How to remove RaRuCrypt ransomware

RaRuCrypt ransomware – one of the cheapest Russian viruses that encrypt files 

RaRuCrypt ransomware is a dangerous virus which encrypts^[1] your data and demands a ransom to be paid for its recovery. The note is primary dedicated to Russian speakers, as it requires using VKontakte to contact hackers and a special amount of Rubles (currency of Russia) to be paid as the ransom. At the moment, hackers demand 200 RUB in Bitcoin which is probably the smallest ransomware required by hackers to be paid for file encryption. 

As soon as RaRuCrypt invades the target machine, it embeds itself deep within computer system files and modifies Windows registry. Therefore, each time the device is started, the virus initiates a scan for new system files and encrypts them. Soon after that it drops the ransom note of .txt format on computer's screen which informs the victim about the current situation and asks using VKontakte social network to contact its developer.

The ransom note of RaruCrypt states:

Attention! Your files were encrypted!
Decryption costs: 200 RUB.
Contacts: vk.com/id12269280

RaRuCrypt ransomware uses RSA cipher to lock up files. Hence, the encryption key is kept publicly, instead of privately. Therefore, security expert Jakub Kroustek^[2] discovered that data could be decrypted using password “S?{DCO^C!{L@CR^+<7E}2””S?{DCO^C!{L@CR^+<7E}2″.

Even if the recovery of your files might seem like a priority for you, we highly recommend taking care of RaRuCrypt removal first. Otherwise, the virus might initiate another encryption of your important files and start requiring a bigger ransom. To get rid of this malware without wasting your precious time, use reliable security software, like FortectIntego or MalwarebytesMalwarebytes.

A ransom of 200 Rubles is a relatively small amount of money, so some of victims who do not have access to their business documents, important photos and similar data might consider paying it. However, we do not recommend contacting hackers as they are known to ignore victims, even after the ransom is handled. Additionally, you will encourage cybercriminals to continue their crimes as they get funding for their destructive deeds.

In most cases, hackers provide an email address to contact them. However, these criminals use a profile of a popular social network vk.com for contacting them. It is not surprising that authors of the social network blocked the account immediately.

Before trying to decrypt your files to recover them, you should remove RaRuCrypt ransomware from your computer. In case you do the opposite, your data might be locked again right after rebooting the computer. Proceed to virus removal and data recovery instructions below this article.

Beware of dubious emails

Security experts from utanvirus.se^[3] note that most popular distribution method of ransomware is via contaminated email attachments. Typically, service providers flag up suspicious emails as spam. Therefore users should pay attention to these markings.

However, the built-in automated security system might fail to work. Therefore, some users might be confused whether the email is credible. Nevertheless, users should look for unusual signs in the email: poor grammar, the email address the message came from and similar. Typically, the author states that the attachment is critical to open, as it claims to be from a bank or even the government. However, do not get tricked by a fraud.

Elimination and decryption methods of RaRuCrypt crypto-virus

The only guaranteed way to have a chance to recover your files is to keep them on a backup drive or a remote server. Thus, we advise you to take care of your back-ups now and regularly renew them.

However, before proceeding to file recovery, you must remove RaRuCrypt ransomware from your machine completely. Ransomware is a severe infection as it damages your files and makes them unusable. Therefore, it should be taken care of properly. Hence, we do not recommend manual RaRuCrypt removal.

Instead, you should employ decent security software which can find the infection and delete it permanently. We recommend using FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Be aware that the virus might prevent startup of the application. In that case, you should restart your computer in a Safe Mode with Networking and launch program that way.