'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Files Changed to UAJS Extension (Ransomware Recovery)
Question details
The user's files have been appended with a .uajs extension and display as unreadable code when opened, indicating a ransomware infection.
- Product
- Windows File System
- Device & OS
- not provided
- Scenario
- The user attempts to access personal or work documents but discovers the file extensions have changed to .uajs and the contents are completely locked.
- Observed behavior
- Files are inaccessible, open as encrypted code instead of standard text, and bear a new .uajs extension.
Immediately disconnect your infected device from all internet connections, Wi-Fi, local networks, and external backup drives to prevent the ransomware from spreading to other systems.
Isolate the Device and Preserve Encrypted Files
Take immediate containment actions to stop the spread of the STOP/DJVU ransomware and preserve evidence for potential future decryption.
The .uajs extension is a strong indicator of a newer variant of the STOP or DJVU ransomware family. Because these often use online encryption keys, immediate decryption might not be available, but preserving the files is critical.
Unplug your ethernet cable and turn off your computer's Wi-Fi. Do not connect USB drives or external hard drives to the infected machine.
Leave the encrypted files with their .uajs extensions intact. Renaming them back to their original extensions will not fix them and may interfere with future decryption tools.
Locate and keep the ransom note (often a text file like '_readme.txt' placed on your desktop or in affected folders). This contains your personal ID which is required if a decryption tool becomes available.
Use a separate, safe device to monitor trusted cybersecurity websites (such as BleepingComputer or the No More Ransom project) for the release of free STOP/DJVU decryptors.
Restore Files from a Clean Offline Backup
If you have a backup of your files from before the infection, you can restore your data after ensuring the malware is completely removed.
Protect and Recover Documents with WPS Cloud Backup
To safeguard your critical documents against future ransomware attacks or data loss, use WPS Office. The built-in WPS Cloud service automatically backs up your files and retains historical versions, allowing you to instantly restore your work to a clean, unencrypted state.
- 1. Enable Cloud Synchronization: Open WPS Office, go to Settings, and turn on Document Cloud Sync to automatically back up your local documents to WPS Cloud.
- 2. Access File History: If a local file is compromised, log into the WPS Cloud web portal on a secure device, locate your document, and select History Versions.
- 3. Restore a Clean Version: Preview the historical versions, select the one saved just before the infection occurred, and click Restore to recover your unencrypted data.
Frequently Asked Questions
Can I fix the .uajs files by simply changing the extension back?
No. Changing the file extension from .uajs back to .docx, .pdf, or .jpg will not decrypt the file. The actual content of the file has been mathematically scrambled, and renaming it will only result in a corrupted file.
Will running an antivirus scan recover my encrypted data?
While a thorough antivirus scan is crucial for removing the active ransomware and preventing further encryption, it cannot unlock or decrypt the files that have already been converted to the .uajs format.
Is there a free decryptor available for the .uajs STOP/DJVU variant?
Because .uajs is a newer variant of the STOP/DJVU family, it typically uses an online key system for which immediate decryption tools are not available. You should preserve your files and periodically check the No More Ransom project or trusted security forums for updated decryption tools.
