How to remove Ramsey ransomware virus

Ramsey – a new variant of Jigsaw ransomware that aims at Turkish-speaking computer users

Ramsey is a Turkish version of Jigsaw ransomware. This file-encrypting virus uses RSA-2048 and RSA-256 algorithms to encrypt files on the attacked computer. Malware aims at various audio, video, image, text and many other files, and append the .ram file extension to each of the encrypted files. Once this task is completed, it opens a ransom note written in the Turkish language. It arrives in a program window that includes the main information about data encryption, provides data decryption conditions and instructions, gives Bitcoin wallet address, provides contact email address (ramsey34.ramsey34@vfmail.net) has “View encrypted files” button and a timer that counts how much time has left until deletion of one random file. Ramsey ransomware asks to pay 100 Turkish Lira or at least 25 USD. Otherwise, victims will experience a tremendous damage. Nevertheless, the size of the ransom is not huge; you should not transfer it. Even the small amount of money is a motivation for cyber criminals to continue their cyber crimes and create even more dangerous viruses. Instead of paying the ransom, you should try Jigsaw decryptor,^[1] use backups or try alternative recovery methods that are safe and do not require having business with cyber criminals. But first, you need to scan the computer with FortectIntego or other security tool and remove Ramsey from the system.

Malware arrives on the system as an obfuscated Ramsey_Ransomware.exe^[2] file. Once it’s executed on the system, Ramsey starts completing its tasks. The virus might make modifications in the system in order to run on system startup, make Registry entries, and install many malicious files. Only when it strengthens its presence on the device, it starts data encryption procedure. As you can see, ransomware not only damages your files but makes the system vulnerable too. Thus, it might open the backdoor and help other malware to launch other successful cyber attacks. It’s another reason why we do not recommend delaying Ramsey removal. It may lead to more computer and privacy-related problems than you already have.

Sneaky distribution ways of the ransomware virus

Ramsey might be using several distribution and infiltration strategies, such as malicious spam emails and their attachments, malvertising, exploit kits, fake software updates and downloads. Cyber criminals use clever social engineering techniques to trick people into opening an infected email attachment. They might pretend to be from reliable organizations or companies (e.g. banks, hospitals, delivery services, etc.), and inform about serious issues. More information about the problem is usually provided in the attached document or users have to click on a button and visit a crafted site. Once they are tricked to do that, Ramsey payload is dropped and executed on the system. The malicious executable might be installed when a person clicks on a malware-laden ad or installs software from unknown file-sharing sites or torrents. Besides, ransomware might also be capable of using system vulnerabilities and outdated software to enter the system. Thus, you should not only behave carefully online but keep your software up-to-date too to avoid crypto-malware.

Safe way to remove Ramsey from the device

Ramsey removal has to be performed using reputable and powerful malware removal program. Trying to locate and delete virus-related entries manually might lead to irreparable system damage because various malicious files might be installed on different system locations and hidden under legitimate system file names. Thus, you might accidentally delete safe files instead of dangerous. In order to avoid such problems, you should install FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and scan the computer. But first, you may need to reboot the computer to the Safe Mode with Networking. It helps to disable the virus, install your chosen security software and remove Ramsey automatically without any obstacles.