Remove MNCB Ransomware

The MCNB Ransomware is a file-locking Trojan, which belongs to the STOP Ransomware family. However, it seems to be slightly different compared to other STOP variants we have seen recently. Typically, the ransom note is written in English, but this variant has a ransom message in Chinese. Furthermore, it does not use the typical ransom note names that the STOP Ransomware relies on – victims will find two files named '@RecoveryYourFiles@.exe' and '@readme@.txt.'

Both of these files contain a ransom note, which advises the victim to contact helpmanager@airmail.cc for assistance. The same email has been used by just about any STOP Ransomware variant to come out in recent months. Unfortunately, contacting the attackers is not a solution – you will be asked to pay a ransom fee, and it is very likely that users who opt to pay will be scammed.

Do Not Accept the Offer of the MNCB Ransomware

The MCNB Ransomware also seems to be called MiniWorld Decrypt0r, judging by the name of the window that one of the ransom note uses. Files that this threat locks will have the '.MCNB' extension added to their name. Other STOP variants use similar suffixes to modify filenames - like the Nooa Ransomware

The change of tactics seen in the MCNB Ransomware is very weird since the STOP Ransomware has been using the same pattern for over two years. Currently, this threat is considered to be incompatible with free decryptors. Uses who encounter it should run an antivirus scanner to eliminate the threat. After this, they can explore alternative data recovery tools and opportunities. Keep in mind that recovering your data fully will be very difficult. When it comes to ransomware attacks, you should always prioritize preventive measures – use an antivirus app at all times, and make sure to stay away from suspicious sites and downloads.