Site icon EaseMyPhD

New NLAH virus attacking window users: Protect your important research data

What is NLAH?

NLAH ransomware is a new malicious software launched one or two weeks ago attacking primarily window users. It is a member of a STOP Djvu ransomware family and was first discovered by Michael Gillispie as reported by him on twitter on 2nd June 2020. It can enter your PC through malicious ads, email attachments and torrent sites. Systems infected with this virus get all their data files encrypted in a way that all files get modified with a .nlah extension and slowly within a span of a day or two, file type is altered to NLAH. After the virus has penetrated all your files, a “_readme.txt” file is created asking for big ransom amount for decrypting the data. It says that all your data files are secure and will be returned to you iff the asked amount (varying from 490$ to its double)  is paid as ransom in bitcoins at given account details. Also this virus attempts to prevent users from contacting with cyber-security websites by creating a fake window update. To aggravate the issue, password-stealing trojans get installed in your PC automatically. It has the ability to encrypt the files on all the drives strapped with your PC such as internal hard drives, USB disks, network storages, etc.

No Antivirus!!

No antivirus has been prepared for it till now, much likely as coronavirus vaccine. Once your files have got encrypted, they can’t be decrypted unless a ransom is paid to the attackers. However, there are solutions available to get rid of the virus from your PC so that newly installed files can be saved from infections. In case encryption has been carried out using an offline ID, there is probably a chance that any of available decrypters might help you. It is a cryptographic key that is used by the virus when it is not in connection with its commands server. However in the event of encryption carried out using an online ID, it is almost impossible to retrieve the data without the payment of ransom as of now.

Remove NLAH virus from your PC

 The strategies to remove the virus from the system are detailed below.

Step 1: Download and install Malwarebytes Free

It runs alongside antivirus software without conflicts. For complete removal of virus, scan your computer with this software in safe mode and quarantine the malicious entries detected by the software and lastly completely delete them. To enter safe mode, press Windows key + R  and type MSCONFIG, a window will appear in which you have to click on boot >> safeboot >> restart your PC. Similarly to get out of safe mode, press Windows key + R  and type MSCONFIG, and unclick the boot option and restart.

Step 2: Use HitmanPro

It uses a cloud based approach for malware scanning all active files and all the suspicious locations where virus can reside. It offers 30-days free trial and hence can be used for the time being. Again scanning in safe mode is more beneficial.

Step 3: Use Emsisoft Emergency Kit

Use this kit to double check any leftover malicious entry in your PC after scanning with Malwarebytes and HitmanPro.

Step 4: Downlaod Emsisoft decrypter for STOP Djvu

This can help to decrypt your files in case of use of an offline ID.

Protect your work from virus attack

Always  Enable your Firewall

It is a security application built by Microsoft and instituted in windows to screen network data transmissions to and from your windows system. Earlier it was known as Internet Connection Firewall, then later in 2004, it was renamed as Windows Firewall with improved core capabilities.  It demolishes the malicious softwares such as Trojans Horse attacks and worms entering your PC. It is automatically turned on in modern windows versions and runs silently in the background. Most windows program using internet and demanding internet access automatically add exceptions to windows firewall. If they don’t add such exceptions, a windows security alert is displayed by firewall asking you to allow access or not. And here, your wisdom plays the role. Don’t allow access to any suspicious software into your PC!!

Don’t open spam mails

These are the unsolicited messages sent in bulk by the email. Consistent rise in email spam since early 1990s was accounted for  90% of total email traffic as estimated in 2014. Besides being annoying, these are threatening to system’s security. Users should not open any link provided in the email messages that look like emails as these may contain URLs to malicious websites.

Use pop blockers

A pop up is a graphical user interface, usually a small window appearing in the foreground of visual interface and is a means of online advertising. These are usually written in JavaScript that provided capability for a web page to open another window. A pop up may include the tab ‘Close’ or ‘Cancel’ but there is no guarantee that link behind the tab will dismiss the pop-up and may appear to be dangerous triggering other pop-ups and download of viruses in PC. Opera was the first internet browser to incorporate an pop-blocking tool. Later, Mozilla improved on this by allowing pop-blocks as the page loads. At present, all ,modern web browsers allow users block unwanted pop-ups completely.

Back up your important data

Always keep a copy of your important work data in a hard disk, google drives, one drive etc. This will serve as a boon to you in case of any mishappening. One drive is Microsoft’s storage service for hosting files in the cloud and offers you a simple way to store, share or sync your files. It is freely available to all the owners of a Microsoft account.

for more details contact us: info@easemyphd.com

copyright@EasMyPhD 2020
Exit mobile version