Share via

Files extension - *.docx.sspq

Anonymous
2021-06-19T02:56:11+00:00

My files has been renamed as *.docx.sspq; *.pdf.sspq etc.
Help me to resolve this sspq extension.

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

6 answers

Sort by: Most helpful
  1. Anonymous
    2021-06-19T03:03:19+00:00

    Unfortunately, your computer has been successfully attacked by ransomware.

    It may be possible to decrypt your files, although no guarantees can be made.

    Equally unfortunate: Many websites claiming to decrypt your files are useless and self-serving. If a website claims to be able to decrypt files that were encrypted by a type of ransomware for which there is no publicly available decryption tool, you need to be highly suspicious.

    You would be well-advised to seek help from a professional, and the sooner the better.

    4 people found this answer helpful.
    0 comments No comments
  2. JuliaMarvin 19,075 Reputation points Volunteer Moderator
    2021-06-19T06:04:16+00:00

    Your files were encrypted with a new variant of STOP ransomware... 

    > https://support.emsisoft.com/topic/36935-all-my-files-were-encrypted-to-sspq-extension/?do=findComment&comment=217435

    Please read the 1st post of the STOP Ransomware (.STOP, .Puma, .Djvu, .Promo, .Drume) Support Topic****

    and also these  FAQs with detailed information etc about the Emsisoft Decryptor

    > https://blog.emsisoft.com/en/26164/how-to-remove-ransomware-the-right-way-a-step-by-step-guide/ 

    If you have an offline ID, you might be able to recover your files....

    More information here:https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/****

      <- The decrypter will tell you if your files are decryptable, whether you're dealing with an "old" or "new" variant of STOP/Djvu, and whether your ID is online or offline."

    How to identify if infected with an OFFLINE or ONLINE KEY

    Also see:

    2 people found this answer helpful.
    0 comments No comments
  3. Anonymous
    2021-07-03T08:29:13+00:00

    https://www.emsisoft.com/ransomware-decryption-tools/stop-djvu

    it should work as a decryptor for the new versions

    1 person found this answer helpful.
    0 comments No comments
  4. JuliaMarvin 19,075 Reputation points Volunteer Moderator
    2021-07-02T19:12:21+00:00

    FYI:

    https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/page-715#entry5218260 

    "These versions all have the same offline ID :  304 : .sspg

    305 : .iqll

    306 : .ddsg

    The offline/private key has been received by Emsisoft. Any victims of these 3 variants that had files encrypted by the offline key can recover their files. "

    1 person found this answer helpful.
    0 comments No comments
  5. Brian Tillman 25,040 Reputation points Independent Advisor
    2021-06-19T03:42:49+00:00

    Hi. I'm Brian, an Independent Advisor.

    You've managed to install ransomware. I hope you have a good backup. See this: https://malwaretips.com/blogs/remove-sspq-ranso....

    Note that the web site I referenced isn't a Microsoft web site but it appears to contain accurate information and no potentially unwanted apps. It may, however, contain ads and use cookies, so be aware.

    1 person found this answer helpful.
    0 comments No comments