Urgent Help Needed: Ransomware Attack on Teacher’s Laptop
Recently, my teacher encountered a troubling issue with his laptop after downloading PDF files from an untrustworthy site. Now, all files on his machine carry the “.nobu” extension, and the Task Manager is plagued with numerous dubious programs. Unfortunately, there were no backups of these critical files, leaving us in a precarious situation with limited options.
The Situation
Initially, I attempted to run Malwarebytes, hoping to restore his laptop to a functional state; however, without a backup, we can’t revert to a previous point in time. We are now seeking guidance on how to remove the “.nobu” extension from all affected files. If anyone has insights or suggestions, your help would be greatly appreciated! I’m planning to share some screenshots for reference as well.
Updates on Progress
-
Critical Files Affected: Among the infected files are his important Eagle files, which he uses for PCB design. This ransomware has also affected the associated Software, rendering it unusable.
-
Ransomware Encryption: We’ve determined that the encryption appears to rely on an online key. I attempted to use Emsisoft for decryption, but unfortunately, it did not yield results.
-
Community Support: A heartfelt thank you to everyone who has reached out and provided assistance! My teacher, who has a background in electronics and works in an IT firm, was genuinely touched by the outpouring of support after he saw the post on my phone. I hesitated to share his profession earlier, fearing it might lead to ridicule, but teaching is merely a side job for him; the laptop is essential for his work on PCB design and Arduino programming.
-
Visual Documentation: I’ve attached some images to illustrate the current state of his desktop and the ransomware letter. Unfortunately, I faced challenges taking proper screenshots, so here are the best captures from my phone:
- desktop Screenshot
- Ransomware Letter
Next Steps
Before resorting to formatting the laptop, I plan to explore every available decryption Software. If you have experienced a similar situation or have any recommendations for decryption tools, please share your knowledge. We are determined to recover these files and appreciate any guidance you can provide!
Share this content: