NoobCrypt ransomware / virus (Removal Guide) - Jul 2017 update

What is NoobCrypt ransomware virus?

NoobCrypt revival brings out new virus versions

NoobCrypt virus is one of those ransomware ^[1] viruses which seem destructive at first but turn out to be not as malicious under further investigation. The initial virus version appeared in September, but it was quickly taken down by the virus researchers.

Unfortunately, that did not stop the criminals. After a brief period of silence, the virus came back with a new force. The latest malware version has changed its ransom note design and demand 100 dollar-ransom to be sent to their account in Bitcoin crypto-currency. The virus encrypts files with RSA-2048 and AES-128 ciphers and threaten that if the ransom is not paid in time, the hackers will corrupt user's personal files beyond recovery.

However, while the new ransomware variant is causing most of the upsurge at the moment, its previous version has not gone obsolete either. It is demanding 299 USD in return for the locked data.

Regarding its ransom message, one might suspect that this virus is the misdeed of amateur hackers. However, the original version still has managed to encode personal information with the help of a complex mathematically interrelated set of codes, specifically AES algorithm.

If we believe the content of the message, the virus was generated in Romania ^[2]. Thus, the residents of the latter country should be extremely cautious. On the other hand, it does not mean that if you live in the country far from this European state, you can escape this threat. That is why it is important to arm up with the knowledge about effective NoobCrypt removal.

NoobCrypt virus versions have use different ransom notes. You can see examples of these notes above.

Reviewing this ransomware, it does not present any extraordinary nor unusual features. As usual, hackers attempt to persuade you into remitting the payment for the locked personal files. Certainly, without the private key, decoding your files is not an easy task to do.

Thus, the cyber criminals employ psychological pressure ^[3] to urge you with the payment. They threaten to delete some files every two hours. The standard amount of the ransom equals 299 dollars. The victims of NoobCrypt ransomware are expected to purchase Bitcoins and then enter the unique verification code in the provided bar in the ransom message.

At first glance, the virus is ordinary file-encrypting malware. Users who are befallen by this menace might panic while searching for a way to retrieve the files.

However, IT experts have discovered that there are several significant flaws in the source code of the malware. It creates only one registry entry — HKEY_CURRENT_USER\k1j3jk153kj153. Thus, it is unlikely to re-launch itself after the reboot of the operating system.

The ransomware behaves more like a lock-screen virus. Luckily, there is no need to pay the money, because malware specialist, Jakub Knoustek, discovered a key. Enter ZdZ8EcvP95ki6NWR2 code into the bar which requires the verification code. After that, you will be able to decrypt the files for free. After that, remove NoobCrypt right away. FortectIntego is one of the security programs which quickly and effectively deal with the ransomware.

September 2016 update: NoobCrypt uses the same decryption password for all of its victims

Just recently Noob Crypt virus researchers have made a breakthrough with this ransomware by disclosing another huge flaw in the program's source code.

Iakub Knoustek, who initially came up with NoobCrypt decryption key, continued to inspect the virus even further and found that this key is only suitable for some computers, while the others remain undecryptable. The main problem is that there are several versions of the NoobCrypt malware and each of the version feature a different decryption code.

Luckily, the same code unlocks all computers infected with the same version of the virus. So, to decrypt your data, you only need to find out what particular version of the virus has infected your PC.

To do that, pay attention to the ransom note details such as the amount of ransom and the Bitcoin wallet address. For instance, the code “ZdZ8EcvP95ki6NWR2” only works for the virus versions demanding the highest ransom — 299 USD.

The virus version demanding 100 dollars for the data decryption can be decontaminated with a code “RedStarPenis”, while the ones asking for 50 USD can be unlocked using lsakhBVLIKAHg. Good luck decrypting your data! Just do not forget to eliminate the virus from your computer when you do!

Experts detect improved virus versions

After the IT professionals have shattered the hackers' ambitions mercifully, it seems that there is going to be one virus less in the virtual world. Nonetheless, the authors have proved not be so “noob” and decided to counterattack the IT specialists.

Consequently, an improved version of the ransomware was detected. The renewed edition contains several improvements, such as C+ evaluation copy.

However, to big disappointment of the crooks and the joy of the virtual community, the improvements made the virus worse. In other words, the hackers included obfuscating elements, but in the end they resulted in the version of the virus which does not require any decryption key!

However, such improvements reveal that crooks, whether they are member of organized cyber rime gang or just hacker-wannabes, still create significant problems for the users. Though rarely the virus updates mess up the virus itself, such

Principles of system infiltration

Since the hackers behind NoobCrypt seem to be amateur hackers yet, it is likely that the malware is distributed via P2P file sharing websites or other questionable advertising, gaming, or pornographic domains. Such domains often contain various hyperlinks.

After a user clicks on such link, he unintentionally downloads the file with the ransomware. Alternatively, it is a matter of time when cyber criminals decide to shift to another, a more profitable method of distributing the malware.

It is a common tendency to transmit file-encrypting viruses via spam emails. In the case of some previous ransomware, cyber criminals have manifested real mastery by creating fake letters which can be easily mistaken for the official emails received by governmental institutions.

Thus, if you receive an invitation to fill the form for a tax refund or customs declaration, do not open any attachments. They might contain NoobCrypt hijack within. In order to block any malware, which might disguise the virus, and decrease the number of spam emails, install an anti-spyware application.

NoobCrypt removal and recovery

Since this virus is not a mere PUP, we highly advise you to opt for the automatic elimination. The security application, FortectIntego or Malwarebytes, will remove NoobCrypt virus properly.

If you update the application regularly, it will safeguard your PC from all kinds of threats. However, you might encounter some problems related to NoobCrypt removal because the virus locks your screen and you cannot operate your device properly.

If after entering the above-provided code, the computer still remains unusable, use the recovery instructions below. After the threat is completely eliminated, you should focus on developing several plans in case ransomware targets your system again:

• Update security applications daily
• Store your private information in several locations
• Employ portable data keeping devices, such as USB sticks or DVDs to secure your data copies