rename. Select the VPSH extension and delete it. Press Enter to save changes.
3. In the prompt asking whether you want to make the changes as file might become unusable, click OK.
4. Try opening the file.

STOP/DJVU DECRYPTION TOOL USAGE GUIDE

STOP/DJVU ransomware versions are grouped into old and new variants. VPSH ransomware virus is considered the new STOP/DJVU variant, just like LMAS, WRUI, LMAS, REJG, PCQQ, IGVM, NUSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.

Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.

In order to test the tool and see if it can decrypt VPSH files, follow the given tutorial.

1. Download the decryption tool from Emsisoft.
2. Click the little arrow next to your download and choose Show in Folder.
   
3. Now, right-click the file and choose Run as Administrator. If asked, enter administrator's password.
   
4. In UAC window, click Yes.
5. Click Yes to agree to software terms in both windows.
   
6. The tool will automatically include C:// disk as a location to decrypt. The file recovery tool will prepopulate the locations to scan, including connected data storage drives or network drives. Click Add folder if you wish to add additional locations.
   In Options tab, you can choose to keep encrypted file copies. We recommend leaving this option selected, especially if you do not know if the decryption tool will work.
   
7. Click Decrypt to start restoring VPSH files. You will see the progress in the Results tab. Here, you can see messages from the tool, such as whether the decryption procedure is successful, or you need to wait for an update.
   You might also be informed that online key was used to encrypt your files. In such case, the decryption tool won't work for you, and the only way to recover your files is to use a data backup.
   

Meanings of decryptor's messages

The VPSH decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:

Error: Unable to decrypt file with ID: [example ID]

This message typically means that there is no corresponding decryption key in the decryptor's database.

No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible

This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.

Result: No key for new varient offline ID: [example ID]
This ID appears be an offline ID. Decryption may be possible in the future.

If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your VPSH extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

REPORT INTERNET CRIME TO LEGAL DEPARTMENTS

Victims of VPSH ransomware virus should report the Internet crime incident to the official government fraud and scam website according to their country:

• In the United States, go to the On Guard Online website.
• In Australia, go to the SCAMwatch website.
• In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.
• In Ireland, go to the An Garda Síochána website.
• In New Zealand, go to the Consumer Affairs Scams website.
• In the United Kingdom, go to the Action Fraud website.
• In Canada, go to the Canadian Anti-Fraud Centre.
• In India, go to Indian National Cybercrime Reporting Portal.
• In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.

Another recommendation is to contact your country's or region’s federal police or communications authority.

FREQUENTLY ASKED QUESTIONS