Hi, my computer is infected with .NESA ransomware. I just completed a system restore but I still find my files are affected with .nesa extension and are unable to open them.
My computer is infected with .NESA ransomware. What to do?
Liang1991, | Nesa ransomware |
Ask a question
Community Answers
Your opinion regarding My computer is infected with .NESA ransomware. What to do?
You must be logged in to post a comment.
This is the virus that keeps persistent and encrypts files using a powerful asymmetric algorithm. It is known that this version Djvu virus employs the SHA-1 encryption method in particular and can be especially persistent, based on previous strains.
Your mentioned System Restore feature can help remove the virus and its traces, but your files will remain locked. For file recovery, you can try Windows Previous Versions feature once the System Restore is enabled. That method helps to recover one file at the time.
This and other data recovery methods can be found in this Nesa virus removal guide.
Also, there are a few options for decryption. Although STOP decrypter that was capable to help with previous versions of the ransomware is no longer supported, researchers provided a few other options for victims. It is possible that particular Nesa decryption tool can be developed in the future, so you should store locked files and wait for that addition.
People can try a decryption method that recovers files encrypted using offline keys or pay for the particular Dr.Web service named Rescue Pack. All these options are listed in the article linked above. By no means consider the ransom paying. That is not advisable and such option can lead to more issues with the device.
Best regards,
2spyware team