Do you know what Ntk Ransomware is?
Ntk Ransomware does not encrypt files like a number of threats categorized as ransomware do. Instead, it is a screen-locking type of malicious software. It was first detected on the 15th of February, 2017 by malware experts, and it has already managed to infiltrate a handful of systems. Even though its infection rate is not that high at the time of writing, this might change one day because it targets both French and English-speaking users, according to our researchers, even though it uses the French language exceptionally. The email (ths1337@tutanota.com) used by Ntk Ransomware has led to the discovery that this ransomware infection is not the only method used by its developers to obtain money from users. Evidently, cyber criminals behind this threat hack websites too with the intention of getting money from administrators of these pages. Ntk Ransomware is a focus of this article, so we are not going to analyze used website hacking methods here in great detail.
Users find out about the presence of malicious software after several minutes of the Ntk Ransomware entrance because they discover a window “You got pOwned by NTK” locking their screens first. It contains a Guy Fawkes mask, three steps explaining how to unlock the screen, and a small code box at the bottom. It seems that the unlock code is required, and it can only be received by writing an email to ths1337@tutanota.com and doing what cyber criminals say. Most probably, users will be asked to purchase the code for a certain price. It will not be cheap, we can assure you. Specialists do not recommend paying money to developers of ransomware because there are no guarantees that such a code will be sent to you. Also, they do not see a point in doing that when it is possible to unlock the screen without this unique code. More specifically, this can be done by restarting the computer. Since the screen-locker does not have a Point of Execution (PoE), the screen will not be locked again after the reboot. Have you already bought the unlock code? If the answer is yes, you have made a huge mistake. Yes, you will be provided with instructions that supposedly should help you to unlock the screen after entering this code in the box, but, as our team of experts has noticed, these instructions might be useless and do not even help to restore the Windows Explorer, meaning that users might still need to take care of Ntk Ransomware even if they spend money on the code.
Ntk Ransomware screenshot
Scroll down for full removal instructions
It is unclear yet how exactly Ntk Ransomware is distributed, but there is no doubt that this malicious application enters computers illegally and then starts performing its activities on the infected computer immediately. It does not make copies of its executable file once it enters the system. Instead, it works from one place. The only modification it applies after the successful infiltration is disabling the Task Manager. Evidently, it leaves no chance for users to kill its process and remove the screen-locking window easily. Do not worry, as has already been mentioned, it is still possible to do that without the unlock code. The last paragraph of this article, we hope, will answer all your questions about the deletion of this threat.
Users only need to do three things to unlock their screens: restart their computers to remove the screen-locking window, find and delete Ntk Ransomware, i.e. its executable file, and undo changes this infection has applied (enable the Task Manager). The last, i.e. reviving the Task Manager, is the most difficult job you will have to do, but our instructions located below should help you. If not, go to download a reputable antimalware tool, e.g. SpyHunter after unlocking the screen, i.e. after restarting your computer. It will delete all infections it finds on the computer really fast.
Remove Ntk Ransomware manually from your computer
- Reboot your computer to unlock Desktop.
- Find the malicious recently downloaded file after the restart (check such directories as %USERPROFILE%\Downloads and %USERPROFILE%\Desktop).
- Delete it.
- Empty the Recycle bin.
Enable the Task Manager
- Press Win+R.
- Type gpedit.msc in the box and click OK.
- Click User Configuration (you will find it in the menu on the left).
- Select Administrative Templates.
- Click System.
- Select Ctrl + Alt + Del Options.
- On the right-side pane, double-click on Remove Task Manager.
- Check Not Configured or Disabled and then click Apply at the bottom of the window.
- Close the window by clicking OK.
In non-techie terms:
Ntk Ransomware is a dangerous malicious application. Even though it does not encrypt users’ files like other ransomware infections do, its one and only purpose is to get money from users too. Users are asked to pay money for the code to unlock their screens. Sadly, this code might not even reach you, meaning that you might spend your money for nothing. Do not support cyber criminals by making a payment. It would be smart of you to go to delete Ntk Ransomware the moment you have discovered it on your computer. This is a free way to unlock the computer and use it normally again.