The Nymaim ransomware is a malicious application that is categorized as a ransomware virus. This tricky virus often presents itself as a legitimate application that helps you in your searches but actually this is a fake program. Once installed, the Nymaim ransomware blocks your PC and you just see the message on the screen to pay $300 to unblock your computer. When this infection affects US based computers, it presents itself as an FBI notification. It is stated that you are involved in an illegal activity such as downloading an unwanted program or violating copyrights so now you have to pay the fine of $300. Keep in mind that even if you pay this huge amount, you will never be able to get access on your system. This dangerous application spreads through compromised web pages, downloading freeware, and opening spam email attachments. Once installed it will also perform other illegal activities on the infected system.
The Manual Removal of Nymaim ransomware
Once the Nymaim ransomware .infect your system you must delete this virus at your earliest as this can be extremely dangerous if left un-removed. You can get rid of this malicious application either by choosing a reliable automatic removal tool, or by following the complicated instructions of the manual removal method. However, we recommend the automatic tool for the novice users as manual method is a bit difficult for them. Following are the steps that you need to follow for manual removal of this dangerous ransomware:-
Start the System in Safe Mode
First of all you have to reboot the system and select the safe mode option to restart the computer in the safe mode. You can get the list of boot options by pressing the F8 key while the system is restarted.
Kill the Associated Processes
Once the system starts operating in the safe mode, you have to get rid of the corrupt processes created by this tricky ransomware. You have to open the task manager by using the Ctrl+Alt+Delete keys, and click on the processes tab. You have to find as well as end the following processes from the list:-
- %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe
Delete the Associated Files
Once done with the removal of the processes, you have to find and delete the following related files of the Nymaim ransomware:-
- %Desktopdir%\Nymaim Ransomware.lnk
- %Programs%\Nymaim Ransomware\Nymaim Ransomware.lnk
Reverse the Modification in the Windows Registry
You also need to delete the corrupt entries created by this ransomware in the windows registry. Open the registry editor, and remove the following entries from there. After removing all of the following entries close the registry editor:-
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Nymaim Ransomware\DisplayIcon %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe,0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Nymaim Ransomware
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Nymaim Ransomware\UninstallString “%AppData%[RANDOM CHARACTERS][RANDOM CHARACTERS].exe” -u
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\[RANDOM CHARACTERS] %AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Nymaim Ransomware\ShortcutPath “%AppData%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe” -u
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Nymaim Ransomware\DisplayName Nymaim Ransomware
Restart the computer, in the normal mode, to see whether the manual removal is successful or otherwise. Update the antivirus program and run a complete system scan to remove the infections caused by this dangerous Trojan infection.