Urgent Help Needed: Recovering Files Affected by Ransomware

Recently, I encountered a troubling situation with a colleague’s laptop. After downloading several PDFs from an unreliable source, his machine has been compromised—now, every file has been modified to include a “.nobu” extension. This issue has resulted in numerous phantom programs appearing in the Task Manager, causing significant frustration and concern.

Initial Steps Taken

In an effort to rectify the situation, I ran a malware scan using Malwarebytes. Unfortunately, my colleague does not have a backup of his critical files, and restoring his system to a previous state isn’t an option. So, I’m reaching out to the community for guidance on how we might eliminate the “.nobu” extension from all affected files.

The Situation Ramps Up

As I delved deeper into the problem, I realized that some of his most essential files—Eagle files used for designing PCBs—were also affected. Additionally, the corresponding design software has been rendered inoperable, leaving my colleague in quite a predicament.

More Updates on the Ransomware Problem

In exploring potential solutions, I’ve discovered that the encryption appears to rely on an online key. I attempted to use Emsisoft’s decryption tools, but unfortunately, those efforts did not succeed.

The response from the community has been overwhelming and much appreciated. My colleague, who has a background in electronics and works for an IT firm, was genuinely surprised by the support received. He usually juggles teaching as a side job and primarily uses this laptop for PCB design, C programming, and Arduino projects.

Requested Assistance

I’ve attached a couple of images below to provide context:
1.
2.

I am determined to explore every available decryption tool before considering formatting the laptop. Any further advice or assistance from those who have navigated similar situations would be immensely helpful. Thank you for your support during this challenging time!