How to remove nRansom ransomware

nRansom is ransomware that may ask nudes instead of ransom

nRansom is a ransomware virus that has been first detected in 2017 by malware researchers. Its payload is being distributed as a Hide My Ass VPN software via spam,^[1] exploit kits and similar means. Once installed, it initiates multiple system's changes and displays a lock screen, which demands the victim to transfer at least ten nudes 1_kill_yourself_1@protonmail.com email address.

The nRansom ransomware has been silent for a while and came back with a new version dubbed as nRansom Reborn. While its behavior remains more or less the same, it changed the contact email to die_yourself@protonmail.com. Besides, the number of nudes demanded was increased to 15 in exchange for nRansom Reborn decryptor. The text submitted on the ransom note claims:

NRANSOM REBORN
I have finally awaken

Your computer has been locked. Don’t worry; your files are safely and easily accessible by closing this window.
But how do you close this window?

The button at the bottom will close this window.
However, it will only close if you have the unlock code.

Getting the unlock code is easy. Go to protonmail
and send an email to me. My address is
die_yourself@protonmail.com

Send me 15 of your nudes and
then I will give you the unlock code.

The code goes here –>

The nRansom Reborn ransomware belongs to the crypto-lock ransomware family.^[2] That’s because it does not encrypt files but instead renders the entire system inaccessible by displaying a lock screen. The initial version used Tom the Train theme, while the Reborn virus uses Barney the Dinosaur.

We believe that no one wants to send nude photos to criminals so that they could spread them in various adult websites or use for other crimes. We do not recommend doing that anyway because it’s not clear whether crooks will send you the unlock code. We recommend you to remove the nRansom Reborn virus from the system instead.

You may ask how it’s possible as you cannot access the desktop. Bedynet.ru^[3] experts claim that all you have to do is to restart your PC into Safe Mode with Networking and run a full system scan with FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.

Be careful with spam emails

Ransomware is one of the most dangerous infections on the web. They can lock the screen or encrypt files and demand to pay a ransom. While usually, criminals accept the redemption in the form of money in Bitcoins or another cryptocurrency, the others ask for nudes or urge to play a game.

Anyway, ransomware viruses are hazardous and can cause both money and data loss. To protect yourself from such attacks, be extremely careful with spam email attachments. That’s the number one medium used to distribute ransomware payloads.

If you received a doubtful message from well-known companies like Amazon, eBay or IRS, do not fall for opening them. Crooks often exploit such names to claim trustworthiness, though the attachment may be malicious.
Besides, make sure to have a reputable anti-virus installed and update it regularly to prevent exploit kits, fake software downloads, and other tricks.

NRansom removal tutorial

It’s a must to remove nRansom ransomware if you want to start using your PC as you used to before the attack. Since your screen is locked and you cannot launch anti-virus, restart your PC into Safe Mode with Networking as explained below.

In case you found your files encrypted after nRansom removal, try to encode them using third-party data recovery programs. Our top pick options for data recovery are listed down below.