Nelasod Ransomware - How to remove

Nelasod is a PC virus that hides your files from you in an attempt to get you to pay a ransom of $490 to $980. The worst of all is that a Nelasod infection can genuinely result in a loss of your data and, in worst cases, even in your credentials and credit card data being leaked. This virus is no joke and it’s important to secure your PC so that similar viruses don’t infect it in the future.

Nelasod did not appear out of the blue — it’s a new member of the STOP/Djvu ransomware family. We have written about these viruses before: Kroput, Djvu, Bopador, and many others have been released over the months. The developers of STOP ransomware have not been sitting on their hands — they’ve changed how the viruses are distributed and how much damage they do.

Characteristics of Nelasod

Nelasod is a file-encrypting virus, which means that the files are essentially broken and the only way to reverse that is to get the decryption key — an alphanumeric string that’s unique to each victim and only known to the criminals.

Unsurprisingly, the virus is named after the extension that is given to all the encrypted files — “.nelasod”. Every locked file is renamed by appending this extension.

Not any different from the previous versions of STOP ransomware, Nelasod’s ransom note is named “_readme.txt” and the contacts of the criminals are [email protected], [email protected], and @datarestore on the Telegram network. The price of decryption also hasn’t changed and is either $490 or $980.

It’s important to mention that paying the criminals absolutely does not guarantee your files being fixed. Roughly two-fifths of those who pay the ransom don’t get a working decrypter. Also, remember to remove all the malware from your machine and create a backup of your files. Repeat ransomware hits have happened and can be devastating.

How Nelasod spreads

Currently, most STOP ransomware infections result from people downloading software cracks, activators, and key generators, activated “free” commercial software, and programs from unofficial websites. Piracy has always been dangerous, an infection like Nelasod is a very harsh reminder of that.

Software bundles are also a method that Nelasod’s predecessors have used in the past. Usually, you wouldn’t expect a freeware bundle to infect you with anything worse than a toolbar, some scareware, or maybe a trojan. However, ransomware can be hidden in bundles and start working as soon as you install the front program — and Nelasod can lock a lot of files very quickly.

Spam email letters with infected attachments are the overall most popular way that ransomware viruses spread, along with hacked RDP (Remote Desktop) connection. The last one is usually targeted manually and directed at businesses, but Nelasod’s developers target individuals, as is reflected by the relatively small ransom that they ask (less than a thousand dollars).

How to remove Nelasod and restore the files

To restore the encrypted files, it’s first important to make sure they won’t be re-encrypted. To check if Nelasod is no longer on your system, scan it with Spyhunter, or another strong antivirus tool. It might detect the spyware trojan (AZORult is distributed with Nelasod) which should be removed so that it can’t collect your passwords and leak them to criminals and so that it does not install any other viruses later.

After the removal, review your options to restore the encrypted data:

• Restore from backups.
• Decrypt using STOPDecrypter.

Restoring from backups is ideal, but not everyone has backups. Review what files you can retrieve from your email account, USB keys and memory cards, and other storage unaffected by Nelasod. Nelasod removes shadow copies and it’s likely that System Restore won’t work on your machine if you used the encrypted disk to keep your backups. Still, you can try — sometimes malware doesn’t do everything properly and you might be able to reverse the changes made by Nelasod.

STOPDecrypter is a program developed by a researcher who dedicates a lot of his time to solving STOP ransomware. In this post he explains what STOPDecrypter can and can’t do. Keep in mind that the chances of STOPDecrypter working for you are very small.

You can also try and restore deleted data from your disk (instructions below). If you wish to wait for a guaranteed decryption solution, keep the encrypted files, don’t edit them. It’s possible, though unlikely, that the decryption keys will become available in the future. It wouldn’t be the first time: in 2016, TeslaCrypt ransomware was retired and the extortionists simply made the master decryption key public.

Automatic Malware removal tools

How to recover Nelasod Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Nelasod Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Nelasod Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Nelasod Ransomware. You can check other tools here.  

Step 3. Restore Nelasod Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Nelasod Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Nelasod Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.