Get Rid of the Nuclear #55 Ransomware

The Nuclear #55 ransomware is the newest variant of the Nuke family of ransomware, follow this guide to learn more about it and remove the infection from your PC.

Nuclear #55 Ransomware Description

The Nuke Ransomware (click here to read more about it) has proved to be a popular tool for hackers, as a new variant of it has appeared. The Nuclear #55 ransomware has gained a new name and extension which is used to differentiate between the two. All affected victim files are encrypted with a strong cipher and renamed with the “.nuclear55” file name extension.

Two ransom notes are generated bearing the name “!!_RECOVERY_instructions” with the TXT and HTML formats.
The ransom note contains the following text:

NUCLEAR#55 ~
!! Your files and documents on this computer have been encrypted !!
** What has happened to my files? **
Your important files on your computer; photos, documents, and videos have been encrypted. Your files were encrypted using AES and RSA encryption.
** What does this mean? **
File encryption was produced using a unique 256-bit key generated specifically for this machine. Encryption is a way of securing data and requires a special key to decipher.
Unforunate for you, this special key was encrypted using an additional layer of encryption; RSA. Your files were encrypted using the public RSA key. To truly reverse the unfortunate state of your files, you need the private RSA key which is only known by us.
** What should I do next? **
For your information your private key is a paid product. If you really value your data we suggest you start acting fast because you only short amount of time to recover your files before they are gone forever.
There are no solutions to this problem, and no anti-virus software can reverse the process of file encryption because we have also erased recent versions of your files which means you cannot use file recovery software.
Modifying your files in any way can damage your files permenantly and we will no longer be able to help you. Follow our terms assigned to you below, and we will have your files recovered.
You now have 72 hours to make payment before we destroy your encryption keys, leaving your files damaged for good
How do I recovering my files?
Without Bitcoins your files can never be recovered. Follow the steps below:
[1] => Create a Bitcoin wallet
In order to use Bitcoin you will need to setup your own Bitcoin wallet. We recommend blockchain.info. However, if you already own a Bitcoin wallet you can skip this step.
[2] => Purchase Bitcoins
There are a number of ways to purchase Bitcoins, whether you’re paying by cash, credit/debit card, or direct from your bank account. A range of Bitcoin sellers make Bitcoins easy to obtain.
https://localbitcoins.com Buy bitcoins with bank transfer, cash, and Moneygram (best option – worldwide)
https://coinatmradar.com Buy bitcoins from local ATM machines
https://bittylicious.com Buy bitcoins with bank transfer or debit card (United Kingdom)
https://cex.io Buy bitcoins with credit/debit card or bank transfer)
https://btcdirect.eu Buy bitcoins in Europe
https://coincorner.com Buy bitcoins in Europe with credit or debit card
[3] => Send bitcoins to our address
You should send 2 BTC to our Bitcoin address: 1NLLrung1MaXucHpAzY5KjdK4y8woodJWt
[4] => Contact us and receive encryption keys, and file recovery software
– Send an email with the subject ‘PAYMENT’ along with 1 encrypted file attached [these end in .nuclear55], to [email protected]
– Wait for a response from us (up to 24-48 hours)
– Receive file decryption software to decrypt every encrypted file on the hard drive
– If you do not here from us after 3 days, register an account on mail.india.com and email us. Your mail provider may be blocking us
– We will not respond without proof of payment. If you waste our time, we will destroy your encryption key and waste the life of your files
—————————————————————–
Our service is not designed to harm his/her computer in any way, but to provide a full decryption service of the intended computer and allow the user to regain access to the specified files.
—————————————————————–

What is interesting is that the variant uses the same email address ([email protected]). The ransomware demands the sum of 2 Bitcoins, which is equivalent of around 1300 US Dollars. Like other ransomware the threat also generates a unique victim ID that is used to identify the victim’s machine and affected files.

Nuclear #55 Ransomware Distribution

There have been no reported large-scale campaigns using the Nuclear #55 ransomware, however several samples containing the malware threat have been captured. Ransomware such as this one are primarily distributed via malicious spam campaigns that contain binary attachments or links that lead to the infection.

Nuclear #55 Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Nuclear #55 completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Nuclear #55 Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter