Nusm ransomware (virus) - Decryption Methods Included
Nusm virus Removal Guide
What is Nusm ransomware?
Nusm file virus – dangerous ransomware that leaves personal data inaccessible
Nusm ransomware is a type of Windows malware that locks all personal files on an infected computer within a few minutes after gaining access to it. Then it generates a ransom note, titled _readme.txt, and leaves it on the desktop and random folders with encrypted files.
Within that note, malware developers state their demands and instructions on what to do to regain access to the locked data. Suchlike modified files are then marked with .nusm extension and can no longer be accessed. It is important to note that the data is not corrupted and is potentially retrievable.
Cybercriminals urge the victims to contact them via helpmanager@airmail.cc, helpteam@mail.ch within 72 hours to receive a 50% discount for the ransom. That would lower the amount needed to transfer in Bitcoins from $980 to $490. If you're reading this article, we assume that you were unlucky enough to get your device infected with Nusm virus.
Although we receive tons of emails asking, “how did ransomware infect my device?” there's no unequivocal answer to this question. Security researchers claim that the most common distribution method for this strain is software cracks[1] and torrent websites, although you should keep in mind that software bundles,[2], or other methods can be used for this purpose.
This article was created to provide you with the correct course of actions to be taken upon ransomware infiltration and guide you through the process with detailed instructions. Since this virus is a member of the Djvu family, there might be a chance of restoring the encrypted files without paying the attackers.
If you spot that Nusm ransomware encryption is taking place on your device, the first thing you should do is disconnect it from any other devices that are connected to it, whether it's a USB drive or a Network Attached Storage (NAS). Also, please unplug your network cable, and turn off the WiFi on your device. That is essential to prevent re-infection after ransomware removal is complete.
Ensuring that copies of locked files are preserved at the correct time is crucial, as, if everything else fails, you might be able to restore them later in the future. The correct process of malware removal is also essential. Please follow the instructions below to achieve the best possible outcome for you and your files.
Here is a summary of the dangerous computer infection:
| name | Nusm virus |
|---|---|
| Type | Ransomware, file-locking virus |
| Family | Djvu/STOP, based on Virus Total results |
| Previous version | Igvm |
| infection symptoms | Personal data is renamed and is inaccessible; a ransom note appears on the desktop; security-related websites can't be opened thanks to “hosts” file modifications |
| Appended file extension | .nusm |
| Ransom note | _readme.txt |
| File recovery | Might be possible with Emsisoft decryptor or a few alternative methods – refer for more below |
| Elimination | Remove this parasite with our detailed instructions posted below |
| System health fix | Recover the damage done to your device's system files and settings sustained by running system diagnostics with the time-proven FortectIntego PC repair tool |
Nusm virus removal instructions and means to restore altered system settings
The first step is realizing that the worst part is over. The infection has done its bidding. Now what really matters is how you react to all of this. We highly recommend not paying the ransomware developers as you may never receive the promised decryption software. The ransom money would only increase the motivation of the assailants to attack more innocent people and develop more advanced malware.
Before you take on the task of the ransomware removal, you should copy the encrypted files onto a separate storage device, such as a USB flash drive or SSD, and then disconnect them from your PC. Locked data does not hold any malicious code, so it is safe to transfer to other devices
When your data is extracted, you should proceed with Nusm ransomware removal. For it, you should employ anti-malware software. Some ransomware can self-destruct after a successful file encryption process. Even in such cases, malware might leave various data-stealing modules or could operate in conjunction with other dangerous programs on your device.
SpyHunter 5Combo Cleaner or Malwarebytes can detect and eliminate all ransomware-related files, additional modules, along with other infections that could be hiding on your computer. These security tools are really easy to use and do not require any prior IT knowledge to succeed in the removal process.
A proper AV engine might have been able to protect you from Nusm ransomware as a report from VirusTotal[3] shows, that 55 out of 69 of the most popular security tools have identified the virus and prevented it from accessing the system. Here are some examples of its detections names:
- Trojan.GenericKD.46322797
- Artemis!220AA39CCC6D
- Trj/GdSda.A
- Trojan:Win32/Azorult.RTH!MTB
- Win32:PWSX-gen [Trj]
- Win32/Filecoder.STOP.A
By causing alterations to various system directories, Djvu ransomware might block you from visiting security-related pages or opening your anti-malware software. The latter can be resolved by rebooting your infected device in Safe Mode with Networking, which guide can be found at the bottom of the page.
The caused modifications won't go away when you remove Nusm virus. It would be best if you used special software to recover from the damage. According to cybersecurity experts,[4] there's no better way to resolve any system inconsistencies than by running a scan with the FortectIntego optimizer.
Here's what you need to do to get your computer system back on track and avoid BSoDs, freezing, and other system stability and performance issues:
- Download the application by clicking on its name above
- Click on the ReimageRepair.exe
- If User Account Control (UAC) shows up, select Yes
- Press Install and wait till the program finishes the installation process
- The analysis of your machine will begin immediately
- Once complete, check the results – they will be listed in the Summary
- You can now click on each of the issues and fix them manually
- If you see many problems that you find difficult to fix, we recommend you purchase the license and automatically fix them.
By using this PC repair tool, you would not have to worry about future computer issues, as most of them could be fixed quickly by performing a full system scan at any time. Most importantly, you could avoid the tedious process of Windows reinstallation in case things go very wrong due to one reason or another.
Only when you complete all these steps can you safely recover your files from backups or try to recover Nusm files with decryptors (next paragraph). And please remember that keeping your antivirus software up to date could prevent the latest malware from infecting your devices, so make a habit of updating it at least twice a week.
Free decryption software might help you to regain access to your locked data
This part of the article is about encrypted file recovery, so if you had excessive backups of all your essential data, you should skip this paragraph and recover your data if the infection is completely removed from your device. If you didn't store backups, please be advised that you could get away from this sticky situation without paying a dime as some Djvu ransomware variants can be deciphered for free by using Emsisoft decryption tools.
We're not saying that it works all the time, but you should try it anyway:
- The first step would be to download the app from the official Emsisoft website.
- After pressing the Download button, a small pop-up at the bottom, titled decrypt_STOPDjvu.exe, should show up – click it.
- If User Account Control (UAC) message shows up, press Yes.
- Agree to License Terms by pressing Yes.
- After the Disclaimer shows up, press the OK button.
- The tool should automatically identify folders affected by Nusm ransomware, although you can also do it by pressing Add folder at the bottom.
- Press Decrypt.
From here, there are three available outcomes:
- “Decrypted!” will be shown under files that were decrypted successfully – they are now usable again.
- “Error: Unable to decrypt file with ID:” means that the keys for this version of the virus have not yet been retrieved, so you should try later.
- “This ID appears to be an online ID, decryption is impossible” – this decryption tool won't help you with this particular ransomware.
If the free decryption software didn't do the trick, and the files encrypted by Nusm ransomware are still inaccessible, please rest assured that sooner or later, Emsisoft or other companies fighting with ransomware and helping their victims could produce the necessary key so you could decipher your locked data.
Besides, you will find more information below that could help you recover at least some of your lost files – using data recovery software, for example. Also, you will find a few tips on how to backup your data effectively to prevent its future compromise.
Getting rid of Nusm virus. Follow these steps
Isolate the infected computer
Some ransomware strains aim to infect not only one computer but hijack the entire network. As soon as one of the machines is infected, malware can spread via network and encrypt files everywhere else, including Network Attached Storage (NAS) devices. If your computer is connected to a network, it is important to isolate it to prevent re-infection after ransomware removal is complete.
The easiest way to disconnect a PC from everything is simply to plug out the ethernet cable. However, in the corporate environment, this might be extremely difficult to do (also would take a long time). The method below will disconnect from all the networks, including local and the internet, isolating each of the machines involved.
- Type in Control Panel in Windows search and press Enter
- Go to Network and Internet
- Click Network and Sharing Center
- On the left, pick Change adapter settings
- Right-click on your connection (for example, Ethernet), and select Disable
- Confirm with Yes.
If you are using some type of cloud storage you are connected to, you should disconnect from it immediately. It is also advisable to disconnect all the external devices, such as USB flash sticks, external HDDs, etc. Once the malware elimination process is finished, you can connect your computers to the network and internet, as explained above, but by pressing Enable instead.
Restore files using data recovery software
Since many users do not prepare proper data backups prior to being attacked by ransomware, they might often lose access to their files permanently. Paying criminals is also very risky, as they might not fulfill the promises and never send back the required decryption tool.
While this might sound terrible, not all is lost – data recovery software might be able to help you in some situations (it highly depends on the encryption algorithm used, whether ransomware managed to complete the programmed tasks, etc.). Since there are thousands of different ransomware strains, it is immediately impossible to tell whether third-party software will work for you.
Therefore, we suggest trying regardless of which ransomware attacked your computer. Before you begin, several pointers are important while dealing with this situation:
- Since the encrypted data on your computer might permanently be damaged by security or data recovery software, you should first make backups of it – use a USB flash drive or another storage.
- Only attempt to recover your files using this method after you perform a scan with anti-malware software.
Install data recovery software
- Download Data Recovery Pro.
- Double-click the installer to launch it.
- Follow on-screen instructions to install the software.
- As soon as you press Finish, you can use the app.
- Select Everything or pick individual folders where you want the files to be recovered from.
- Press Next.
- At the bottom, enable Deep scan and pick which Disks you want to be scanned.
- Press Scan and wait till it is complete.
- You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
- Press Recover to retrieve your files.
Restore Windows "hosts" file to its original state
Some ransomware might modify Windows hosts file in order to prevent users from accessing certain websites online. For example, Djvu ransomware variants add dozens of entries containing URLs of security-related websites, such as 2-spyware.com. Each of the entries means that users will not be able to access the listed web addresses and will receive an error instead.
Here's an example of “hosts” file entries that were injected by ransomware:
In order to restore your ability to access all websites without restrictions, you should either delete the file (Windows will automatically recreate it) or remove all the malware-created entries. If you have never touched the “hosts” file before, you should simply delete it by marking it and pressing Shift + Del on your keyboard. For that, navigate to the following location:
C:\\Windows\\System32\\drivers\\etc\\
Create data backups to avoid file loss in the future
One of the many countermeasures for home users against ransomware is data backups. Even if your Windows get corrupted, you can reinstall everything from scratch and retrieve files from backups with minimal losses overall. Most importantly, you would not have to pay cybercriminals and risk your money as well.
Therefore, if you have already dealt with a ransomware attack, we strongly advise you to prepare backups for future use. There are two options available to you:
- Backup on a physical external drive, such as a USB flash drive or external HDD.
- Use cloud storage services.
The first method is not that convenient, however, as backups need to constantly be updated manually – although it is very reliable. Therefore, we highly advise choosing cloud storage instead – it is easy to set up and efficient to sustain. The problem with it is that storage space is limited unless you want to pay for the subscription.
Using Microsoft OneDrive
OneDrive is a built-in tool that comes with every modern Windows version. By default, you get 5 GB of storage that you can use for free. You can increase that storage space, but for a price. Here's how to setup backups for OneDrive:
- Click on the OneDrive icon within your system tray.
- Select Help & Settings > Settings.
- If you don't see your email under the Account tab, you should click Add an account and proceed with the on-screen instructions to set yourself up.
- Once done, move to the Backup tab and click Manage backup.
- Select Desktop, Documents, and Pictures, or a combination of whichever folders you want to backup.
- Press Start backup.
After this, all the files that are imported into the above-mentioned folders will be automatically backed for you. If you want to add other folders or files, you have to do that manually. For that, open File Explorer by pressing Win + E on your keyboard, and then click on the OneDrive icon. You should drag and drop folders you want to backup (or you can use Copy/Paste as well).
Using Google Drive
Google Drive is another great solution for free backups. The good news is that you get as much as 15GB for free by choosing this storage. There are also paid versions available, with significantly more storage to choose from.
You can access Google Drive via the web browser or use a desktop app you can download on the official website. If you want your files to be synced automatically, you will have to download the app, however.
- Download the Google Drive app installer and click on it.
- Wait a few seconds for it to be installed.
- Now click the arrow within your system tray – you should see Google Drive icon there, click it once.
- Click Get Started.
- Enter all the required information – your email/phone, and password.
- Now pick what you want to sync and backup. You can click on Choose Folder to add additional folders to the list.
- Once done, pick Next.
- Now you can select to sync items to be visible on your computer.
- Finally, press Start and wait till the sync is complete. Your files are now being backed up.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Nusm and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Software cracking. Wikipedia. The free encyclopedia.
- ^ M.R. Anglin. What is a Software Bundle?. Easytechjunkie. Easy and clear answers to common tech questions.
- ^ VirusTotal. Virustotal. Suspicious file analysis.
- ^ Virusai. Virusai. Spyware news and security.