Getting Your ID and MAC With STOPDecrypter
You can get STOPDecrypter from this link. Once you're done downloading it, follow the instructions below. A number of the steps include pictures to make it easier to see what you're supposed to do.
Note that it is important to run STOPDecrypter on the computer that was infected. The output from STOPDecrypter is preferred over trying to supply the information yourself.
The creator of STOPDecrypter has an FAQ at this link with additional information. Any questions you have should be answered in the FAQ.
Open the file you downloaded.
When a window opens with two files in it (“README” and “STOPDecrypter”), double-click on the one named
STOPDecrypter.
Windows will warn you about the application depending on other files. Click the
Extract all button to prevent errors.
In the window that opens, click the
Extract button to confirm extraction of the files.
A window almost identical to the one in step 2 will open. This shows the extracted files. Double-click on
STOPDecrypter again to run it.
STOPDecrypter will display a message asking your if you have read
the FAQ. You must click
Yes in order to continue. Please read the message before clicking “Yes”.
STOPDecrypter will now open, and will show your ID's and MAC addresses in the box on the left.
Please copy this information, and paste it into a reply to the forum post or e-mail where you were asked to follow these instructions. Alternately you can leave the information in a reply to the STOP ransomware help thread on the BleepingComputer forums at
this link.
Once your ID and MAC address have been posted, it can be forwarded to the creator of STOPDecrypter, or if it was posted in the BleepingComputer STOP ransomware help thread then he should find it himself and archive it. If he is able to figure out your decryption key, then you should be contacted with information on how to decrypt your files.