Noob Ransomware Removal Guide

Noob Ransomware is one of those ransomware infections that currently do not have a public decryption tool available. Therefore, it is very important to avoid getting infected with it. And if you happen to have this program on your computer, you need to remove Noob Ransomware immediately, and then look for ways to restore your files. Please bear in mind that it might be impossible to retrieve some of your files, especially if you do not have them saved elsewhere. The only thing you really mustn’t do is pay the ransom fee that the program demands you to transfer.

Further research into the matter reveals that Noob Ransomware belongs to the CryptoMix Ransomware family. So this program is similar to Mole ransomware, CryptoShield Ransomware, Revenge Ransomware, and others. Just like other programs from the same group, this ransomware app tends to spread via spam email messages. This is why we say that it is important that you avoid this infection. It is because it is possible to do so once you recognize the main ransomware distribution patterns! So if you receive a message from an unfamiliar sender, and that message comes with an attachment, you should think twice before opening it.

Here some of you might say that email services filters spam emails into the Junk folder so it should not be a problem. However, the mails that distribute ransomware are quite sophisticated. For instance, they might look like legitimate financial reports from a bank or like an invoice message from an online store. In this case, you clearly need to rack your brain and recall whether you have purchased anything from the said store lately, and whether you have an account in the bank. The chances are that the financial organization that is used in these scams is pretty random, and you probably are not associated with it at all.

Unfortunately, if Noob Ransomware manages to access your system, then the ransomware will scan your computer and will find all the files it can encrypt. Then it will encrypt your files, and the filenames will end up having a new extension added to them. For example, it might change from dog.jpeg to dog.jpeg.NOOB. What’s more, the ransomware will also display a ransom note that will ask you to pay the ransom fee. Restarting your computer would not solve this problem because the infection auto-starts with your operating system.

Here is an extract from the ransom note this program displays:

All your important files were encrypted on this computer.
You can verify this by click on see files an try open them.
Encryption was produced using unique public key RSA-1024 generated for this computer.
To decrypted files, you need to obtain private key.

The program gives you 78 hours to contact the criminals, and if you do not comply, they threaten to destroy the server that hosts the decryption key. Needless to say, you should never succumb to these threats. Please remove Noob Ransomware from your system at once. When this program is gone, you can look for ways to restore your files.

Perhaps you have an external hard drive, perhaps you store some of your files on a cloud storage system, perhaps you have a lot of your photos saved on your mobile device. There are many possibilities you can try. For more information, please do not hesitate to contact us.

How to Remove Noob Ransomware

1. Press Win+R and type regedit. Click OK.
2. Go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
3. On the right pane, right-click and delete these files: 00FF0EBCF2F2 & BC0EBCF2F2.
4. Go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce.
5. Right-click and delete the *BC0EBCF2F2 value.
6. Exit Registry Editor and press Win+R.
7. Type %AppData% into the Open box and click OK.
8. Delete the BC0EBCF2F2.exe* file.
9. Remove all _HELP_INSTRUCTION.TXT ransom notes.

* We would like to note that the filename might be random. Albeit we have seen several malware examples that generated the same filename, there are also malware sample submissions with different names out there.