I just caught a ransomware that encrypted many of my files and I need to get them back. Now they all end in .NORVAS and I can't find a way to decrypt them back. I tried with data recovery pro, shadow explorer and easeus data recovery but no luck.

  • 3
  • Its no duplicate because this is RANSOMWARE and all of them are different... – Cain Nuke Apr 20 '19 at 22:42
  • 1
    The files are encrypted. This means that unless a vulnerability exists that resulted in the key, used to encrypt the files was found, only the that key can be used to decrypt the files. The solution to this problem will always be to restore the files from a unaffected backup. As for the malware infection, the duplicate handles, how to remove the malicious file. The key to this malware has not been leaked, nor is it likely, that the key will be leaked by a white hatter. – Ramhound Apr 20 '19 at 22:49
  • 1
    Welcome to Super User. Getting malware sucks. Unfortunately, there are thousands of variants, and it is beyond the scope of a site like this to maintain a library of all of them and their individual solutions (to the extent that there are solutions). There's a section on ransomware in the linked thread. It mentions that some of the A/V vendors have some tools that can help with some ransomware variants. But the sad fact is that the only good solution is to protect yourself in advance with backups. If your computer gets infected, wipe it, reinstall your OS, and restore from backups. – fixer1234 Apr 20 '19 at 23:03

It may be possible to recover your data. However, the possibility is very, very unlikely.

There are a few utilities such as McAfee Ransomware Recover (Mr2) which can decrypt some ransomware encrypted files. There is no guarantee your type and variant of ransomware is supported.

You have three other options:

  1. Restore the data from backups if you have them.
  2. Pay the ransom - Note: There is no guarantee the data will be restored. I would not consider this option, unless the data was truly worth the cost of the ransom to you.
  3. Consider the data is lost.

Unfortunately, this is a harsh lesson for most people:

If you consider your data important, MAKE BACKUPS!

  • I did make backups but guess what? Since it was on a driver that was plugged onto the computer at the moment of the infection it got infected too!! – Cain Nuke Apr 20 '19 at 23:34
  • @CainNuke That sucks. Remember, leave you backup drive completely separate from your computer when not in use. If your data is really important, keep offsite backups. – Keltari Apr 20 '19 at 23:36
  • I got one like that too but unfortunately that prevents me from backing up files that Im updating constantly. – Cain Nuke Apr 20 '19 at 23:40
  • @CainNuke when i was working in my last job, we plan and prepare backups system. Ransomware can read the letter units, there is a little bat that mount and unmount units on execution. Try to find it and mount unit when you are working, then unmount unit when you arent working. (Excuse me my bad english). – Jose Manuel Morales Apr 22 '19 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.