What is ‘National Bank of Greece’ email Scam? 

‘National Bank of Greece’ email scam is a phishing campaign spotted by malware researchers targeting the banking users of “National Bank of Greece.” Thus, this new campaign is named as ‘National Bank of Greece’ email virus. The phishing email tends to appear a bank transfer proposal, that encloses a transaction receipt as an attachment.

The phishing email being distributed in larger numbers to target Greek users, which open downloading the attachment, install a RAT named as NanoCore RAT.

However, this is a scam tactics of cyber-criminals to distribute severe Trojan threat. Thus users should not open “National Bank of Greece,” emails. And if you have already did, then you should quickly run a scan to the compromised system.

‘National Bank of Greece’ email virus

Name ‘National Bank of Greece’ email virus
Type Phishing email, email virus, scam
Risk level High
Description ‘National Bank of Greece’ email virus tricks to open the infected attachment and download the malware on the computer.
Occurrence Due to opening spam email attachments
 Symptoms Drained CPU performance, unknown processes running, strange browser activities, or anti-virus detecting some threats but not able to locate them.

Run The Scan tool NowTo eliminate ‘National Bank of Greece’ email virus from your computer.

The Distribution campaign

‘National Bank of Greece’ email virus is a phishing attempt by cyber-criminals to install NanoCore RAT malware on their system. To achieve this evil motive, the threat actors shoots out spam email imitating to be ‘National Bank of Greece.’ They use the email spoofing technique to imitate to be legit email address and so the users can get tricked easily. The scam emails are written entirely in Greek language.

The text message in the “National Bank of Greece” email scam appear as:

Subject: Μεταφορά στοιχείων

‘Εχουμε στείλει τις προτάσεις τραπεζικής μεταφοράς στον λογαριασμό της εταιρείας σας

Επισυνάπτεται η απόδειξη μεταφοράς.
Χαιρετισμοί /Agnes Aetόs

National Bank of Greece
Address: Leof. Ιανrίνυ 134, Glika Nera 153 54, Greece
Phone: +30 21 0863 5881
National Bank of Greece – Wikipedia

Η Εθνική Τράπεζα της Ελλάδος είναι μια παγκόσμια εταιρεϊα τραπεζικών και χρηματοοικονομικών υπηρεσιών με έδρα στην Αθήνα. Το 85°/ο των προπαρασκευαστικών κερδών προ της υπηρεσίας προέρχεται από τις δραστηριότητές της στην Ελλάδα, συμπληρωμένο με 15°/ο από τη Νοτιοανατολική Ευρώπη

As per the email message, it claims to offer some proposals of bank transfer to the account holders. Additionally, the letter has some information about the bank including its address and contact details. Perhaps, this is done to appear the email legitimate.

Further, the email has an attachment named as “transaction receipt.” The attachment is an ‘.r11’ file, that is used with archive services of  7Zip and WinRAR. If user extracts the zipped file, then the payloads of the malware concealed within starts executing automatically. And finally installs the NanoCore RAT.

‘National Bank of Greece’ email Scam virus Attack Motives

If user opens the email and downloads the attachment from the ‘National Bank of Greece’ email virus, then it starts extracting the zipped files on the computer. After that, it takes no moment to execute the commands to drop the payloads of the malware.

However, phishing email campaign is the most common way used by attackers to spread malware. So, this one is no different. As such it pretends to be an important legitimate email from ‘National Bank of Greece.’ Thus, users don’t hesitate to open the file. Unfortunately, which results in the execution of malicious codes, that installs NanoCore RAT.

Being a RAT (Remote Access Trojan), it allows the remote attackers to control the target system remotely. Further, the hacker can easily execute malicious actions on the system.

 The NanoCore RAT malware has various functionality, which allows the hackers to: 

  • Install a keylogger that helps recording the key strokes of user, when users perform any activity.
  • Receive various commands and execute it on the system;
  • Establish communication via C&C server, and send various information;
  • Download additional threats;
  • Spy on the user’s activity both online and offline. 

Such threats are designed to silently run in the background, imitating to be genuine windows process. Thus, users may have no clue of such a threat present on their system. Unless there installed anti-malware program does not detect and warn users. 

So, it is very important to keep a reputable anti-malware and anti-virus programs installed on the device. If you have opened the ‘National Bank of Greece’ scam email, then quickly run a scan to your system. 

How to Remove ‘National Bank of Greece’ email Scam virus

The removal process of ‘National Bank of Greece’ email scam virus is tough like any other virus. It can leave you puzzled as it does too many modifications to the system internal settings. This may take enough time and patience to do it manually. That even may not ensure you complete removal.

Thus, it is advised to scan the infected computer with reputable anti-malware program to detect and remove ‘National Bank of Greece’ email virus Virus.

“Windows OS: Use Anti-Malware To Scan And Remove ‘National Bank of Greece’ email virus (Recommended)”

SpyHunter is a giant among the security programs that use advanced threat detection technology to remove any sort of Adware/PUPs, Browser hijacker, Trojans, Rootkits, Fake system optimization tools, worms, and rootkits. It not only remove threats but provides rigorous 24/7 protection from any unsolicited programs, vulnerability or rootkits attacks.

Special Offer
“‘National Bank of Greece’ email Scam virus “ may reinstall it multiple times if you don’t delete its core files. We recommend downloading Spyhunter to scan for malicious programs. This may save your precious time and effort.
Download SpyHunter 5 Anti-Malware
More information on SpyHunter, steps to uninstall, EULA, Threat Assessment Criteria, and Privacy Policy. Spyhunter scans the infected PC for free but you need to purchase its full version for complete removal.

Steps To Perform System Scan with SpyHunter

  • Once the program is installed successfully, the SpyHunter 5 Anti-malware program will launch automatically. If it does not then locate the SpyHunter icon on the desktop or click on “Start” ? “Programs” ? Select “SpyHunter”.
  • Now, To start the scan click on the “Home” tab and select “Start Scan Now” button. The program will now start scanning for ‘National Bank of Greece’ email virus and other associated programs.
    Start Scan Now For 'National Bank of Greece' email virus

    Start Scan Now For ‘National Bank of Greece’ email virus

  • The scan will report will all the details of the result about ‘National Bank of Greece’ email virus along with system errors, vulnerabilities and malware found.
    'National Bank of Greece' email virus PUP Found

    ‘National Bank of Greece’ email virus PUP Found

  • Once you have found ‘National Bank of Greece’ email virus  as shown in the screenshot below:
'National Bank of Greece' email virus PUP Removal

‘National Bank of Greece’ email virus PUP Removal

  • To select an object for removal, just select the checkbox at the left of the object and click on “Next“. You can select or deselect any objects displayed in the “Malware,” “PUPs” or “Privacy” tabs. We have included a convenient “Select All” feature that will allow you to select or deselect all objects displayed in a specific tab. To utilize this feature, simply select the checkbox at the left in the specific tab (9).
Select Objects To Remove

Select Objects To Remove

  • Once you have selected which objects you would like to remove, click the “Next” button.
    Press Next To Clean You PC

    Press Next To Clean You PC

If you want to know more about it, you are welcomed to check out the full review of SpyHunter 5.

How To Remove ‘National Bank of Greece’ email virus Manually From Windows OS

To Remove ‘National Bank of Greece’ email virus , follow these steps:

For our readers to understand, we have put our best possible solution that can help to remove this threat. But we suggest you to only try this if you are familiar with system configurations, registries keys and its subkeys values and also boot settings.

While performing the manual solution, be enough cautious and if you get confused at any point of time, them leave it and take the help of powerful anti-malware program to detect and remove the virus. This will not only ensure safe removal of ‘National Bank of Greece’ email virus but also restore default system settings.

Method 1: Remove ‘National Bank of Greece’ email virus Manually From Windows OS (Safe Mode)

For Windows XP and 7:

  1. Click on the “Start menu, then on click the arrow next to “Shut Down.” Select Restart. (Just as you normally Restart your PC).
  2. Once the computer screen is powered on, immediately start tapping “F8” key till you see “Advanced Boot Options” screen. if you don’t enter to the boot screen, then restart the process again and press F8 while the PC is restarting.
  3. Here, you need to choose “Safe Mode with Networking option and press “enter” key to troubleshooting windows. As later on, you need to access the internet.
    Safe Mode With Networking

    Safe Mode With Networking

  4. And you will now see the login screen. Now log in with your Administrator Account.

NOTE: To get back to your normal windows configuration, you need to repeat steps 1-3 and select Start Windows Normally.

  1. For Windows 10: Click Start –> Power and then hold the Shift key on your keyboard and click Restart.
  2. For Windows 8/8.1:  Press the “Windows key + C“, and then click “Settings“. Click “Power“, hold down the Shift key on your keyboard and then click “Restart“.
  3. From here steps are same for Windows 10 and 8.
  4. Click “Troubleshoot”.
    Choose Troubleshoot

    Choose Troubleshoot

  5. Click Advanced options.
    Choose Advanced Options

    Choose Advanced Options

  6. Click Startup Settings.
    Choose Start Up Settings

    Choose Start Up Settings

  7. Click Restart.
    Click Restart To Enable Safe Mode

    Click Restart To Enable Safe Mode

  8. After your computer restarts, select Safe Mode with Networking.
    Windows 10 Safe Mode With Networking

    Windows 10 Safe Mode With Networking

  9. Enter your Administrative username and password to start Windows in Safe Mode with Networking.

NOTE: To get back to normal Windows configuration you need to Click Start –> Power and then click Restart.

Kill ‘National Bank of Greece’ email virus Process From Task Manager

  • Press “Window key+ R” and type “taskmgr”.
    Open Task Manager Windows 10

    Open Task Manager Windows 10

  • Now once the task manager window opens, perform these steps:
  • Under the process tab, check for the suspicious program still running;
  • If you find it, right click on the name and select “Open file location”;
  • Then click on “End Task”;
    Task manager End Task Windows 10

    Task manager End Task Windows 10

  • Now go to the file location window opened and select the program and delete that file.

Disable ‘National Bank of Greece’ email virus suspicious program from startup.

It is very important to remove ‘National Bank of Greece’ email virus program, from auto-launch when the system boots. As if not removed,  then it will not allow you to remove the malicious programs completely from the infected system. And there is very much chances that it will again repair its files and be active on your system.

Disabling this will allow you to completely get rid of any unwanted program.

To Disable Auto-Startup For ‘National Bank of Greece’ email virus Program: 

For Windows Xp and older version:

  1. Press “Windows key+R” that will open the run box. Within the search field type “msconfig”  and hit enter that will launch “System Configuration” window.
  2. Next, click on the “Startup” tab to see the list of programs which are set to auto-launch with the computer boot.
    Disable auto-start up apps windows 7

    Disable auto-start up apps windows 7

  3. Now browse the list to locate the programs related to ‘National Bank of Greece’ email virus . To disable it, un-check the boxes next to the program names, you want to remove from start up. And choose “Disable All” click “Apply” and “OK.”

For Windows 8, 10 and newer versions:

This feature is available within the Task manager window. So open it and switch to “Start Up Tab.

  1. Click on the ‘National Bank of Greece’ email virus or other harmful program, then click “Disable” button appearing at the bottom of the window.
    Disable auto-start up apps windows 10

    Disable auto-start up apps windows 10

Remove ‘National Bank of Greece’ email virus And Other Harmful Program From Computer

  • In the taskbar, click on the “Search” icon. And Type “Apps And Features;”
    Apps And Feature Windows 10

    Apps And Feature Windows 10

  • When the “Apps And Features” window opens, you can see the list of applications installed;
  • Go through it carefully and search for Presearch.org or other apps that looks suspicious to you. If you don’t remember to install yourself;
  • If you find such, click on it to expand; And click on “Uninstall”.
    Uninstall application Windows 10

    Uninstall application Windows 10

  • Repeat for all such apps.

If the program does not allow you to remove it, or says the program is running in the background. Then you need to first finish the task from the task manager.

After removing the program, it is important to remove the Registry Entries Created by the malicious program. It is a tricky process, as you should know about the entries created and remove it one-by -one. So, it is better to use a powerful- tool to remove all traces of ‘National Bank of Greece’ email virus .

Remove ‘National Bank of Greece’ email virus using HitmanPro.Alert


HitmanPro.Alert is an advanced anti-malware program that takes on proactive approach towards threat behavior and its activities. Its cloud-based scanning technique is deeply scans the system to the possible locations where threats mostly resides.

Running HitmanPro.Alert on your computer will provide your real-time status, checks the browser integrity and alerts or any suspicious activity. So that you can have a safe browsing and online transactions. Read the full review of HitmanPro.Alert here.

Steps To Install And Run HitmanPro.Alert

  • Click on the provided link to download HitmanPro.Alert anti-malware;
    Download HitmanPro.Alert

    Download HitmanPro.Alert

  • Now, open the download folder to locate “hmpalert3”;
  • Click on it, to begin the installation;
  • It will ask your User Account control, if prompted click on “yes”; The download should begin shortly. HitmanPro.Alert window will appear, where you need to choose the options:
Click on Install

Click on Install

  • Choose Protection level as Maximum
  • And tick the other boxes and finally click on “Install”.
  • HitmanPro.Alert only takes 5MB of your memory and is very quick to install.
HitmanPro Scan Process

HitmanPro Scan Process

  • After the installation is complete, the scan will start. First scan may take up some minutes, as it will scan the whole computer.
    HitmanPro Scanning

    HitmanPro Scanning

  • The scan results are here. Carefully look down the list. You can here, the scan has found 1 Riskware and thousands of traces which can be risky.
    AV Threat Detection

    AV Threat Detection

  • You can select the threat to delete, quarantine, ignore or, mark as safe. If you want to remove all the threats, then simply click on the “Next” button below.
    AV Threat Removal

    AV Threat Removal

  • HitmanPro.Alert first creates a restore point and then starts the removal process. This helps to recover from any damage.
    Delete Threats

    Delete Threats

So, now you are done, with the removal process with HitmanPro.Alert.

HitmanPro.Alert step 8

HitmanPro.Alert step 8

Method 2: Remove ‘National Bank of Greece’ email virus Virus Using System Restore Procedure. (Advanced option)

Another method is a manual way to get rid of ‘National Bank of Greece’ email virus which is through System Restore. If you don’t know much about this process, then read here. Click here to perform System Restore in Windows OS.

Safe Mode with Command Prompt (Follow the above steps and choose Safe Mode with Command Prompt option from boot setting.)

To Reboot your computer to “Safe Mode with Command Prompt”

Windows 7 / Vista / XP

  • Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart.
  • Now select Troubleshoot –> Advanced options –> Startup Settings and finally press Restart.
  • Once your computer becomes active, select “Enable Safe Mode with Command Prompt” in Startup Settings window.

Windows 10 / Windows 8

  • Click Start –> Restart –> OK.
  • When your computer becomes active, start pressing “F8″ multiple times until you see the Advanced Boot Options window.
  • Select Command Prompt from the list

To Restore your system to default settings as it was prior to the attack of ‘National Bank of Greece’ email Virus

  1. Once the Command Prompt window appears, type “cd restore” and press Enter.
  2. Now again type “rstrui.exe” and hit Enter button;
    System Restore 1

    System Restore 1

  3. It will show up a new window, now click on “Next”.
    Restore System files Settings

    Restore System files Settings

  4. Then, select your restore point that should be prior to the attack of ‘National Bank of Greece’ email virus
    or any other point you want. Click on “Next”.

    Restore System choose Date

    Restore System choose Date

  5. Now click on “Yes” to confirm the system restore.
Restore System Finish

Restore System Finish

Once the system restore to your selected date is done, then you need to restart your computer normally.

You should Download effective anti-virus program and scan your computer to ensure successful removal of any threat.

Best Practices To avoid Such Infections

  • Keep a secure firewall for the system. This will help block any unwanted internet connections to your device.
  • Do not open spam mail attachments from unknown sender. This is the common way through which malicious programs intrude inside. Thus, we should be cautious while getting mails from non-trusted sources.
  • Keep the software program updates, so that it does not have any security patches.
  • Be very cautious while downloading any freeware from third-party websites. Always download software programs from official websites. Thus avoiding any accidental download of Adware/PUPs.
  • Do not use public wi-fi for online transactions, as they are not fully secure and can infect the device.
  • Use a powerful anti-virus program that will keep track of the security.

By following the above tips, you can avoid viruses or unwanted programs entering on your computer. Hope this article is helpful to you.

More From Unboxhow