How to remove Raa-consult1@keemail.me ransomware virus

What you should know about Raa-consult1@keemail.me ransomware?

Raa-consult1@keemail.me virus has been called like that due to email it provides for the victims. Cyber security experts identify this infection as RAA ransomware virus and a file-encrypting malware. This infectious Trojan encrypts all victim’s files with AES-256 encryption, making them unusable and worthless. Criminals steal the decryption key from the computer and start demanding a ransom, which is worth 250 USD dollars. Victims are advised not to pay the ransom as this will not grant confirmation that files will be restored. However, let’s get into the details of this virus’ modus operandi and see how it encrypts those files.

Once installed, Raa-consult1@keemail.me virus drops Pony Trojan (a malicious virus that steals private data) on the system and starts searching for particular files on the infected system. Typically, it looks for photos, videos, documents, and archives, and encrypts them all with military-grade encryption, which means that these files become inaccessible to anyone except someone who has the unique decryption key. It is also worth noting that the virus generates different encryption and decryption keys for every victim. Besides, after encrypting victim’s files, it adds .locked file extension. Other viruses add this file extension to encrypted data, one of them is .locked virus. However, the aim of Raa-consult1@keemail.me malware is to swindle money from victims, so they take their files hostage and suggest buying them out by purchasing the decryption software. All information on how to decrypt files is provided in a ransom note that the virus leaves on the system, which is called !!!README!!![Victim’s ID].rtf. The ransom note is inscribed in The Russian language. It asks the victim to buy Bitcoins and transfer them to a presented Bitcoin wallet address. If you are wondering if you should pay up or not, we want to warn you that scammers might try to sell you useless piece of software that cannot decrypt the files, or might be supplemented with more malicious files. Therefore, the best idea is to remove Raa-consult1@keemail.me ransomware from the system and start recovering your files from backups, email, USBs and other storage devices. Full Raa-consult1@keemail.me removal can be successfully completed using FortectIntego.

How did this ransomware get inside your computer?

The fact that this ransomware has managed to enter your computer system without being stopped proves that your computer needs more protection. Is your computer actively defended with some security software? Because if not, then there is no surprise why this virus has been installed without your notice at all and managed to encrypt all your files. We have mentioned in the beginning that such computer pests spread like Trojan horses, which means that their authors hide them in regular-looking files and send them to victims via emails, present their download links in pop-up ads or distribute them with the help of exploit kits. In this case, virus spreads in a form of malicious Word document containing infectious script that can be activated by enabling Macros. Below you can find some easy ransomware prevention techniques that can lower the possibility of becoming a victim of ransomware attack.

1. Update your software, or enable automatic software updates.
2. Install a good security software.
3. Stay away from suspicious emails and files attached to them. If the attachment asks you to activate Macros function, do not do that!
4. Do not agree to install unknown programs from pop-up ads or sites that you get redirected to without showing the intention to enter them.
5. Instead of running or opening files downloaded from the web, save them on the system instead. This way, your anti-virus software will have time to check its safety level.

How to uninstall Raa-consult1@keemail.me malware?

We definitely do not recommend victims to remove Raa-consult1@keemail.me virus or Pony Trojan manually. These shady programs hide their files in the computer system by using safe-looking filenames, so it can be hard to identify them. Of course, viruses do not use filenames such as “virus.exe.” Therefore, it is better to rely on malware removal software and allow it to eliminate such threats automatically. When infected with ransomware, it can be tough to launch such software, so we recommend you to carry out these instructions first: