DAH_2 Posted October 27, 2018 ID:1277814 Share Posted October 27, 2018 My computer was hit by ransomware and encrypted every file and added the extension .nozelesn. I was asked to pay $22,500 in order to decrypt my files. Has anyone been able to decrypt & remove this ransomware ? Link to post Share on other sites More sharing options...
Aura Posted October 27, 2018 ID:1277815 Share Posted October 27, 2018 Hi DAH_2 Can you upload a ransom note to ID-Ransomware and copy/paste the results here? https://id-ransomware.malwarehunterteam.com/ Link to post Share on other sites More sharing options...
DAH_2 Posted October 29, 2018 Author ID:1278166 Share Posted October 29, 2018 I have the computer shut down because I don't want it to infect anything else. What is the best way to get the file off without it getting on anything else? If I copy it to a thumb drive and send it, I could get on my new system. Please let me know the best way to send you the file. Thanks. Link to post Share on other sites More sharing options...
Aura Posted October 30, 2018 ID:1278240 Share Posted October 30, 2018 Chances are that if the ransom notes are already dropped on your system, then the ransomware already encrypted all your files, as dropping the notes is the last thing they do. So turning your computer on now wouldn't cause any more harm. Link to post Share on other sites More sharing options...
DAH_2 Posted October 31, 2018 Author ID:1278689 Share Posted October 31, 2018 Thank you. I have uploaded the files. Link to post Share on other sites More sharing options...
Aura Posted November 1, 2018 ID:1278768 Share Posted November 1, 2018 Can you copy/paste the result from ID-Ransomware here so I can see it? Link to post Share on other sites More sharing options...
Aura Posted November 4, 2018 ID:1279236 Share Posted November 4, 2018 Hi DAH_2, Are you still with me? Link to post Share on other sites More sharing options...
Aura Posted November 7, 2018 ID:1279785 Share Posted November 7, 2018 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Aura Posted November 9, 2018 ID:1280061 Share Posted November 9, 2018 Topic has been reopened per request. Thanks Link to post Share on other sites More sharing options...
Aura Posted November 9, 2018 ID:1280062 Share Posted November 9, 2018 You need to upload the encrypted file/ransom note to ID-Ransomware, and copy/paste the output of the report here so I can see it Link to post Share on other sites More sharing options...
DAH_2 Posted November 9, 2018 Author ID:1280271 Share Posted November 9, 2018 This ransomware is still under analysis. Please refer to the appropriate topic for more information. Samples of encrypted files and suspicious files may be needed for continued investigation. Identified by ransomnote_filename: HOW_FIX_NOZELESN_FILES.htm Click here for more information about Nozelesn Link to post Share on other sites More sharing options...
DAH_2 Posted November 9, 2018 Author ID:1280273 Share Posted November 9, 2018 I got the following when I tried to upload an encrypted file. Error: Please upload a ransom note and/or sample encrypted file for identification. Link to post Share on other sites More sharing options...
Aura Posted November 10, 2018 ID:1280286 Share Posted November 10, 2018 Do you live in Poland? And did you receive any emails with an attachment (Word, Excel, PowerPoint, etc.) before the infection? https://www.bleepingcomputer.com/news/security/nozelesn-ransomware-reportedly-using-spam-to-target-poland/ Link to post Share on other sites More sharing options...
DAH_2 Posted November 12, 2018 Author ID:1280627 Share Posted November 12, 2018 No, I live in California and I don't remember opening and clicking on any file. Link to post Share on other sites More sharing options...
Aura Posted November 14, 2018 ID:1280979 Share Posted November 14, 2018 Alright. In that case, as stated by IDR there isn't much you can do. Your best bet is to restore the encrypted files from a recent backup (if you have one). If not, you should backup the encrypted files somewhere safe in case a free decrypter gets released in the future. Link to post Share on other sites More sharing options...
Aura Posted November 17, 2018 ID:1281791 Share Posted November 17, 2018 Hi DAH_2, Are you still with me? Link to post Share on other sites More sharing options...
DAH_2 Posted November 17, 2018 Author ID:1281827 Share Posted November 17, 2018 Thanks. Seems there is nothing I can do for now. It infected all my backups and cloud drives. I was able to get some files restored from dropbox but didn't have full backups there. I thought my external hard drive would have been good but I learned my lesson. Thanks for your help. Link to post Share on other sites More sharing options...
Aura Posted November 17, 2018 ID:1281850 Share Posted November 17, 2018 No problem DAH, you're welcome! Stay safe Link to post Share on other sites More sharing options...
Aura Posted November 17, 2018 ID:1281851 Share Posted November 17, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts