Nemesis Ransomware Virus (Removal Steps and Protection Updates)

The Nemesis ransomware is a new type of encrypting malware that uses the AES cipher to compromise valuable user data and extort the victims for a ransom payment. Our removal guide will show you how you can remove the existing infection from your computer and protect yourself in the future.

Nemesis Ransomware Description

Nemesis ransomware shares the same ransomware family as CryptON and X3M crypto viruses. It uses the typical infection patterns of a data locker ransomware by activating its encryption engine upon infection.

Once the malicious Nemesis ransomware payloads are on the computer, it initiates the infection process. The ransomware ensures its sustainable presence on the PC by creating files and accessing different system libraries that allow it to perform various functions. The Nemesis ransomware associated files may plague essential Windows OS folders like:

  • %AppData%
  • %Windows%
  • %Local%
  • %Roaming%

Afterward, it initiates scanning process and encrypts all files set as its target utilizing the AES-256 encryption algorithm. The encrypted files may be marked with malicious extensions that include hackers’ email and four or five randomly generated symbols at the end like .v8dp, .63vc4, etc. Viruses like this one usually target commonly used and important file types – various multimedia files (audio, video, and photos), backup images, configuration files, office documents and more.

Nemesis is also able to connect its remote command and control server to transfer the decryption key so that only crooks possess it and blackmail victims for a ransom payment. So after the encryption process, the threat is designed to drop a ransom note in a file called “### DECRYPT MY FILES ###.html” that is automatically displayed on the victim’s screen. The text is encouraging victims to pay the ransom for the decryption key and all it could read is:

Your documents, photos, databases and other important fíles have been encrypted! To decrypt your files you need to buy the special software – «Nemesis decrypt»
To obtain decryptor, please, contact me by email: [email protected]
Write me in online Service:
Address: BM-2cVcW2PHuo8HsWtmoY3oFPcU76bqJ*****
Your personál identification ID: id-8932*****

nemesis ransomware ransom note decryption instructions bestsecuritysearch

Nemesis Ransomware
To decrypt your files you need to buy the special software – «Nemesis decryptor»
To recover data, follow the instructions!
You can find out the details/ask questions in the chat:
h**ps:// (not need Tor)
If the resource is not available for a long time, install and use the Tor-browser:
1. Run your Internet-browser
2. Enter or copy the address hxxps:// in the address bar of your browser and press key ENTER
3. On the site will be offered to download the Tor-browser, download and install it. Run.
4. Connect with the button “Connect” (if you use the English version)
5. After connection, the usual Tor-browser window will open
6. Enter or copy the address h**p://qg6m5wo7h3id55ym.onion in the address bar of Tor-browser and press key ENTER
7. Wait for the site to load
// If you have any problems installing or using, please visit the video tutorial h**ps://

The file could be found on the desktop as well as any other folder with encrypted files. Like other related threats, the Nemesis ransomware appends a unique victim id to every infected host. The ransom is demanded in Bitcoins, however, there is no specified amount.


The latest reports about the Nemesis ransomware reveal that the threat is likely to have a new variant that uses a long extension that contains several random hexadecimal characters and the malicious extension at the end of the file name. Security researchers are currently investigating the ransomware samples so our advice is to save your encrypted data and wait for a possible breakthrough. Meanwhile, some alternative data recovery solutions may be of help to restore critical data – look at step six in the removal guide at the end.

Nemesis Ransomware Distribution

The first Nemesis ransomware infections were reported by victims on January 8. It is not known which infection method is primarily used by its operators, however, we can assume that spam email campaigns and infected software bundles, as well as updates and games downloaded from hacked or malicious sites or BitTorrent peers, may be the primary medium.

It appears that Nemesis ransomware primarily targets English-speaking users.

Summary of Nemesis Ransomware


Nemesis Ransomware

File Extension
.v8dp or .63vc4, another combination of random symbols or


Easy Solution
You can skip all steps and remove Nemesis ransomware with the help of an anti-malware tool.

Manual Solution
Nemesis ransomware can be removed manually, though it can be very hard for most home users. See the detailed tutorial below.

Spam emails, malicious URLs, malicious attacments, exploit kits, freeware.

Nemesis Ransomware Removal

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

    1) Hit WIN Key + R


    2) A Run window will appear. In it, write “msconfig” and then press Enter
    3) A Configuration box shall appear. In it Choose the tab named “Boot
    4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
    5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking

STEP II: Show Hidden Files

    1) Open My Computer/This PC
    2) Windows 7

      – Click on “Organize” button
      – Select “Folder and search options
      – Select the “View” tab
      – Go under “Hidden files and folders” and mark “Show hidden files and folders” option

    3) Windows 8/ 10

      – Open “View” tab
      – Mark “Hidden items” option


    4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

    1) Hit the following key combination: CTRL+SHIFT+ESC
    2) Get over to “Processes
    3) When you find suspicious process right click on it and select “Open File Location
    4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process
    5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Nemesis Ransomware Using SpyHunter Anti-Malware Tool

Manual removal of Nemesis requires being familiar with system files and registries. Removal of any important data can lead to permanent system damage. Prevent this troublesome effect – delete Nemesis ransomware with SpyHunter malware removal tool.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

    1) Again type simultaneously the Windows Button + R key combination
    2) In the box, write “regedit”(without the inverted commas) and hit Enter
    3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
    4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

    1) Use present backups
    2) Use professional data recovery software

      Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.
    3) Using System Restore Point

      – Hit WIN Key
      – Select “Open System Restore” and follow the steps


    4) Restore your personal files using File History

      – Hit WIN Key
      – Type “restore your files” in the search box
      – Select “Restore your files with File History
      – Choose a folder or type the name of the file in the search bar


      – Hit the “Restore” button
      5) Emsisoft’s CryptON Decrypter

      Since the Nemesis ransomware is believed to be the same ransomware family as CryptON, some encrypted files may be restored with the help of Emsisoft’s CryptON Decrypter. Just make ensure to have copies of all encrypted files before any recovery attempts.

STEP VII: Preventive Security Measures

    1) Enable and properly configure your Firewall.
    2) Install and maintain reliable anti-malware software.
    3) Secure your web browser.
    4) Check regularly for available software updates and apply them.
    5) Disable macros in Office documents.
    6) Use strong passwords.
    7) Don’t open attachments or click on links unless you’re certain they’re safe.
    8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

Author : Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

Related Posts