Need Immediately Help .COOS Virus dencrypt

[Aaravchand 78]

hijo mailea euta website bata software download gareko theya it was call netwatcher.exe
But when I installed it, I feel a little suspicious and when I successfully installed it I tried to open the software through its icon on desktop so Jaba mailea tyo software Ko icon hereya at that time The icon was different that It was shown in the website and suddenly I get administrative request. I was already  suspicious, so I click No and again I get administrative request and I click No. The request came 3 times more. and Suddenly My PC speed dherai slow vo I can't even open my computer and then I restart my pc and when I try to open my videos and photos on PC it was names like image.jpg.coos

and when I try to open it was saying

please select the program to run the file aani jaba ma Image viewer program lai select garera  file open garanea try gardaii theya  it was saying the file is corrupt

So I search for the solution on Internet 
How to remove .coos virus and dencrypt it so I installed 360 Total security pc version and malaiea Deep scan garea and the virus were deleted but the virus Encrypt my files and again I search on Internet how to dencrypt they suggest many ways to solve and software to pay them in order to dencrypt and I get these _readmefile on every folder on my file and on that folder I can see

 

these people need $490 to send me the software to dencrypt files 


so if you guys can help me please do it I can't access my my files and can't till the maker send the software and also I have tried all ideas suggest on internet IF YOU KNOW SOME HACKING OR MORE ADVANCE TECHNICAL GUYS THAT YOU CAN SLOVE MY PROBLEM PLEASE MESSAGE ME I DONT WANT TO PAY RS.98000 FOR UNLOCKING MY FILE

[ZeroOne 01 49]

I couldn't find any antivirus that can decrypt this .coos ransom virus.

If there are not much thing on your pc . Sign out from everything then I suggest boot your pc then install new windows via pendrive. Format your drive if everything is infected before installing new windows.

Edited January 12 by ZeroOne 01

[Aaravchand 78]

22 minutes ago, ZeroOne 01 said:

If there are not much thing on your pc . Sign out from everything then I suggest boot your pc then install new windows via pendrive. Format your drive if everything is infected before installing new windows.

I wish I could Format my all driver and Install New Fresh windows but the Problem is I have 2TB hardisk and there are 4 Drivers  on 1st driver there is windows File , on 2nd there is my photos, videos and many more personal stuff, on 3rd there is Software where I have all software store on that drive and on last its Anime Driver where I have saved alot of anime. But I installed new windows but the .coos encrypt my all personal file and I cant use them anymore until I get any solution

[RedEye 318]

You have been a victim of Ransomeware. Although it's pretty common i doubt there is a fix that you can use to recover your files. And i tried to look into the coos. Seems it's a relatively new virus. Unless the people who made the virus are uploading fixes on google and paying them to put their websites on the front page and making them do more damage to their PC's. All the fixes seems to be uploaded on google since less than a day.

Now, I am not recommending you try all of these but if you are up for the risk you can look into these sites but looks sketchy AF. So, I personally wouldn't trust much. Even comments on how to fix vids have people willing to pay unless they are also fake but seems somebody just released this new ransomeware.

 

Sorry this ain't any help but to anyone who are downloading their stuff from thirdparty sites pls be careful. Only use trusted sites and be extra aware while downloading from sketchy sites.

 

@ avinash @ Beecase @ sakshyam khanal could one you guys look into this stuff and write a article. I am currently busy with my exams and seems this thing has been blowing up everywhere lately. Might be a way to help stay the community conscious about this and stay safe.

Not only from the physical one but also from virtual one.😋

[Aaravchand 78]

1 minute ago, RedEye said:

You have been a victim of Ransomeware. Although it's pretty common i doubt there is a fix that you can use to recover your files. And i tried to look into the coos. Seems it's a relatively new virus. Unless the people who made the virus are uploading fixes on google and paying them to put their websites on the front page and making them do more damage to their PC's. All the fixes seems to be uploaded on google since less than a day.

Now, I am not recommending you try all of these but if you are up for the risk you can look into these sites but looks sketchy AF. So, I personally wouldn't trust much. Even comments on how to fix vids have people willing to pay unless they are also fake but seems somebody just released this new ransomeware.

 

Sorry this ain't any help but to anyone who are downloading their stuff from thirdparty sites pls be careful. Only use trusted sites and be extra aware while downloading from sketchy sites.

 

@ avinash @ Beecase @ sakshyam khanal could one you guys look into this stuff and write a article. I am currently busy with my exams and seems this thing has been blowing up everywhere lately. Might be a way to help stay the community conscious about this and stay safe.

Not only from the physical one but also from virtual one.😋

I'm really stressed out I'm searching solution on internet but nothing seems to work 
aajai I cant access my files like video, musics and other programs


Someone with very high coding skills can help me I think

[RedEye 318]

1 hour ago, Aaravchand said:

I'm really stressed out I'm searching solution on internet but nothing seems to work 
aajai I cant access my files like video, musics and other programs


Someone with very high coding skills can help me I think

Your thinking of a very high level coder is a little flimsy.

Firstly, Every file is encrypted differently. It is very hard to the point of impossible to decrypt a encrypted file just by looking at it. What you'll need is a key to decrypt it. The same key the encrypter used to encrypt the file. 

Firstly, you will need to know how a ransomeware works. Mostly, the ransomeware will make a copy of all your files, and then encrypt the copy it made and delete the source file. Now using a third party data recovery tool might be able to help you recover the original deleted source file, then you can just recover the file and delete the copied file.

But to do that firstly, you will need to make sure to delete any source of the ransomeware virus which in most cases the will be deleted automatically after encryption because people who do make these virus try to make sure others can't detect what they used but if it isn't you can remove it there are plenty of forums that can help in the internet and then start your PC in safe mode and do the recovery using the tool. This might seem easy but there's another catch. Most data recovery tool will only let you recover certain amount of files for free(most cases 1 to 5 GB). 

Hope this helped even a little and gave you an option if not anything.

[Aaravchand 78]

1 hour ago, RedEye said:

Your thinking of a very high level coder is a little flimsy.

Firstly, Every file is encrypted differently. It is very hard to the point of impossible to decrypt a encrypted file just by looking at it. What you'll need is a key to decrypt it. The same key the encrypter used to encrypt the file. 

Firstly, you will need to know how a ransomeware works. Mostly, the ransomeware will make a copy of all your files, and then encrypt the copy it made and delete the source file. Now using a third party data recovery tool might be able to help you recover the original deleted source file, then you can just recover the file and delete the copied file.

But to do that firstly, you will need to make sure to delete any source of the ransomeware virus which in most cases the will be deleted automatically after encryption because people who do make these virus try to make sure others can't detect what they used but if it isn't you can remove it there are plenty of forums that can help in the internet and then start your PC in safe mode and do the recovery using the tool. This might seem easy but there's another catch. Most data recovery tool will only let you recover certain amount of files for free(most cases 1 to 5 GB). 

Hope this helped even a little and gave you an option if not anything.

really like your idea but it is too much complex process to do

[Aaravchand 78]

@ avinash can your please help me and Can you Please Pin this Topic please

and @Amul @ kal and other admins can you guys help me or do you know any guy who can slove my problem please let me know

[Amul 713]

I will see if i find something on this and would get back to you. 

[Niyankhadka 122]

@Aaravchand I  saw your problem and i was wondering, on which drive your files are encrypted ? If it is system drive, then you can boot the system file. If it is infected to other drives i.e your personal one then, i need to see the solution for that. For now, i need the answer of what i have asked for firstly.

Have you checked this one ?
Remove COOS Ransomware Virus (DECRYPT .coos FILES) | Geek's Advice using restoro.exe file ?

And here i found this one too. 
Remove Coos Virus Ransomware (+File Recovery) - Trojan Killer (trojan-killer.net)

though there has not been offline key found yet to decrypt, it is better to delete affected files before it affects your whole system and files. Try to restore the pc back to the day where it was working fine.

 

Edited January 13 by Niyankhadka

[Aaravchand 78]

51 minutes ago, Niyankhadka said:

@Aaravchand I  saw your problem and i was wondering, on which drive your files are encrypted ? If it is system drive, then you can boot the system file. If it is infected to other drives i.e your personal one then, i need to see the solution for that. For now, i need the answer of what i have asked for firstly.

Have you checked this one ?
Remove COOS Ransomware Virus (DECRYPT .coos FILES) | Geek's Advice using restoro.exe file ?

And here i found this one too. 
Remove Coos Virus Ransomware (+File Recovery) - Trojan Killer (trojan-killer.net)

though there has not been offline key found yet to decrypt, it is better to delete affected files before it affects your whole system and files. Try to restore the pc back to the day where it was working fine.

 

I have tried each and every trick that is shown in the internet each and every 
When I use decrypt software its says that
New key variant found, the ID is appears to be online and when I searched about the problem ID is appears to be online. Then I saw that many people think and even many other software created that say to you if you found ID is appears to be online  problem in dencrypt software there is no chance to let those file back ever

So unfortunately and unwantedly I have to format my all driver which have my personal stuffs, documents and other many more stuffs (around 1TB size ) files deleted and again I have to download using SLOW internet only have 1.2 Mbps download speed

GUYS PLEASE STAY CAREFULL FROM THESE KNID OF RANSOMWARE. THIS STUFF IS VERY HARD/IMPOSSIBLE TO REMOVE SO PLEASE USE TRUSTED SITES AND ALWAYS MAKE BACKUP OF YOU FILES NOT ONLY WINDOWS FILE ALSO YOUR PERSONAL STUFF 

BECAUSE IF WE RESTORE THE DATA IT WILL ONLY RESTORE THE WINDOWS FILE NOT OUR PERSONAL FILE BECAUSE BYDEFAULT WINDOWS ONLY MAKE BACKUP OF YOU WINOWS AND UNTIL YOU MANNUALY SELECT IT