Do you know what Nulltica Ransomware is?
Nulltica Ransomware is a computer infection that is classified as ransomware. Ransomware programs nowadays enter target computers and encrypt user’s files. Once the encryption is complete, the program demands that user pays a ransom. That is actually the main reason such programs are created in the first place. The criminals develop such programs in order to make as much money as possible. Of course, you should not succumb to these demands, and the sooner you remove Nulltica Ransomware from your computer, the better. Scroll down to the bottom of this description for the manual removal instructions.
As far as we know, there could be several ways for this infection to enter your system. It could be distributed via social networks in social engineering messages that look like notifications from friends. However, clicking the link that comes in such message usually results in malware infection. Or you could be redirected to some malicious website.
Also, Nulltica Ransomware could use the most common ransomware distribution method: spam emails. The problem with this distribution method is that users end up installing malicious programs themselves because they do not recognize the danger behind spam emails and the attachments that come with them. The point is that if you did not expect to receive any kind of file from an online store, a financial institution or any company that you have not worked with, the chances are that the file “impersonates” a legal document because it wants to push you into opening it with no questions asked. However, you CAN ask questions, and you SHOULD.
In fact, when you think that the file you are about to open is somewhat fishy; you can scan the file with a security application. If you do not have one, we recommend scanning your system with the SpyHunter free scanner.
Nulltica Ransomware screenshot
Scroll down for full removal instructions
On the other hand, our research shows that Nulltica Ransomware might also enter your system via compromised Remote Desktop Protocol. When ransomware uses this distribution route, the infection is installed manually by the criminals themselves. Unfortunately, there is nothing you can do to stop the actual infiltration, and the best way to protect yourself from this distribution vector is to avoid using remote desktop connections.
This infection first appeared in the beginning of September, 2017. Usually, the installer file is called Important.exe, but the name could be generated at random, too. Our research team has also found that the program may have some keylogger functions. It means that it could collect certain personal information. It can actually steal your Facebook data and store it on your computer in a file called log.txt.
The program’s code also includes functions that should help the criminals distribute the infection via Facebook. Hence, it is very likely that Nulltica Ransomware does spread via social engineering messages. What’s more, some of the code is written in the Polish language, and Google.pl is mentioned in the code, too. Hence, it is possible to assume that the developers of this infection might be based in Poland. In general, the program is based on the Hidden Tear open source ransomware infection, and we have covered similar programs many times before. The Hidden Tear code allows criminals to create many different infections quite fast, and they are sure quick to make use of that.
Once Nulltica Ransomware encrypts your files using the AES 256 algorithm, it might seem that there is no other way to solve this problem but pay $50USD in bitcoins for the decryption key. Nevertheless, we always emphasize that paying the ransom does not guarantee that the criminals will issue the decryption key.
Hence, you need to take this matter into your hands and remove Nulltica Ransomware at once. If you have a file backup, it will not be hard to restore your files. If you do not have such a thing, you should stop and think for a while, because you will surely have quite a few of your documents saved on your mobile device, in your email outbox, or on some cloud storage. The point is that sometimes the healthy copies of your files are quite close, you just need to take a closer look around.
Should you have more questions about Nulltica Ransomware or similar infections in general, do not hesitate to leave us a comment in the box below.
How to Remove Nulltica Ransomware
- Go to your Downloads folder.
- Delete the most recently downloaded files.
- Press Win+R and the Run prompt will open.
- Type %AppData% into the Open box and click OK.
- Delete the most recent executable file from the directory.
- Press Win+R again and type regedit. Press OK.
- Open HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
- On the right side, right-click the random name string value that opens the infection.
- Select to Delete it and close Registry Editor.
- Run a full system scan.
In non-techie terms:
Nulltica Ransomware is a dangerous infection that can severely cripple your computer. It will try to get as much money from you as possible, but you should never pay a single cent to these criminals. Please get rid of this infection and then look for ways to restore your data and protect your system from similar intruders in the future. Do not feel discouraged if your data cannot be recovered. Ransomware infections are extremely dangerous, and the cyber security community is still trying to curb them.