I just caught a ransomware that encrypted many of my files and I need to get them back. Now they all end in .NORVAS and I can't find a way to decrypt them back. I tried with data recovery pro, shadow explorer and easeus data recovery but no luck.
-
3Possible duplicate of How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?– fixer1234Apr 20, 2019 at 22:41
-
Its no duplicate because this is RANSOMWARE and all of them are different...– Cain NukeApr 20, 2019 at 22:42
-
1The files are encrypted. This means that unless a vulnerability exists that resulted in the key, used to encrypt the files was found, only the that key can be used to decrypt the files. The solution to this problem will always be to restore the files from a unaffected backup. As for the malware infection, the duplicate handles, how to remove the malicious file. The key to this malware has not been leaked, nor is it likely, that the key will be leaked by a white hatter.– RamhoundApr 20, 2019 at 22:49
-
1Welcome to Super User. Getting malware sucks. Unfortunately, there are thousands of variants, and it is beyond the scope of a site like this to maintain a library of all of them and their individual solutions (to the extent that there are solutions). There's a section on ransomware in the linked thread. It mentions that some of the A/V vendors have some tools that can help with some ransomware variants. But the sad fact is that the only good solution is to protect yourself in advance with backups. If your computer gets infected, wipe it, reinstall your OS, and restore from backups.– fixer1234Apr 20, 2019 at 23:03
-
3Does this answer your question? QDLA Remove and Decrypt– RamhoundNov 11, 2022 at 21:26
Add a comment
|
1 Answer
It may be possible to recover your data. However, the possibility is very, very unlikely.
There are a few utilities such as McAfee Ransomware Recover (Mr2) which can decrypt some ransomware encrypted files. There is no guarantee your type and variant of ransomware is supported.
You have three other options:
- Restore the data from backups if you have them.
- Pay the ransom - Note: There is no guarantee the data will be restored. I would not consider this option, unless the data was truly worth the cost of the ransom to you.
- Consider the data is lost.
Unfortunately, this is a harsh lesson for most people:
If you consider your data important, MAKE BACKUPS!
-
I did make backups but guess what? Since it was on a driver that was plugged onto the computer at the moment of the infection it got infected too!! Apr 20, 2019 at 23:34
-
@CainNuke That sucks. Remember, leave you backup drive completely separate from your computer when not in use. If your data is really important, keep offsite backups.– KeltariApr 20, 2019 at 23:36
-
I got one like that too but unfortunately that prevents me from backing up files that Im updating constantly. Apr 20, 2019 at 23:40
-
@CainNuke when i was working in my last job, we plan and prepare backups system. Ransomware can read the letter units, there is a little bat that mount and unmount units on execution. Try to find it and mount unit when you are working, then unmount unit when you arent working. (Excuse me my bad english). Apr 22, 2019 at 11:53