Ninja Ransomware - How to remove

Ninja Ransomware is a malicious application that will block your files and will ask for a ransom in order to retrieve them.

As a lot of other ransomware, Ninja Ransomware was developed in Russia, that’s why message displayed to users with infected computers are in Russian. It looks like this:

In case you can’t speak Russian, here is a translation for you:

Your files are encrypted, if you want to retrieve them, send one of them at

[email protected]

ATTENTION! You have 1 week to send me your file. After this period of time file decryption will be not available

Basically hackers are just trying to scare users and make them pay the ransom fast. In order to prove that they are able to decrypt your files, you are asked to send one of them and they will send decrypted one back to you. It’s not clear how much you will be asked to pay and what payment methods hackers offer, but it’s completely clear that paying the ransom does not guarantee that your files will be decrypted so you should think twice before doing that.

This ransomware can encrypt most of most common file types, including .mp3, .jpg, .txt, .rtf, and others. Even though it’s not possible to decrypt the files, we suggest to eliminate Ninja Ransomware from your computer because it can encrypt more files or infiltrate other malware into your system. Scroll down below this article to see what you should do in this particular situation.

Removal methods of Ninja Ransomware

Note, that there are many versions of this scam, but each of them can be removed with various degrees of difficulty. It is tought to identify correct method at once, so if one method fails, skip and try next one. We cover most of the methods from easiest to the most complex to remove this Ninja Ransomware scam.

The easiest way to get rid of Ninja Ransomware virus is scan your PC from unaffected account with administrative permissions with Spyhunter or Malwarebytes Anti-Malware. If you are not so lucky and have no unaffected account on your computer, there are other options:

1. Restart your computer, press F8 while it is restarting.
2. Choose safe mode with networking.
3. Launch MSConfig.
4. Disable startup items rundll32 turning on any application from Application Data.
5. Restart your computer again.
6. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to find the file and remove it. Here is a video guide, showing how to do all the steps:

Removing Ninja Ransomware Virus when you can boot to Safe Mode with command prompt only

If you cannot use Safe Mode, try rebooting into safe mode with command prompt. Here how to delete Ninja Ransomware using this approach:

1. Reboot into safe mode with command prompt. Ninja Ransomware should not be launched this time.
2. Run regedit. Search for Winlogon.
3. There will be a key labeled Shell under Winlogon. It should refer to Explorer.exe or be blank. If there is something else referring an executable in one of users folders, replace it with explorer.exe.
4. Save changes, reboot to safe mode with networking.
5. Run msconfig and disable all unnecessary startup entries. Reboot normally, your system should start without parasite interfering.
6. Install and run https://www.2-viruses.com/downloads/spyhunter-i.exe. Scan with it the PC and delete Ninja Ransomware Virus executables it finds.

Here is a video guide illustrating this virus removal method:

Automatic Malware removal tools

Manual removal