[Gadzso]

Hi, my friend just got the new Qewe ransomware from downloading a cracker for a program called Serato Dj. I offered him to help, but i don't know where to start. I identified the virus as all of his files were encrypted and renamed to .qewe files. If you can help me to restore his files i would really appreciate it .

[Drako]

That's what happens when you download from shady cracked program websites. Fortunately there are trustworthy websites with cracked programs out there you just have to know what to look for, and how to use VirusTotal.

Hopefully he hasn't paid the creators yet. You should never pay ransomware ransoms. It just helps fund the organization or person that created the ransomware.

If your friend has Windows 10, he may be able to load a restore point. Unless something went wrong or is disabled, you should be able to do just that.

[mothered]

If your friend has Windows 10, he may be able to load a restore point. Unless something went wrong or is disabled, you should be able to do just that.

That's provided there's restore points available, and the System Volume Information Folder hasn't been Infected by the ransomware.

[Gadzso]

He doesn't have the money nor the will to pay the ransom. There isn't any restore points available. I checked it myself and it's more complicated then that. Emisoft offers a tool which you can decrypt certain files infected by the DJVU Stop Ransomware but not for the variant which i'm interested in (QEWE ransomware). Is there a software to decrypt qewe file if you know something please post a reply, because my friend lost all of his music files and he used to be a dj and now he needs to start all over again.

[Charonone]

I got that virus too... I think it's impossible to remove, because it stores the keys online not offline.

[Drako]

He doesn't have the money nor the will to pay the ransom. There isn't any restore points available. I checked it myself and it's more complicated then that. Emisoft offers a tool which you can decrypt certain files infected by the DJVU Stop Ransomware but not for the variant which i'm interested in (QEWE ransomware). Is there a software to decrypt qewe file if you know something please post a reply, because my friend lost all of his music files and he used to be a dj and now he needs to start all over again.

Sorry to hear that. I would chalk everything up as a loss.

Tell your friend to buy an SSD or external SSD to keep backups. It's a better idea to buy an internal SSD for SATA speeds instead of being limited by USB. Just unplug the SATA cable when you're done using it.

If he has some sort of game client like Steam, don't backup the games. Only the save files. You can always download the games again.