Remove Nuke Ransomware and Restore AES Encrypted Files - How to, Technology and PC Security Forum |

Remove Nuke Ransomware and Restore AES Encrypted Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

nuke-ransomware-sensorstechforum-ransomware-malwareNuke ransomware virus is here and it aims to nuke any chance it’s victims have of seeing their files again, by encrypting them with a strong AES-256 bit cipher. The ransomware demands from affected users to contact the criminals at to get more instructions on how to get their files back. What Is interesting about Nuke is that this variant uses a .pdb file to encrypt data which is rarely seen in ransomware viruses. In case you have become a victim of the Nuke virus, we strongly urge you to back up the encrypted files and use the instructions below to attempt and decrypt them after removing Nuke from your computer.

Threat Summary

NameNuke Ransomware
Short DescriptionThe ransomware encrypts files with the AES-256 encryption algorithm.
SymptomsFiles are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a wallpaper.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by Nuke Ransomware


Malware Removal Tool

User ExperienceJoin our forum to Discuss Nuke Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

How Does Nuke Ransomware Infect

Typically to ransomware infections, like the latest Locky, Nuke may spread via different spam campaigns of malicious files or URLs. Such campaigns are mostly conducted via phishing e-mail messages, but they may also spread spam on social media websites as well as other online locations.

To perform a successful infection. However, an exploit kit may be used by Nuke ransomware which essentially takes advantage of several different exploits in Windows to cause a successful infection. Another method of infection may be If an obfuscated.JS (JavaScript) is being used to slither the malware without any trace of files left on the compromised computer.

What Does Nuke Do After Infection

After it contaminates a targeted computer, the virus may drop it’s malicious payload, named Nuke.pdb in the following Windows directory:

→ D:\Software\Nuke\Nuke\bin\Debug\CryptoObfuscator_Output\Nuke.pdb

The file format of the file is very interesting (.PDB) and according to Fileinfo ( this type of file is associated with the following programs:

  • Quicken.
  • Microsoft Visual Studio.
  • Pegasus.
  • Palm Pilot.

It is not yet clear whether this file is the Program Database file format. It may simply carry the .pdb file extension, but it most likely is and could be used to probably exploit one of the programs above and encrypt user files.

To encrypt files of a compromised computer, the virus uses several different methods and strategies. Some of those methods are primarily oriented with scanning and comparing file extensions from a pre-configured list of such to encrypt. Nuke ransomware may target file extensions of widely used file types, such as:

  • Videos.
  • Audio files.
  • Adobe Reader files.
  • Microsoft Office documents.
  • Adobe Photoshop files.
  • Photos.

After encryption, the Nuke ransomware virus adds the following ransom note as a wallpaper:


In addition to this another file is also added with detailed instructions on paying the ransom as well:


Nuke Ransomware – Conclusion, Removal, and File Restoration

As a bottom line, Nuke Ransomware is a malware threat resembling most Shade XTBL variants. However, do not be fooled by it and do not take it lightly. We will keep researching and post a decrypter if it is available for this virus as soon as it is.

In the meantime, it is higly advisable to follow the instructions below and remove Nuke ransomware and also attempt to restore your files using the alternatives in step “2. Restore files encrypted by Nuke” below. Make sure to backup the files before attempting any type of file decryption.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share