What is .truke virus? How did it infect? Can .truke files be recovered?
The so-called virus .truke is devastating ransomware that plagues computer systems in order to encrypt personal files with strong cipher algorithm. Like most malicious programs of this type, .truke forces its victims to pay ransom fee for a specific decryption tool. As reported by security researchers, .truke files virus belongs to the infamous STOP/Djvu ransomware family. When this ransomware encrypts a file, it appends the extension .truke. For example the file family.jpg will be renamed to family.jpg.truke when encrypted. An additional trait of infection with this ransomware is the appearance of a ransom note file named _readme.txt in all folders that contain encrypted data. The file may be placed on the desktop as well.
|Name||.truke Files Virus|
|Short Description||Encrypts files on your computer and extorts a ransom fee for their recovery.|
|Symptoms||Important files are locked and renamed with .truke extension. A ransom message requires ransom payment for a decryption tool.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by .truke Files Virus |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .truke Files Virus.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
.truke Files Virus – Update June 2019
The good news for all victims of STOP .truke ransomware is that the security researcher Michael Gillespie cracked the code of this variant and released an updated version of his STOP ransomware decrypter.
So the moment you remove all malicious files and objects from your infected system you can enter our data recovery guide where you will find a download link for the free .truke decryption tool and learn how to proceed with the decryption process.
Have in mind that the tool is designed to support specific offline IDs, so it may not be effective for all occasions of .truke ransomware infections.
.truke Files Virus (STOP Ransomware) – How Does It Infect and What Does It Do?
As identified by security researchers, the so-called .truke files virus is yet another strain ofSTOP/ Djvu ransomware. Once started on a computer system, it interferes with essential settings to become able to reach personal files and encode them with sophisticated cipher algorithm. Following encryption, it leaves all corrupted files renamed with an extension of the same name .truke. In the picture on the right you can see how the image file family.jpg will appear when the ransomware encrypts it:
All changes which .truke virus applies enable it to remain undetected during the attack. Some modifications affect main registry keys like RUN and RUNONCE. Since these keys manage the automatic execution of many essential files they perfectly support ransomware’s persistent presence on the machine. Once the threat adds malicious values under these keys it becomes able to load on every system start.
The main goal of .truke virus is to blackmail its victims into transferring ransom fee to cybercriminals who control the attack. That’s why it drops the _readme.txt file on the infected computer. This file contains ransom message with instructions on the ransom payment process. Here is a copy of its text:
Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.
To get this software you need write on our e-mail:
Reserve e-mail address to contact us:
If you want to prevent yourself from falling victim to hackers once again, we recommend you to refrain from contacting cybercriminals and continue with our thorough .truke files virus removal guide. The steps below will help you remove all malicious files and objects from the infected computer and show you several alternative data recovery approaches that may be efficient for .truke files recovery.
As regards the distribution of .truke files virus, it is likely to be realized with the help of common techniques such as malspam, malvertising, software bundles, and corrupted websites. The most preferred by hackers is malspam. It is realized via massive email spam campaigns. So beware every time when a received email contains the following elements:
- URL address that appears in the form of an in-text link, banner, image, button or typical link. When opened in the browser this link could load compromised web page that is set to download and execute infection files directly on the PC.
- A file attachment of well-known file format like .rar, .zip, .docx, .mp3, .txt, etc. The attached file could be set to evade active security measures and trick you into running the ransomware on your PC.
We should inform you that there is a free STOP decrypter which is expected to be updated to support decryption of .truke files soon. So it is advisable to refrain from any negotiations with hackers and keep an eye on our removal guide for updates. As soon as the creator of STOP ransomware decrypter, Michael Gillespie manages to update his tool we will update our .turke ransmware removal with information and download option.
Remove .truke Files Virus and Restore Data
The so-called .truke files virus is a threat with highly complex code that corrupts both system settings and valuable data. So an infected system could be used in a secure manner again only after all malicious files and objects are removed. For the purpose, we recommend the help of our guide that reveals how to remove .truke ransomware from the computer. In addition, the guide presents several alternative data recovery approaches that may be helpful for the restore of .truke files. We remind you to back up all encrypted files to an external drive before the recovery process.
- Guide 1: How to Remove .truke Files Virus from Windows.
- Guide 2: Get rid of .truke Files Virus from Mac OS X.
How to Remove .truke Files Virus from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove .truke Files Virus
Step 2: Uninstall .truke Files Virus and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it.
Step 3: Clean any registries, created by .truke Files Virus on your computer.
The usually targeted registries of Windows machines are the following:
You can access them by opening the Windows registry editor and deleting any values, created by .truke Files Virus there. This can happen by following the steps underneath:
Step 4: Scan for .truke Files Virus with SpyHunter Anti-Malware Tool
Step 5 (Optional): Try to Restore Files Encrypted by .truke Files Virus.
Ransomware infections and .truke Files Virus aim to encrypt your files using an encryption algorithm which may be very difficult to decrypt. This is why we have suggested a data recovery method that may help you go around direct decryption and try to restore your files. Bear in mind that this method may not be 100% effective but may also help you a little or a lot in different situations.
If the above link does not work for you and your region, try the other two links below, that lead to the same product:
Get rid of .truke Files Virus from Mac OS X.
Step 1: Uninstall .truke Files Virus and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove .truke Files Virus via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove .truke Files Virus files from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as .truke Files Virus, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Step 3 (Optional): Try to Restore Files Encrypted by .truke Files Virus on your Mac.
Ransomware for Mac .truke Files Virus aims to encode all your files using an encryption algorithm which may be very difficult to decode, unless you pay money. This is why we have suggested a data recovery method that may help you go around direct decryption and try to restore your files, but only in some cases. Bear in mind that this method may not be 100% effective but may also help you a little or a lot in different situations.