.DED Dateiendung

Nbes ransomware is a type of malware utilized by cybercriminals that encrypts the files on a computer with AES-256 encryption. After the ransomware takes the files hostage, it forces the victim to pay the perpetrator to unlock the files. It is most often introduced to a victim's computer through spam emails with a .DOCX file attached that stores the ransomware.

When the ransomware runs on a user's computer, it encrypts files on the computer and adds the .ded extension onto the names of the files. The types of files typically targeted include spreadsheets, documents, images, videos, and system files, such as .CSV, .PDF, .JPEG, .AVI, and .DLL files. For example, an presentation.pptx file becomes presentation.pptx.ded.

The virus then generates a ransom note image instead of a ransom note .TXT file and sets it as the background of the user's desktop. The image includes instructions explaining the hostile takeover of the user's files and how the user can recover his files by paying a ransom payment, which is typically 2 Bitcoins.

No known program can restore DED files to their original state. The best way to recover your files is to retrieve them from a recent backup or perform a System Restore to a point before your computer was infected.