National Security Agency virus - How to remove

National Security Agency virus

National Security Agency virus is a ransomware that sends a notification to computers which imitates a message from National Security Agency although it has nothing to do with this institution. It is a malicious program that is distributed to computers with a help of Trojan viruses without users’ consent and seeks to rip computer users off.

National Security Agency virus targets computers that are located in the United States of America. Once inside, it completely locks your computer and displays a message accusing you on violating the law of the USA. The message states that you have been involved into viewing and distributing pornographic or copyrighted content and for this reason you must pay a fine of $300 now. If you do not agree to pay, it claims that you will have to face more serious consequences and may even go to jail.

You can only pay a fine using Moneypak or Monegram which are the payment systems that require prepaid cards. Although these systems are legal, official institutions do not use such methods to collect any money. In fact, they are very popular among cybercriminals as it is a quick and easy way to make a money transfer. And this is just one more prove that a message by National Security Agency is not reliable.

It is a scam that you should never trust. If your system has been locked, you should remove National Security Agency virus from your system as soon as possible. Since it blocks your system entirely, the removal process is not that easy. If your computer has more than one user account and not all of them are locked, scan whole PC with anti-malware programs, e.g. spyhunter, by logging to the account that is not blocked. Another option is to use system restore. If none of these methods worked for you, do the following:

  • Restart your computer;
  • Press F8 while it is still restarting;
  • Choose between safe modes in following order: Safe mode, Safe mode with command prompt

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking

  1. Launch MSConfig.
  2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for National Security Agency virus but some others might be used.
  3. Restart the system once again.
  4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify National Security Agency virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

  1. Run Regedit.
  2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
  3. Search registry for National Security Agency virus files and delete the registry keys referencing the files
  4. Try to reboot and scan with Spyhunter.
  5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If none of safe modes could be launched

Some versions of National Security Agency virus disable all safe modes, but give a short gap that you can use to run anti-malware programs:

  1. Reboot normally.
  2. Start->Run.
  3. Enter: http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
  4. Press Alt+tab and then R couple times. National Security Agency virus process should be killed.

Here is a video detailing this approach:

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of National Security Agency virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

  1. Download Hitman Pro on uninfected PC. 
  2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
  3. When USB ready, reboot infected PC with USB attached and press DEL
  4. Choose USB as primary boot device.
  5. Boot normally.
  6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Download Spyhunter for Malware detection
(Win)

Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,

Download Combo Cleaner for Malware detection
(Mac)

Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,

Manual removal

Leave a Reply

Your email address will not be published. Required fields are marked *