.truke Files Virus – Remove It and Restore Files

What is .truke virus? How did it infect? Can .truke files be recovered?

The so-called virus .truke is devastating ransomware that plagues computer systems in order to encrypt personal files with strong cipher algorithm. Like most malicious programs of this type, .truke forces its victims to pay ransom fee for a specific decryption tool. As reported by security researchers, .truke files virus belongs to the infamous STOP/Djvu ransomware family. When this ransomware encrypts a file, it appends the extension .truke. For example the file family.jpg will be renamed to family.jpg.truke when encrypted. An additional trait of infection with this ransomware is the appearance of a ransom note file named _readme.txt in all folders that contain encrypted data. The file may be placed on the desktop as well.

The good news for all victims of STOP .truke ransomware is that the security researcher Michael Gillespie cracked the code of this variant and released an updated version of his STOP ransomware decrypter.

So the moment you remove all malicious files and objects from your infected system you can enter our data recovery guide where you will find a download link for the free .truke decryption tool and learn how to proceed with the decryption process.

Have in mind that the tool is designed to support specific offline IDs, so it may not be effective for all occasions of .truke ransomware infections.

As identified by security researchers, the so-called .truke files virus is yet another strain of

STOP/ Djvu ransomware. Once started on a computer system, it interferes with essential settings to become able to reach personal files and encode them with sophisticated cipher algorithm. Following encryption, it leaves all corrupted files renamed with an extension of the same name .truke. In the picture on the right you can see how the image file family.jpg will appear when the ransomware encrypts it:

All changes which .truke virus applies enable it to remain undetected during the attack. Some modifications affect main registry keys like RUN and RUNONCE. Since these keys manage the automatic execution of many essential files they perfectly support ransomware’s persistent presence on the machine. Once the threat adds malicious values under these keys it becomes able to load on every system start.

The main goal of .truke virus is to blackmail its victims into transferring ransom fee to cybercriminals who control the attack. That’s why it drops the _readme.txt file on the infected computer. This file contains ransom message with instructions on the ransom payment process. Here is a copy of its text:

Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-pPLXOv9XTI
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
gorentos@bitmessage.ch
Reserve e-mail address to contact us:
gorentos@bitmessage.ch
Telegram

If you want to prevent yourself from falling victim to hackers once again, we recommend you to refrain from contacting cybercriminals and continue with our thorough .truke files virus removal guide. The steps below will help you remove all malicious files and objects from the infected computer and show you several alternative data recovery approaches that may be efficient for .truke files recovery.

As regards the distribution of .truke files virus, it is likely to be realized with the help of common techniques such as malspam, malvertising, software bundles, and corrupted websites. The most preferred by hackers is malspam. It is realized via massive email spam campaigns. So beware every time when a received email contains the following elements:

• URL address that appears in the form of an in-text link, banner, image, button or typical link. When opened in the browser this link could load compromised web page that is set to download and execute infection files directly on the PC.
• A file attachment of well-known file format like .rar, .zip, .docx, .mp3, .txt, etc. The attached file could be set to evade active security measures and trick you into running the ransomware on your PC.

We should inform you that there is a free STOP decrypter which is expected to be updated to support decryption of .truke files soon. So it is advisable to refrain from any negotiations with hackers and keep an eye on our removal guide for updates. As soon as the creator of STOP ransomware decrypter, Michael Gillespie manages to update his tool we will update our .turke ransmware removal with information and download option.

The so-called .truke files virus is a threat with highly complex code that corrupts both system settings and valuable data. So an infected system could be used in a secure manner again only after all malicious files and objects are removed. For the purpose, we recommend the help of our guide that reveals how to remove .truke ransomware from the computer. In addition, the guide presents several alternative data recovery approaches that may be helpful for the restore of .truke files. We remind you to back up all encrypted files to an external drive before the recovery process.