NoobCrypt Ransomware

What is NoobCrypt Ransomware?

NoobCrypt Ransomware is a threat that secretly enters computers and then starts acting the way it is programmed to. If this infection ever enters your computer, it will, first of all, encrypt all the files it finds on your computer. It has been noticed that it encrypts pictures, images, videos, music, and other kinds of files. In addition, it blocks the Registry Editor and the Task Manager to make it extremely hard to remove it. Despite the fact that it is not easy to delete this ransomware infection, you need to get rid of it in the near future because NoobCrypt Ransomware will not allow you to access Desktop and thus use your computer normally. Even if you could access Desktop, it would still be a must to delete the ransomware infection from the system as soon as possible because it is only a question of time when NoobCrypt Ransomware locks all new files you create. As this threat blocks system utilities and does not allow to access Desktop, it will not be easy to erase it from the system; however, we are sure that the information provided in this article will make it easier for you to get rid of this threat, so continue reading!

What does NoobCrypt Ransomware do?

NoobCrypt Ransomware secretly enters computers because its main goal is to extort money from computer users. This ransomware infection was first detected on the 23rd of July, 2016, and it is known that it has already affected a number of computers and stolen $3500 in total. At the time of writing, NoobCrypt Ransomware asks users to pay $299 for the decryption tool. The ransom has to be paid within 48 hours; however, it is written in the ransom note that will appear on the active window covering Desktop that “every 2 hours files will be deleted”, which means that cyber criminals want to convince users to make a payment immediately. Even though it is said that all the files will be deleted if cyber criminals do not receive the payment within the given time, we still suggest that you do not spend your money on the “private decryption key” because you might not even receive it, and it is unclear whether it will really work. In addition, there might be an alternative way to restore those encrypted files. For example, you do not even need the private key if you have copies of your main files because you could restore them easily once you eliminate NoobCrypt Ransomware from your computer.

You will quickly notice the window the ransomware infection will open and a bunch of encrypted files; however, you should know that this threat makes other modifications too. Researchers working at anti-spyware-101.com have carried out research and found that this threat also creates the Value CryptoLocker in HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Fortunately, it does not make copies of itself to different directories. Instead of doing that, it operates straight from the directory it has been launched from. The changes NoobCrypt Ransomware has applied will no longer be visible if you fully remove the ransomware infection from your computer. Be sure you get rid of it as soon as possible.

Where does NoobCrypt Ransomware come from?

Cyber criminals distribute NoobCrypt Ransomware as a legitimate-looking document, usually a .pdf or .doc file in most cases. It comes inside spam emails and looks harmless, which explains why so many users open it and thus allow the ransomware infection to enter their computers. You should not open spam emails and download their attachments ever again if you do not want to allow another computer infection to enter your system. To be 100% safe, you should also not forget to install security software on your computer.

How to uninstall NoobCrypt Ransomware

To be able to remove NoobCrypt Ransomware, you will, first of all, have to start Windows in Safe Mode with Networking because the active window this infection puts on Desktop cannot be removed or hidden. You have two options once you do that: you can either delete NoobCrypt Ransomware manually by using our step-by-step removal instructions or download the automatic scanner, e.g. SpyHunter and erase it automatically. Before you employ any of these methods, try to unlock your files by clicking the Check button on the active window and then entering the key ZdZ8EcvP95ki6NWR2j. If this does not work, it means that you have the newest version of this ransomware infection and simply need to remove it from your PC.

Delete NoobCrypt Ransomware manually

Start Windows in Safe Mode with Networking

Windows 8/8.1/10

1. At the Windows login screen, press the Shift key, click Power, and then click Restart.
2. Open Troubleshoot.
3. Click Advanced options.
4. Click Startup Settings.
5. Click on the Restart button.
6. Tap F5.

Windows XP/Vista/7

1. Restart or turn on your computer.
2. Start tapping F8 when BIOS screen shows up.
3. Select Safe Mode with Networking from the Advanced Boot Options menu using the arrow keys.
4. Tap Enter.

Delete the ransomware infection

1. Tap the Windows key + R simultaneously.
2. Enter regedit.exe in the box.
3. Click OK.
4. Move to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
5. Locate the Value whose name is CryptoLocker.
6. Right-click on it and select Delete.
7. Find and remove the malicious file you have downloaded from the spam email.
8. Reboot your computer.

You should scan your computer with an automatic scanner to find out whether or not there are other threats on your system. If the scanner finds anything, delete those unreliable applications ASAP.

Download Removal Tool100% FREE spyware scan and
tested removal of NoobCrypt Ransomware*