NMO Ransomware Encrypted File
3.0 | 3 Votes
What is an NMO file?
A file with the .nmo extension has been maliciously renamed and encrypted by NMO ransomware. It contains a document, image, video, or other file the ransomware is holding hostage. The .nmo extension and an email address are appended to the file's normal extension, producing a compound extension like .docx.[[email protected]].nmo.
NMO ransomware is a variant of Dharma ransomware (which operates similarly but appends users' files with the .DHARMA extension). After infecting a user's computer, this malware encrypts the user's files and produces a ransom note named info.txt. The note contains instructions users can supposedly follow to decrypt their files.
Unlike most other forms of ransomware, NMO ransomware inserts the attacker's email address in encrypted files' extensions. Presumably, this is to make it easier, and thus more tempting, for victims to contact the attacker and pay their ransom.
How did my computer get infected by NMO ransomware?
NMO ransomware is most commonly distributed within email attachments and programs that appear to be legitimate but are actually malicious. If you recently downloaded and opened an unverified email attachment or program, that may be how your computer became infected by NMO ransomware.
How to open an NMO file
No known program can restore NMO files to their original state. The best way to recover your files is to retrieve them from a recent backup or perform a System Restore to a point before your computer was infected.
FileInfo.com recommends you never pay a ransom to decrypt files encrypted by ransomware. Paying a ransom encourages ransomware distributors to continue their efforts, and there is no guarantee that paying a ransom will give you access to your files. Instead, you should restore your data from a recent backup created before the ransomware infected your computer.