Nhtnwcuf Ransomware

Nhtnwcuf Ransomware is not a typical ransomware infection. Unlike similar threats which seek to obtain money from users, it does not encrypt users’ personal files. Instead, it destroys them all. This malicious application was detected at the end of February (February 23, 2017), which means that it is a newly-developed threat, but, judging from the number of complaints specialists get from users, it seems that it has already affected more than a few computers. Undoubtedly, you have become a victim of Nhtnwcuf Ransomware too if you can locate such files as !_RECOVERY_HELP_!.txt or HELP_ME_PLEASE.txt on Desktop. This vicious threat illegally enters users’ computers with the intention of stealing money from them. Do not transfer a cent to cyber criminals because, as specialists working at pcthreat.com have found, they are not capable of decrypting your files even though they claim that they can do that because the actual encryption of files is not performed. Instead, first 10.45 MB of every file stored on the affected computer is replaced with the random data thus corrupting them all completely. Cyber criminals can do nothing about that too, so transferring money to them would be a foolish decision.

Nhtnwcuf Ransomware slithers onto computers without permission. Then, it scans the machine to find users’ valuable files. After finding pictures, music files, videos, documents, and other data, it corrupts them all without mercy by overwriting a part of every file with the random data. Once it destroys all these files, it drops a .txt file (we have already told you about that in the 1st paragraph). It tells users that their files have been encrypted and they can purchase both the Decryptor and the Unique decryption key from guys behind Nhtnwcuf Ransomware. At present, the price of the decryption software is 1 Bitcoin (~ $1250). Users have to create a Bitcoin wallet and then send this amount of money to the provided Bitcoin address. Once the payment is made, an email with the payment confirmation has to be sent to helpmehelpm@mail.ua (another email address might be used as well). Even though cyber criminals promise to send the decryptor to users via email, we can assure you that this will not happen. Nobody will give back your money either. As has already been mentioned at the beginning of this article, all these files are destroyed, so any decryption tool will not help you to get them back. Although you have lost your files, it does not mean that you can let Nhtnwcuf Ransomware stay on your computer. Find the detailed information about its removal in the last paragraph of this report.

Even though researchers at pcthreat.com have carried out a thorough research about Nhtnwcuf Ransomware, they still could not find much information about the methods used to spread this ransomware infection. Of course, it is clear that it is one of these threats which illegally enter computers but do not try to hide their presence. In other words, this malicious application does not work in the background and does not have a goal to stay unnoticed. Although there is not much known about the distribution method employed, there is no doubt that Nhtnwcuf Ransomware illegally shows up on computers. Ransomware infections can enter PCs with the help of other dangerous threats, users can download them from file-sharing websites unknowingly because they pretend to be useful software in some cases, and, finally, users can allow ransomware-type infections to enter their PCs by opening attachments from spam emails. Not all these spam email attachments are associated with ransomware, of course.

Do not let Nhtnwcuf Ransomware corrupt your new files – go to delete this malicious application from your computer as soon as possible. Start by erasing all recently downloaded/opened files. If you have no idea where to start looking for them, check two directories where users’ downloaded files are usually located: %USERPROFILE%\Downloads and %USERPROFILE%\Desktop. If these malicious files are still nowhere to be seen, use an automatic scanner to find them. There are hundreds of untrustworthy antimalware tools out there, so we highly recommend using SpyHunter instead of trusting the first tool promoted on some kind of dubious third-party page. Click on the Download button below this article to get its free diagnostic version.

Remove Nhtnwcuf Ransomware manually

1. Open the Windows Explorer (tap the Windows key and E buttons simultaneously).
2. Go to %USERPROFILE%\Desktop.
3. Delete all suspicious files.
4. Open %USERPROFILE%\Downloads.
5. Repeat the 3rd step.
6. Delete !_RECOVERY_HELP_!.txt or HELP_ME_PLEASE.txt, depending on which one of them you can find on your PC.
7. Empty the Recycle bin.
8. Perform the full system scan to make sure that there are no traces of the dangerous malicious application left on your computer.