[SOLVED] my files extention changed to (.no_more_ransom)

Page 2 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
Z

zeeshan.nayani

Honorable
Jun 19, 2018
33
0
10,540
I recently bumped into this situation where all of my files (,jpeg, .mp4, even .exe) in folders and even on my desktop have changed into some weird (.no_more_ransom) it has made my pc extremely slow as well, i have tried renaming my files back to its original extension but it didn't worked even after renaming them it never shows any preview i dont know what to do now, please help me out,,, i have also attached a picture link:
9Z47wSa

http://
 
Solution
USAFRet


If you're asking, then neither you nor your friend should attempt this.

If it were me:
Using a secondary laptop that I absolutely do not care if it gets virused up,
Said laptop is completely off the local network. No WiFi, no ethernet cable,
Using a USB dock for those drives
Boot up, and only after the system is booted, connect one of your virused up drives.
Investigate, and see what I can find.
Repeat with your other drive.

I might even do that from a Linux Live environment.

But the laptop I'd use has a full recoverable backup of the entire drive. If it gets screwed up, take about 20 minutes to fully...
Sort by date Sort by votes


We've all gone though such a loss.
Virus, dead drive, stolen laptop...

The key thing is to make note of this, and don't let it happen again.
 
Upvote 0 Downvote


The ONLY hope is to connect them to some other system, and try one of the data recovery tools.
Maybe that will retrieve a few files. Maybe.

Mostly, it is all gone.
And the 1TB internal drive absolutely needs a full wipe and reinstall of everything.
 
Upvote 0 Downvote


If you're asking, then neither you nor your friend should attempt this.

If it were me:
Using a secondary laptop that I absolutely do not care if it gets virused up,
Said laptop is completely off the local network. No WiFi, no ethernet cable,
Using a USB dock for those drives
Boot up, and only after the system is booted, connect one of your virused up drives.
Investigate, and see what I can find.
Repeat with your other drive.

I might even do that from a Linux Live environment.

But the laptop I'd use has a full recoverable backup of the entire drive. If it gets screwed up, take about 20 minutes to fully recover it.
There is literally no data on that system I care about. It is simply a test box.

So unless you and your friend are really really comfortable doing that...don't.

It's like you're a doctor, and have to go into a room with a known infected Ebola patient. And you have to wear the whole isolation suit.
 
Upvote 0 Downvote
Solution


Recuva
PhotoRec
TestDisk

However...in this situation, nothing really "works". Those tools can only work IF:
the virus made a copy,
encrypted the copy,
deleted the original,
and parts of the original were not overwritten with other data.

Highly unlikely it will recover everything. I'd be surprised to see a 5% recovery rate.
 
Upvote 0 Downvote
Personally I would build a little test box and hook up your hard drive. ensure a.v. scanners are up to date and then turn it all on with your hard drive hooked up. of course STAY OFF THE INTERNET. But see about doing data recovery at this point.

USAFret is right though. You need to be damn careful. He has serious points about the data being encrypted. However I know recently some ransomware creators released master keys. So not to give you false hope but proceed with extreme caution.

In the end what is the data on the hard drive? Can you do data recovery off your DSLR camera memory card to get back photos?
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom