The Ransomware viruses are a commonly encountered form of malware that targets the user’s files. The goal of this type of infections is to make all user files present in the attacked computer inaccessible, and they do that through the application of a data-encryption process. The encryption that gets applied to the user’s files makes them inaccessible, but it doesn’t damage or modify them in any way. This, in turn, allows the hackers to blackmail their victims, by offering them a decryption key for the sealed files in exchange for a ransom payment.
Nuksus is a virus of this category and though it has been released quite recently, the number of its victims is already quite high, and more and more people are falling prey to this malicious program everyday. Below this short article, you will find a guide which focuses on the removal of Nuksus – we advise you to use that guide if Nuksus has managed to enter your computer and lock up your files. However, you must know that removing the cryptovirus will probably not be enough to get your files unlocked, because the encryption would remain on them regardless of whether the virus is in your computer or not.
Fighting the .Nuksus file encryption
One obvious way you can deal with the encryption is if you pay the ransom. However, we do not advise you to take that path. Firstly, the money for the ransom is likely to be quite a lot, and not everyone can afford to pay such a ransom. Secondly, even if the files that the malware has locked are so important that you are ready to spend a big amount of money in order to unlock them, there can’t be any guarantee that after the payment you will receive the needed access key. Do not forget that the people behind Nuksus, Coharos or Nasoh are criminals, and the ransom payment is not a legitimate deal but a criminal money extortion scheme. As soon as the hackers get your money, you are left at their mercy – you may or may not receive a key from them. In either case, however, your money would be gone, and there is nothing you can do to change that.
Dealing with the .Nuksus virus
As we said, the guide below will help you eliminate the infection, and while this will likely not result in the automatic release of your files, it will give you the opportunity to try some other methods of restoring your data. Several such methods you can find in the second part of our guide – use them once you are done removing the virus and see if they work for you. Unfortunately, it is possible that the recovery suggestions we have here, on our site, may not be effective in your case. However, the same can be said about the ransom payment. At least if you go for the alternatives, you won’t be spending your money be giving it to the criminal hackers, who are responsible for all of this to begin with.
Nuksus SUMMARY:
| Name | Nuksus |
| Type | Ransomware |
| Danger Level | High (Nuksus Ransomware encrypts all types of files) |
| Symptoms | Nuksus Ransomware is hard to detect and aside from increased use of RAM and CPU, there would barely be any other visible red flags. |
| Distribution Method | Most of the time, Trojans get distributed through spam e-mails and social network messages, malicious ads, shady and pirated downloads, questionable torrents and other similar methods. |
Nuksus Virus Removal
1: Preparations
Note: Before you go any further, we advise you to bookmark this page or have it open on a separate device such as your smartphone or another PC. Some of the steps might require you to exit your browser on this PC.
2: Task Manager
Press Ctrl + Shift + Esc to enter the Task Manager. Go to the Tab labeled Processes (Details for Win 8/10). Carefully look through the list of processes that are currently active on you PC.
If any of them seems shady, consumes too much RAM/CPU or has some strange description or no description at all, right-click on it, select Open File Location and delete everything there.
Also, even if you do not delete the files, be sure to stop the process by right-clicking on it and selecting End Process.
3: IP related to Nuksus
Go to c:\windows\system32\drivers\etc\hosts. Open the hosts file with notepad.
Find where it says Localhost and take a look below that.
If you see any IP addresses there (below Localhost) send them to us here, in the comments since they might be coming from the Nuksus.
[add_forth_banner]
4: Disable Startup programs
Re-open the Start Menu and type msconfig.
Click on the first search result. In the next window, go to the Startup tab. If you are on Win 10, it will send you to the Startup part of the task manager instead, as in the picture:
If you see any sketchy/shady looking entries in the list with an unknown manufacturer or a manufacturer name that looks suspicious as there could be a link between them and Nuksus , disable those programs and select OK.
5: Registry Editor
Press Windows key + R and in the resulting window type regedit.
Now, press Ctrl + F and type the name of the virus.
Delete everything that gets found. If you are not sure about whether to delete something, do not hesitate to ask us in the comments. Keep in mind that if you delete the wrong thing, you might cause all sorts of issues to your PC.
6: Deleting potentially malicious data – Nuksus
Type each of the following locations in the Windows search box and hit enter to open the locations:
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
%Temp%
Delete everything you see in Temp linked to Nuksus Ransomware. About the other folders, sort their contents by date and delete only the most recent entries. As always, if you are not sure about something, write to us in the comment section.
7: Nuksus Decryption
The previous steps were all aimed at removing the Nuksus Ransomware from your PC. However, in order to regain access to your files, you will also need to decrypt them or restore them. For that, we have a separate article with detailed instructions on what you have to do in order to unlock your data. Here is a link to that guide
