NMoreira Ransomware Removal Guide

Do you know what NMoreira Ransomware is?

NMoreira Ransomware is a dangerous computer infection that will try to turn your life into hell. For the most part, this program will affect computer users in Spain, but that does not mean it cannot barge onto your doorstep, too. When you get infected with malware, you have to remain calm. Do not do any rash decisions because they might result in unexpected money loss. Please scroll down to the bottom of this description for the manual removal instructions, and when you are done with that, do not forget to get yourself a reliable antispyware tool.

Why are we talking about an antispyware tool here? The problem is that NMoreira Ransomware and other dangerous applications are bound to travel in groups. Your computer must have been infected with some other program before the ransomware got into your system. So even if you follow the instructions to terminate this dangerous app, there might be more unwanted and dangerous programs you may need to take care of. And this is where the security tool comes in and helps you deal with that.NMoreira Ransomware Removal GuideNMoreira Ransomware screenshot
Scroll down for full removal instructions

It goes without saying that once the program enters your system, it encrypts the target files. What is interesting about the infection is that it adds an extension to the affected files. The extension is .maktub, and there is actually a Maktub Ransomware infection out there. It would seem that NMoreira Ransomware and Maktub Ransomware are related judging from these extensions. But our research team says there is nothing in common between the two, and the creators of the programs are different people. So it is rather peculiar as to why this infection uses the .maktub name. Also, aside from the extension, the encrypted files also get a padlock icon that replaces the original icons.

This program clearly targets users in Portuguese-speaking countries because the ransom note it displays is entirely in the Portuguese language. What’s more, there is a unique string within the executable file that says the following:

Kaspersky, I really doubt you can decrypt this, I kinda work with data security you know. Are you playing with your users? Btw, this is not a Xorist variant, this just uses the same way of writing its configuration files. Also, we don't call this XPan. Actually, this crypter is called NMoreira. Hugs, inilossaf. E, pqp nunca imaginei que usaria meu conhecimento em C++ para isso :(

Kaspersky is known for having come up with the Xorist ransomware decryptor, and whoever created this infection tries to make people think that NMoreira Ransomware “is not a Xorist variant.” It goes without saying that there is no decryption tool available for this infection at the moment, but that does not mean you must pay the ransom fee. In fact, there is a very good chance that the criminals behind this infection would snatch all the money and make a run for it, without issuing you the decryption tool. So what are you supposed to do with your files?

It is possible to restore your files from a file backup (if you have one). Perhaps you have an external HDD where you keep copies of your files, or maybe you have a backup on another server (depending on the nature of your business). The point is that you will need to remove NMoreira Ransomware before you transfer back all of your files because it is possible that the ransomware will try to encrypt healthy files, too; especially if you transfer the files into their original directories.

To avoid that from happening, remove everything associated with NMoreira Ransomware from your computer and then invest in a legitimate security application that would protect your PC from similar intruders. You have to consider the fact there are more unfamiliar applications on your system, too. So having a licensed security tool would only lower your chances to get scammed by cyber criminals.

Aside from using a security application, you should also think about changing your web browsing habits because that is really important when you want to protect your PC from harm. Do not enter unfamiliar sites and refrain from downloading attachments from spam email messages. For any further security points, please do not hesitate to leave us a comment.

How to Remove NMoreira Ransomware

  1. Open the Downloads folder.
  2. Find the malicious file and delete it (if it is still there).
  3. Press Win+R and type regedit. Click OK.
  4. Go to HKEY_CLASSES_ROOT.
  5. Delete the .maktub key.
  6. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes.
  7. Delete the .maktub key under Classes.

In non-techie terms:

NMoreira Ransomware is an annoying and dangerous program that wants to steal your money. It holds your files hostage and requires you to pay a big sum of money. However, paying is not an option because the criminals might just run away with your money, not giving you the decryption key. Please remove NMoreira Ransomware from your computer ASAP, and then look for other ways to restore your files. Succumbing to cyber criminals’ requests would do you no good.