NELASOD Error: Unable to decrypt file with ID

[Nestor 0]

My PC is infected with Nelasod. I use Emsisoft Descryptor and appear this message...

Error: Unable to decrypt file with ID 

You can see

Download Image

[GT500 593]

.nelasod is one of the newer variants that uses secure RSA encryption. Unless the ID ends in "t1" then it's doubtful the decrypter will ever be able to decrypt your files.

[Nestor 0]

Ok...Thank you for your reponse...

[GT500 593]

13 hours ago, Nestor said:

Ok...Thank you for your reponse...

I was reminded by @Amigo-A that .nelasod was in fact an older variant, which is supported by our decrypter. Please see the information and instructions at the following link to learn about the decrypter and how to use it.
https://www.bleepingcomputer.com/news/security/stop-ransomware-decryptor-released-for-148-variants/

[Nestor 0]

Emsisoft Decryptor for STOP Djvu dont work with nelasod. 

[Amigo-A 43]

Try variant "B"

With the new Decryption Service, you need to find the largest encrypted files of different formats (PNG, JPG, JPEG, PDF, DOC, DOCX, MP3, MP4 ...) and the original unencrypted file for each type. Then upload it to the service. If the decryption service will found the decryption key, then all files of this type can be decrypted.
Also you need to do with each file type (PNG, JPG, JPEG, PDF, DOC, DOCX, MP3, MP4 ...) that you need to decrypt.

At first glance it seems that it is impossible to find a pair of encrypted + original files, but this is not so.

Here is a sample list where you can find the originals of the encrypted files :

1) on flash drives, external drives, CD / DVD, memory cards of the camera, phone;
2) in attachments of emails sent or received by you;
3) among the copies of shared photos of friends, relatives (in their PC) that you gave;
4) among the uploaded photos in the social. networks, including via smartphone and tablet;
5) among the uploaded photos to cloud services (Google Disk,  OneDrive, Yandex Disk etc.);
6) on the sites of ads, forums, where you could previously send photos or images;
7) among unencrypted files, copies, renamed files on your PC;
8 ) on an old PC or disk, from where you transferred photos and documents to a new PC;
9) you can re-upload from the Internet previously downloaded photos, pictures, etc .;
10) you can use sample images supplied with Windows;
11) take photos or pictures that you previously posted on the avatar on the forums.
12) extract previously deleted files from the Recycle Bin or restore it with a special program.
 
If decryption failed ...
 
It is possible that the original file was an inaccurate copy of the encrypted. This could be due to the fact that earlier you yourself reduced or corrected it in the editor, or uploaded to social networks, cloud services, and there the file was somehow automatically changed.
Look for more files and try different pairs of encrypted and original files with the same name. Very often files can have the same name, but are not a copy of each other. Vocabulary used in any language is limited. The possibilities of PCs, cameras and other devices for taking photos are also limited. In cameras and mobile devices, names for photos are given automatically according to a specific format, so photos with the name from IMG_0001.JPG to IMG_9999.JPG can be quite a lot in different years. Smartphones can give photos more original names, such as IMG_20171012_170451.jpg - here and the date of shooting, and the sequence number, thus the repetition of the name is unlikely.

[Nestor 0]

Download Image

 

Im trying but it isnt work. I dont understand how function...

 

Download Image

 

Just tell me: What do I have to do convert one file below. Example: Gloria Instrumental.

 

Download Image

[Amigo-A 43]

Here your used different files

Files must be identical in name, only the encrypted ones have an .nelasod extension.

You have to try with different types of files (PNG, JPG, JPEG, PDF, DOC, DOCX, MP3, MP4 ...). Not everyone can be decrypted.

[GT500 593]

6 hours ago, Nestor said:

Im trying but it isnt work. I dont understand how function...

You need what we call a "file pair", which is an original unencrypted file and an encrypted copy of the same file. You then submit those via our website, and that will help the decryption service learn how to decrypt some of your files.

It's important to note that this does not work for all files. For instance, if you use a file pair for an MP3 file, then the decrypter should be able to decrypt most (if not all) MP3 files on your computer, however it will not be able to decrypt any other files. You'll need to have a file pair for every type of file you want to decrypt.

[Nestor 0]

Ok. I understood. I've tried but I could not decrypt any file. 

I put the file encrypted and put the file with the same extension but it isnt work. 

I ve been thinking if perhaps it has to do with the differents versions of the programs. I have files of several years and the programs versions are differents now when they were created. 

 

 

Download Image

[Nestor 0]

On 10/25/2019 at 1:59 PM, Amigo-A said:

Here your used different files

Files must be identical in name, only the encrypted ones have an .nelasod extension.

You have to try with different types of files (PNG, JPG, JPEG, PDF, DOC, DOCX, MP3, MP4 ...). Not everyone can be decrypted.

 

I sent the wrong image. Really, I used all possibles options, with differents extensions.

 

[Amigo-A 43]

Encrypted files need to be saved.
Then you have to wait for the next update to the decryptor database.

[GT500 593]

On 10/26/2019 at 7:14 AM, Nestor said:

I put the file encrypted and put the file with the same extension but it isnt work.

Do you see the error message in your screenshot? "invalid file pair". This means that you didn't supply two copies of the same file.

[Nestor 0]

5 hours ago, GT500 said:

Do you see the error message in your screenshot? "invalid file pair". This means that you didn't supply two copies of the same file.

This error occurred when I didn't  know how to do it. Now I know, for your explanations...

[GT500 593]

16 hours ago, Nestor said:

This error occurred when I didn't  know how to do it. Now I know, for your explanations...

Did the submission for give you a different error message when you tried with a correct file pair?

[Lana LIma 0]

.mosk (extension) my files are infected, how do I decrypt?

ID: 3JJGd35MhyVcZT9GgnQgZWQwbfVesbBqTmXxI9Ih 

 

Please, help!

 

Thanks

[Amigo-A 43]

Quote

.mosk extension

This is one of the new variants of STOP Ransomware. 

Try this tool,  if the files are encrypted with an offline key, then there is a chance to decrypt some files.

https://www.emsisoft.com/ransomware-decryption-tools/free-download 
https://www.emsisoft.com/ransomware-decryption-tools/stop-djvu

Files encrypted with online keys (when the PC was connected to the Internet) will not be decrypted. 

 

[Faro 0]

19 hours ago, Amigo-A said:

what can we do with online encryption?

 

 

 

[Amigo-A 43]

Files encrypted with online keys (when the PC was connected to the Internet) will not be decrypted. 

 

 

[GT500 593]

On 11/9/2019 at 8:44 AM, Faro said:

what can we do with online encryption?

That depends on the variant. If it's an older variant, then the decrypter can be "trained" how to decrypt your files by uploading file pairs to our submission form. If it's a newer variant, then there is currently nothing that can be done to recover the files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

[Nikhil 0]

Hello, i tried to decrypt with .mbed extension which it failed to. I tried to update the database with same file before and after encryption and it said its a newer version. All my work files are in it, is it viable to wait for days for an update to your encryption systems? i think it was encrypted while the computer was online, sadly.

[soto 0]

 

hello I need help I have files encrypted with the .mosk ramsomware

 

Error: Unable to decrypt file with ID: hSxfBZ0uAYq6gUg6XlFmyROBLsImhUYYinvMojXg
 

[GT500 593]

11 hours ago, soto said:

hello I need help I have files encrypted with the .mosk ramsomware

Error: Unable to decrypt file with ID: hSxfBZ0uAYq6gUg6XlFmyROBLsImhUYYinvMojXg

This is a newer variant of STOP/Djvu, and your ID is an online ID, so there is currently no way to decrypt your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

[ARDHI 0]

help me fix runsomware .hets

[GT500 593]

On 12/1/2019 at 12:05 PM, ARDHI said:

help me fix runsomware .hets

This is a newer variant of STOP/Djvu. If you have an offline ID, then once we can find the decryption key for this variant and add it to our database you will be able to recover your files. However, if you have an online ID (which is more likely) then it will not be possible to recover your files. There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/