Do you know what Noos Ransomware is?
When Noos Ransomware corrupts files, it changes the data within them, which makes them unreadable. If files are unreadable, the owners of these files cannot use them, and that is likely to worry them greatly. While it is possible to replace some files, replacing personal files might be impossible. So, if the infection encrypts photos, documents, and other types of files that cannot be replaced, the victim is likely to be easier to manipulate. That is not the case if backups exist outside the infected computer. Backups are copies of files, and if they are not affected by malware – which can happen if they are backed up internally or if the victim accesses backups while the infection is active – they can be used to replace the corrupted files. Hopefully, that is how you can solve your problem, but you should do it only after you delete Noos Ransomware from your system. Want to learn more? Keep reading.
There is a good chance that you executed Noos Ransomware yourself by opening a malicious file that could have been sent to you via email or hidden in an unreliable bundled downloader. Ransomware is also known to spread by exploiting system and software vulnerabilities, and other infections could aid the downloading and execution as well. That is how Reco Ransomware, Boot Ransomware, and other infections from the STOP Ransomware family are likely to spread too. We have already discussed the removal of these infections in previous reports. The truth is that all of these infections are identical, and so we know exactly how to remove Noos Ransomware. Of course, before you get to that, we want to explain how this malware works. First, after it slithers in, it performs file encryption. It is easy to notice which files were corrupted because the “.noos” extension is appended to their names. Do not bother deleting this extension because that would be a complete waste of your time.
Noos Ransomware screenshot
Scroll down for full removal instructions
After encryption, Noos Ransomware creates a few files. It drops malware files to a folder with a random name in %LOCALAPPDATA%. In the %HOMEDRIVE% directory, the infection drops a folder named “SystemID,” and this folder holds a file name “PersonalID.txt.” This file represents an ID code that is also included in the “_readme.txt” file, which can be located in the same directory. This text file, arguably, is the most important one because it informs what has happened and also presents the instructions that cybercriminals want you to follow. What they want you to do is send them your ID code via email to gorentos@bitmessage.ch (the reserve email address is gerentosrestore@firemail.cc) and then pay a ransom. At the time of research, victims were instructed to pay $490 within 72 hours to obtain a decryptor. How can you be sure that you would be provided with a decryptor after doing all of this? You cannot be, and that is why we do not recommend interacting with the attackers behind Noos Ransomware. In fact, you might not need to if you can employ a free decryptor.
Malware researchers have created a tool called STOP Ransomware Decryptor. If you can get your hands on this tool, you might successfully decrypt your files without having to communicate with attackers or pay a ransom. Of course, you want to look out for fake tools posing as legitimate decryptors! Unfortunately, the success of a free decryptor is not guaranteed, and so it is best if you have backups. Once you decide what you want to do with your files, you need to remove Noos Ransomware. Do this before restoring or replacing files. Manual removal is an option, but our team advises implementing anti-malware software. It would delete the threat automatically, but it is most important that it would reliably protect your system.
Delete Noos Ransomware
- Delete all recently downloaded suspicious files.
- Launch Explorer (tap Win+E keys) and enter %homedrive% into the quick access field.
- Delete the file called _readme.txt and a folder called SystemID.
- Enter %localappdata% into the quick access field.
- Delete the folder with a random name that contains malware files.
- Empty Recycle Bin and then quickly install a legitimate malware scanner.
- Perform a full system scan to check for threats that might still require your attention.
In non-techie terms:
Noos Ransomware is an infection that encrypts files. When files are encrypted, they cannot be read normally. The purpose of this is to convince victims to pay a ransom in return for a decryption tool, but victims of this malware need to understand that the promises of attackers are unlikely to be reliable. Even if you send a message and then pay the ransom, you are unlikely to decrypt your files. Luckily, it seems that a free decryptor is available. If it does not work for you, maybe you can replace the corrupted files with backups? Do not forget to backup all personal files in the future because there are plenty of infections that are out there to get it. As for the removal of Noos Ransomware, while it is possible to delete the infection manually, we encourage all Windows users to install anti-malware software. Besides performing the removal of malware automatically, it also would ensure full-time protection against new threats.