PornBlackmailer Ransomware Removal Guide

PornBlackmailer Ransomware is a dangerous malware program that uses scare tactics to extort money from you. Unlike most ransomware programs, this new infection does  not actually encrypt your files to render them unusable, but, instead, it collects important information about your system and your browsing habits along with proof that you have been accessing porn sites. This malware infection claims that you have been watching child porn and spreading it, too. If you do not send these attackers a certain amount of money, your information will be automatically sent to the police. Even if this threat does not seem to cause any damage to your files, it is important that you take it seriously. It may be a good time to start making regular backups to protect your most important files from possible future attacks if your computer is not safeguarded by security software. We recommend that you remove PornBlackmailer Ransomware immediately.

It you have been visiting adult websites, such as Xvideos, it is possible that by downloading a video, you also downloaded an .scr file. If you launch this .scr file, it starts up this malicious attack. Of course, we cannot stop you from visiting such sites but you need to be more cautious when clicking on content there and downloading files. If your PC were protected with proper antimalware program, your browsing experience could, of course, become peace of mind. But right now it is important that you delete PornBlackmailer Ransomware from your computer as soon as possible.

Of course, it is also possible that this ransomware program tries to infiltrate your system via spam e-mails. This malicious executable can be spread as a file attachment in a spam. This fake e-mail can claim to be regarding something urgent-looking like an undeliverable parcel, issue with your bank account, problem with your credit card details, and so on. You may easily believe that this is a legitimate mail since the sender also may appear to be normal or believable. However, when you open this mail, you will be told to open the attached file for further details. As you can expect by now, if you click to see this file, you would simply initiate this  malicious attack. This is why you should not open questionable mails, let alone their attachments, unless you are perfectly sure that they were meant for you personally. You can consider yourself lucky that this time you can delete PornBlackmailer Ransomware without losing your files to encryption.

After you run the file attachment or the .scr file you may have downloaded from an adult site, it makes a copy of itself as "temps.exe" and along with "bg_robin.jpg", the background replacement, places it in your "%APPDATA%" folder. This malware infection also drops the ransom note text files on your desktop called "." Do not be surprised to find 9 copies of this text file on your desktop because this ransomware actually creates that many. As we have mentioned, this ransomware infection does not encrypt your files. It simply uses scare tactics to frighten you enough so that you would pay the ransom fee.

Once you execute this malware infection, it replaces your desktop background with "bg_robin.jpg," which is a short ransom note on black background. This note simply warns you that child porn has been detected on your system and you have to read the ransom note file on your desktop. When you open the text file, it also claims that "You looked through forbidden children's porn!" and this is why all kinds of information has been collected about you and your machine, such as your IP address and other system and browsing data, which have been saved and stored on a remote server so you cannot delete them. These collected data will be sent to special police departments unless you pay 0.01 BTC (94 USD right now) to the designated Bitcoin address within 24 hours.

This infection really collects information and as a proof, you can find it in either "%Userprofile%\Robin\server_log" or "%Userprofile%\Cerber\server_log" folders. Apart from the aforementioned bits of information you will also find a few screenshots about scanned browser data and your location map as well. Although these cyber crooks may have saved your data on a remote server, obviously, they cannot prove that you have child porn on your machine and they simply try to frighten you with the police so that you pay. We advise you to disregard these empty threats and remove PornBlackmailer Ransomware from your computer right away.

We have included our solution below to eliminate this annoying threat. If you follow our guide step by step, you should be able to remove PornBlackmailer Ransomware in a few minutes tops. Please remember that there could be other threats on your computer as well. You should not go on using your PC until you completely clean it. If manual removal is out of the question for you, we suggest that you install a trustworthy anti-malware program, such as SpyHunter.

How to remove PornBlackmailer Ransomware from Windows

1. Press Win+E.
2. Delete the downloaded malicious file. If you do not have a preferred download folder, check all default ones: Desktop, Downloads, and %Temp%
3. Delete  "temps.exe" and "bg_robin.jpg" from "%APPDATA%"
4. Delete "server_logs" folder from either "%Userprofile%\Robin\" or "%Userprofile%\Cerber\"
5. Bin all copies of the ransom note text files ("READ_ME.txt") from your desktop.
6. Change your desktop background image.
7. Empty your Recycle Bin.
8. Restart your PC.