Urgent Help Needed: Files Infected with Ransomware on Teacher’s Laptop
Recently, my teacher encountered a troubling issue with his laptop after downloading some PDFs from an unknown source. This unfortunate incident has resulted in the majority of his files being altered and now sporting a “.nobu” extension. Additionally, the Task Manager is cluttered with numerous suspicious programs that seem to have appeared out of nowhere.
To address the situation, I took the initial step of running Malwarebytes since my teacher does not have any backup of his files. Unfortunately, we cannot restore the system to a previous state, which has left us searching for solutions to recover the .nobu files. If anyone has suggestions or methods to decrypt these files, please share your expertise. I am willing to provide screenshots if necessary for further clarification.
Recent Developments
Update 1: The most critical files impacted are related to PCB design, specifically eagle files. The ransomware has compromised the necessary program, rendering it inoperable and unlocatable.
Update 2: It appears that the encryption process may involve an online key. I also attempted using Emsisoft, but unfortunately, it was not successful in remedying the situation.
Update 3: I want to express my gratitude to everyone who has shown willingness to assist. My teacher has seen the responses on my phone and was truly touched by the support from the community. Despite being in the IT field, teaching is a secondary job for him, and he relies heavily on this laptop for both PCB design tasks and programming—such as C and Arduino projects.
Update 4: I have included some images captured from my phone, as screenshots were not functioning properly on the device. You can view them here:
– Desktop View
– Ransomware Letter
Before considering a full format of the laptop, I am committed to exploring all potential decryption software options available. Any assistance or advice from this community would be immensely appreciated. Thank you once again for your support!
Share this content: