A rather obnoxious string of ransomware has been discovered, dubbed nRansom by malware researchers. The virus not only pretends to be FBI, but also asks victims to kill 10 people and record it on video, as well as send 20 nudes. This type of mocking ransomware is most likely oriented towards malware researchers, but it may as well be a test before an actual mass spam campaign of the virus is released. This is why we have created the following article which aims to help you remove the nRansom virus, in the event that your computer has been infected with it.
|Short Description||Aims to encrypt the files on your compuer and then drops behind a ransom note.|
|Symptoms||A ransom note and a wallpaper is dropped on the computer of the victim, asking the victim to do insane things to get the files back.|
|Distribution Method||Spam Emails, Email Attachments, Executable files|
|Detection Tool|| See If Your System Has Been Affected by nRansom |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss nRansom.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
How Does nRansom Infect Computers
To infect computer system, the nRansom virus may exist in different forms online. For starters, the virus may be sent to victims as fake e-mail attachment in spam messages. The messages may pretend that the virus file is:
- Letter of confirmation.
- Banking statement.
- Other important document.
In addition to this, the nRansom virus may also exist in the form of fake setups, fraudulent game patches, software license activators and other types of fake of programs.
The malicious executable of nRansom has been uploaded at VirusTotal with the following information:
More About nRansom Ransomware
When we first take a look at the nRansom virus, it immediately comes to mind that the virus is of a trolling essence. The first indicator for that is the wallpaper it uses, which is the following:
In addition to the wallpaper itself, the nRansom virus mimicks multiple different police-like ransomware viruses. But the virus completely goes out of logic when the victims read it’s ransom note, which is the following:
“Your computer has been locked and your files will be encrypted if\r\nyou do not follow the instructions to get the code to unlock the\r\nmachine. There is only one way to
recieve the unlock code. you\r\nmust go to www.mail.india.com and and create an account. send\r\nan email to [email protected] we will not reply \r\ninlnediatly. when we reply. send AT LEAST 20
nude pictures of\r\nyou. – send that to me to. once we verify you, we will give you\r\nyour numerical unlock code. IF YOU DO
NOT UNLOCK THE MACHINE IN 5 HOURS\r\nWE NILL ENCRYPT YOUR FILES AM) THEY WILL BE LNLOCKABLE FOREVER.\P\nTHE VERIFICATION NILL ONLY WORK IF YOU OPEN BOBS AND VAGENE !”
So far, it has not been established whether or not the ransomware creators are serious about what they want or are just joking, however, it is more likely just be a cruel joke to victims
nRansom – Encryption Process
The encryption of nRansom may be conducted In several different stages. First, the virus may scan your computer for widely used type of files, while skipping important Windows file types. The types of file extensions nRansom may scan for may be the following:
- Audio files.
- Virtual drives.
- Other files.
Then, the virus may append strong encryption on enough data of the files to render them no longer able to be opened.
Remove nRansom Virus and Restore Files
In order for you to remove this ransom infection from your computer system, it is recommended to follow the removal instructions down below. They are specifically created to help you isolate and remove the malicious files dropped by this virus on your computer. For fastest and most effective removal, it is natural to use a specific anti-malware software which will take care of the removal for you and protect your computer against future infections as well.
In addition to this, the nRansom ransomware is also a threat that may encrypt your files. If that is so, there is an alternative to meeting the insane demands the cyber-criminals want from you and it is to try with the methods we suggest in step “2. Restore files encrypted by nRansom” bellow. They may not be 100% effective for the recovery, but may restore some of your encrypted files as well.