How to remove Tuid ransomware and decrypt .tuid files

Tuid is a name of yet another ransomware program – simply put, a computer virus that encrypts all the files on your computer and demands payment to decrypt them – effectively forcing you to pay a ransom, with your data being held hostage. This program is a part of the STOP/Djvu ransomware family (other examples include Nqsq and Reco), and, as such, behaves very similarly to other programs in this family. All files encrypted by Tuid are given the .tuid file extension, and a single unencrypted file, named “_openme.txt” is placed on the victim’s desktop. This is a note that contains the demand for ransom and the instructions on how to pay it.
The major talking points of this note are:

  1. The note says that you can send one file to the criminals for free, and they will decrypt it as a guarantee. This guarantees NOTHING. Sure, it shows that the hackers have the ability to decrypt your files, but not that they will do it, should you choose to pay.
  2. The note asks for ransom, specifically $980. The note also mentions that by contacting the hackers within 72 hours from the attack, the victim can receive a 50% discount, thus reducing the price to $490. This is a common tactic employed by these types of programs to create a false sense of urgency and push the victim into making rash decisions.
  3. The note also mentions that it is impossible to restore the files without payment. This is simply a lie. Certain programs, covered in this article, have a chance of decrypting the data. Though it is not always possible, it is not impossible either.

Generally, giving in to the hackers’ demands is not recommended. As we already mentioned, they do not provide you with any actual guarantees of decrypting the data. Even if they decrypt one file as the note promises, that is only done to make you more likely to pay. You are dealing with criminals here, people who are already breaking the law in a major way. Not the kind of people that should be trusted. It is also important to understand that, should you decide to pay, you will likely be targeted again, as paying will make you a valuable target in their eyes. You paid once, maybe you’ll pay again, the logic goes. Even contacting the criminals, without paying, still increases the risk of a future attack.
Whether to pay or to try and remove Tuid and recover the data for free is your choice. But do keep in mind that both of these choices are a gamble. Paying does not guarantee that you will get your files back, but it does guarantee a loss of money. Read the guide below if you’ve decided to not pay.

How to remove Tuid automatically

The easiest and convenient way to get rid of malware is to use a proper anti-malware program that can eliminate Tuid and all its traces in just a few clicks. If your files have been encrypted, removing the virus will not decrypt your files – a separate step is needed to do that.

Performing an antimalware scan with Norton would automatically search out and delete all elements related to the ransomware. It will also protect your computer from future threats. Download it by clicking the button below:

Download Norton

How to decrypt files

Restore files with Stellar Data Recovery

Stellar Data Recovery is an essential tool in the fight against ransomware-type viruses that can recover encrypted files.

stellar data recovery tool

  1. Download Stellar Data Recovery and launch it
  2. Select the drive you want to recover and click START SCAN
  3. After scanning is finished, you are presented with a list of recoverable files found.
  4. Select the required files and click the Recover

Download Stellar Data Recovery
If this did not help, you may also try other recovery options.

Restore files with STOPDecrypter

STOPDecrypter is a program specifically aimed at decrypting files encrypted by STOP/Djvu-type ransomware. As Tuid is one such virus, this program may be able to restore your files.
Download STOPDecrypter

Restore the system

  1. Initiate the search for system restore
  2. Click on the result
  3. Choose the date before the infection appearance
  4. Follow the on-screen instructions

Roll the files back to the previous version

  1. Right-click the file and choose Properties
  2. Open the Previous Version tab
  3. Select the latest version and click Copy
  4. Click Restore

Leave a Reply

Your email address will not be published. Required fields are marked *