Help Needed: Recovering Files Affected by Ransomware with .nobu Extension

Recently, my teacher encountered a significant issue when he downloaded some PDFs from a website. Unfortunately, this led to a malware infection on his laptop, resulting in all of his files being encrypted with the “.nobu” extension. The task manager now displays numerous unfamiliar programs, and it’s clear that the situation has become quite dire.

Seeking Solutions

Given that my teacher has no backup of his files and system restore options are unavailable, I immediately ran Malwarebytes to scan for potential threats. My primary goal is to find a way to remove the “.nobu” extension from all affected files. If anyone has experience with similar situations or knows effective methods for file recovery, your advice would be greatly appreciated. I can provide screenshots for visualization if needed.

Updates on the Situation

1. Critical Files Affected: Among the compromised data are his essential Eagle files, which he uses for designing printed circuit boards (PCBs). The ransomware has also impacted the software he utilizes, rendering it inoperative.

2. Encyption Key Discovery: It appears the encryption relies on an online key. I attempted to use Emsisoft, but unfortunately, it did not yield any results.

3. Community Support: I must express my gratitude to everyone who has offered assistance. My teacher was genuinely touched to see the outpouring of support when he discovered this post on my phone. It’s heartening to know there’s such a caring online community.

4. Background Context: My teacher has a background in electronics and works at an IT firm. He teaches as a secondary job, primarily using his laptop for PCB design and programming projects with Arduino. This context may explain why I hesitated to share this initially—I feared it might not be taken seriously.

5. Visual Evidence: I’ve attached a couple of images for reference:

6. His Desktop
7. The Ransomware Letter

Next Steps

Before resorting to formatting the laptop, I plan to explore various decryption software options. If anyone has recommendations based on their experiences with .nobu or similar ransomware, please let me know. Your insights could make a substantial difference in recovering valuable data. Thank you in advance for your help!