.NamPoHyu is a new malware, the technical characteristics of which match with those of the representatives of the Ransomware cryptoviruses. After infecting the victim’s computer, this threat has the ability to secretly encrypt all the files found on it with a military-grade encryption algorithm and also replace their file extensions with some new ones which are unfamiliar for the system. Once all the data has been locked, the virus creates a special ransom-demanding notification and places it on the screen so that the victims can read it. The notification usually contains a message from the hackers behind the infection and a set of instructions which need to be followed if the users want to regain their access to malware-encrypted files. Typically, a certain amount of money (mostly in cryptocurrency) is requested to be paid within a given deadline in order for the malware victims to obtain a decryption key for the restoration of the sealed information.

The fraudsters promise, as other ransomwares .Etols, Raldug, Veracrypt@foxmail.com, to provide the decryption key and all the tools that you need to liberate your files as soon as the payment reaches their cryptocurrency wallet. Unfortunately, according to most security experts including our “How to remove” team, such promises cannot be trusted. For one, there is absolutely no guarantee that the hackers will send back anything once they get the money and, secondly, there is a high chance that a working decryption key may not even exist.

That’s why, in case that your files have been taken hostage by .NamPoHyu and you are wondering about what you must do, don’t rush with the payment that the blackmailers demand from you. Instead, our suggestion is to focus on the proper removal of the Ransomware and on the alternative file-recovery solutions you can use. That’s why, in the guide below, we have prepared a set of instructions, a trusted malware-removal tool and a special file-recovery section with suggestions for the restoration of your data.

Finding difficulty removing .NamPoHyu Virus Ransomware?

Dealing with malware from the Ransomware type, however, can be a complex task. One of the first things we advise you to do is to arm yourself with a reliable security program like the one linked below. If you already have a security program installed on your computer, restart the machine in Safe Mode with Networking (instructions are available below), install the latest security updates and scan the entire system. If you do not have any security software or your antivirus program fails to detect and deal with .NamPoHyu, you can use the suggested removal tool included in the guide below. It is not a good idea to try to delete the infection by yourself if you are facing such a threat for the first time and are not sure what exactly you have to delete. Otherwise, such attempts can cause even more damage to your computer and to your data. Still, the manual instructions on this page can also be helpful for the removal of the insidious Ransomware infection if you complete them correctly.

Once you ensure that your system is clean and there are no hidden leftovers from the Ransomware, it is time to give a try to alternative data-restoration methods. Unfortunately, removing the infection may not liberate your data from the secret encryption and that’s why you may need to take some additional steps to recover some of your files. If you have backup copies, that will be the ideal case as this is the best protection against threats of this kind.

.NamPoHyu SUMMARY:

[add_third_banner]

Remove .NamPoHyu Virus Ransomware 

1: Preparations

Note: Before you go any further, we advise you to bookmark this page or have it open on a separate device such as your smartphone or another PC. Some of the steps might require you to exit your browser on this PC.

2: Task Manager

Press Ctrl + Shift + Esc to enter the Task Manager. Go to the Tab labeled Processes (Details for Win 8/10). Carefully look through the list of processes that are currently active on you PC.

If any of them seems shady, consumes too much RAM/CPU or has some strange description or no description at all, right-click on it, select Open File Location and delete everything there.

Also, even if you do not delete the files, be sure to stop the process by right-clicking on it and selecting End Process.

3: IP related to .NamPoHyu

Go to c:\windows\system32\drivers\etc\hosts. Open the hosts file with notepad.

Find where it says Localhost and take a look below that. 

If you see any IP addresses there (below Localhost) send them to us here, in the comments since they might be coming from the .NamPoHyu.

[add_forth_banner]

4: Disable Startup programs

Re-open the Start Menu and type msconfig.

Click on the first search result. In the next window, go to the Startup tab. If you are on Win 10,  it will send you to the Startup part of the task manager instead, as in the picture:

If you see any sketchy/shady looking entries in the list with an unknown manufacturer or a manufacturer name that looks suspicious as there could be a link between them and .NamPoHyu , disable those programs and select OK.

5: Registry Editor

Press Windows key + R and in the resulting window type regedit.

Now, press Ctrl + F and type the name of the virus.

Delete everything that gets found. If you are not sure about whether to delete something, do not hesitate to ask us in the comments. Keep in mind that if you delete the wrong thing, you might cause all sorts of issues to your PC.

6: Deleting potentially malicious data – .NamPoHyu

Type each of the following locations in the Windows search box and hit enter to open the locations:

%AppData%

%LocalAppData%

%ProgramData%

%WinDir%

%Temp%

Delete everything you see in Temp linked to .NamPoHyu Ransomware. About the other folders, sort their contents by date and delete only the most recent entries. As always, if you are not sure about something, write to us in the comment section.

7: .NamPoHyu Decryption

The previous steps were all aimed at removing the .NamPoHyu Ransomware from your PC. However, in order to regain access to your files, you will also need to decrypt them or restore them. For that, we have a separate article with detailed instructions on what you have to do in order to unlock your data. Here is a link to that guide.

The post Remove .NamPoHyu Virus Ransomware (+File Recovery) appeared first on Malware Complaints.