Ransomware turned all my files into ".nobu"

[BlueKing]

So I woke up today and my PC was all messed up.

It seems some ransomware has turned all my files into ".nobu" and I got a txt file in all my folders (written in broken english) with a ransom note telling me all my data is asking me to pay $980 for a decryption software to get my files back to normal. But lucky me, I got a 50% discount if I buy it within the first 72 hours... Hahah, I thought that was kinda funny... Anyway, the message continues with two emails and a personal ID code (containing 49 characters).

I did a quick search and found no information about this kind of ".nobu" ransomware. So I started experimenting, I found out that if I just remove the .nobu extension from my files, they turn back to normal and I'm able to use them again.

The thing is, I had a external HD connected when all this happened, and I have a ton of work stored on there. And I'm a bit worried that if I connect it to another PC to start cleaning up the files, it will spread the ransomware to my other PCs.. Is this possible..? Or am I just too cautious..?

Also, my web browser seems to be effected by this as well. It keeps popping up with spam and all sorts of weird stuff is happening. So the ransomware seems to be active/still spreading somehow.

Anyway, I was hoping somebody on here would be able to help me out with some more information about what to do, or how this malware spreads or operates. I was thinking of just doing a backup of all my data and format the whole PC. What do you guys think?

 

Any help is greatly appreciated! 

[BlueKing]

UPDATE:

So I tried to rename some more files and it doesn't work as well as I had hoped.. It seems everything has been signed with the malware and I'm not able to run video files, exe files, or open any other media - except mp3 files..

[kevinf80]

Hello BlueKing and welcome to Malwarebytes,

Can you post the ransom note and attach a copy of one of the encrypted files....

Thank you,

Kevin.

[BlueKing]

UPDATE:

Any USB HD that is connected to the PC will be infected too..

 

9 minutes ago, kevinf80 said:

Hello BlueKing and welcome to Malwarebytes,

Can you post the ransom note and attach a copy of one of the encrypted files....

Thank you,

Kevin.

Thanks! Here are the files you requested.

_readme.txt infected file.rar

[kevinf80]

Read at the following:

https://id-ransomware.malwarehunterteam.com/identify.php?case=707e906651c1df975d1995ed0774d576e97b754e

[BlueKing]

Thank you for helping!

But when I try decrypting my files with the "STOP Djvu" software I get this error message on all files:

Error: No key for New Variant online ID: UMxKWCt3ZhBU8CPXdPsZ8IDzZxzXMI12EUMDqGQN
Notice: this ID appears to be an online ID, decryption is impossible

[BlueKing]

Does this mean I'm infected with a new strain of this ransomware that doesn't have a decryption method yet?

[kevinf80]

Hello BlueKing,

Yes it certainly seems that way. Go to the following link at Bleeping Computers, register and open a topic there, You will receive excellent advice there...

https://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/

 

Thank you

Kevin....

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you