Nransom Ransomware

Nransom Ransomware is a threat that can block your screen and then ask you to send nude photos of yourself as a way of paying for unlocking the computer. It appears to be the malicious program’s creators prefer selling their victims’ photos to gain money instead of asking for a specific price. No doubt, such option might not sound too pleasant, especially if you need to use your computer badly. The good news is it is not a complicated application, and our researchers say anyone can unblock the screen if they know the right keys to click. To be more precise, if you came across Nransom Ransomware, you do not have to take nude pictures to get back the control of your computer. All the user needs to do is slide below this article and complete the steps prepared by our specialists; they will show what the malware’s victims should do to unlock the screen and remove the infection manually. Of course, if you want to know more about this threat first, we would recommend reading our full article as well.

You may wonder how users infect their systems with threats like Nransom Ransomware, to begin with. Our researchers who tested the malicious program say at the moment of writing it is still unknown how exactly it is being spread. However, we have no doubt the Nransom Ransomware’s creators are using more or less the same distribution channels as other hackers responsible for similar malware. For example, a lot of ransomware is distributed via infected email attachments, which is why it is so crucial to keep away from files sent by someone you do not know or for reasons you do not understand. Additionally, our researchers strongly recommend staying away from websites distributing suspicious freeware or pirated software as the installers they offer could be bundled with malicious programs like this screenlocker. Needless to say, a trustworthy antimalware tool would help you maintain the system’s security too, so provided you do not have such a tool yet, we advise you to consider having one.

Nransom Ransomware blocks the screen by putting a borderless window on top of it. The window should show lots of small pictures of a fictional train character known as Thomas and particular swear words next to him. Some part of the window is covered with black space, and it contains text written in white letters. According to it, the user is supposed to send an email to 1_kill_yourself_1@protonmail.com. It would seem once the malware’s creators respond the user is asked to submit 10 pictures of himself and he has to be nude in them. Given the hackers receive such photos they claim they would have to confirm the user is in them and only then they will send the unlock code. As you see next to the instructions, there is a box with an “Unlock” Button next to it. Luckily you do not have to go through all of this as a simple Alt+Tab combination should unblock the screen.

Nonetheless, keep it in mind Nransom Ransomware will lock the screen once again if you restart the computer without deleting it first. Therefore, once you press the mentioned keys, you should immediately launch Task Manager to kill the threat’s process. The moment it is no longer running you should be able to remove the malicious program’s launcher. It ought to be located in some random folder in the %TEMP% directory. On the other hand, instead of looking for it on your own you could right-click Nransom Ransomware’s process in the Task Manager, then choose the “Open File Location” option and the software should open a folder containing the malware’s launcher. No doubt, this might sound somewhat complicated to inexperienced users which is why in addition to explaining how to remove the infection here we are placing instructions showing what to do bit by bit just slightly below this article. Keep it in mind, the malicious program can be deleted with automatic features too, so if you prefer it, you can use an antimalware tool as well.

Eliminate Nransom Ransomware

1. Click Alt+Tab to unblock the computer.
2. Then press Ctrl+Alt+Delete to launch Task Manager.
3. Look for the malware’s process; it could have a random name.
4. Right-click this process and press Go to Details to make sure it is related to the threat (if it is it should be described as “nRansom” in the description tab).
5. Right-click the malicious process once more and select Open File Location.
6. Minimize the opened File Explorer’s window.
7. Go back to the Task Manager and select the infection’s process once again, then press End Task.
8. Open the File Explorer’s window that shows where the malware’s launcher is (it should be some random directory in %TEMP%).
9. Right-click the threat’s launcher and click Delete.
10. Close the File Explorer.
11. Empty your Recycle bin.
12. Reboot the computer.