How to remove Scarry ransomware

Scarry ransomware – a new virus that cybercriminals use for money extortion 

Scarry ransomware is a virus that encrypts^[1] all user files and demands a ransom for a unique decryption tool. Once the computer is infected, the encryption starts immediately. Only system-files are left uncoded, although they are altered to help the malware with its bidding. All personal data is appended with two extensions: a random sequence of characters and .scarry. The non-system computer data, after the virus has done its job, won't be accessible.

After the file locking process is completed, a ransom note “Инструкция.TXT” appears in all affected folders. The whole message is written in the Russian language. Developers of Scarry virus are urging the victims to contact them via email – scarry792@cock.li. A unique ID is prescribed to all victims. As a gesture of goodwill, the cybercriminals are offering to forward them two files for free decoding, thus showing that the decryption tool exists.

It is highly recommended not to agree with any demands of the criminals, sd the promised decoding tool/key might never get delivered. Perpetrators also advise not to use using any antivirus software or third-party decryption tools as it may lead to permanent data loss. A new feature that is introduced with this Scarry ransomware is that it deletes 24 files in 24 hours until the ransom is paid.

Since Scarry ransomware belongs to the Scarab ransomware family, it employs a military-grade AES-256 and RSA-2048 algorithms to lock users' files. There is no possibility to unlock the files with any third-party software. But there's always hope that someday it will come out. Export infected files to empty, offline storage and keep your fingers crossed.

Whole text presented in the ransom note named “Инструкция.TXT”, written in Russian:

Ваши документы, базы данных и другие файлы были зашифрованы. Но не стоит переживать!
Мы все расшифруем и вернем на свои места.

Для расшифровки данных:

Напишите на почту – scarry792@cock.li
 
 *В письме указать Ваш личный идентификатор (Key Identifier)
 *Прикрепите 2 файла до 2 мб для тестовой расшифровки.
  мы их расшифруем, в качестве доказательства, что ТОЛЬКО МЫ можем расшифровать файлы.

ВАЖНО! Не пишите с mail.ru (к нам не доходят пиьсма) Используйте – yandex.ru gmail.com и т.д.
Все кроме mail.ru

 -Чем быстрее вы сообщите нам свой идентификатор, тем быстрее мы выключим произвольное удаление файлов.
 -Написав нам на почту вы получите дальнейшие инструкции по оплате.

В ответном письме Вы получите программу для расшифровки.
После запуска программы-дешифровщика все Ваши файлы будут восстановлены.

Мы гарантируем:
100% успешное восстановление всех ваших файлов
100% гарантию соответствия
100% безопасный и надежный сервис
Внимание!
 * Не пытайтесь удалить программу или запускать антивирусные средства
 * Попытки самостоятельной расшифровки файлов приведут к потере Ваших данных
 * Дешифраторы других пользователей несовместимы с Вашими данными, так как у каждого пользователя
уникальный ключ шифрования

Каждые 24 часа удаляются 24 файла, необходимо прислать свой идентификатор чтоб мы отключили эту функцию.
Каждые 24 часа стоимость расшифровки данных увеличивается на 30% (через 72 часа сумма фиксируется)

P.S
Если Вам не ответили в течении 48 часов. Вам нужно будет связаться с нами по дополнительным контактам.

Скачайте и установите Tor Browser – hxxps://www.torproject.org/ru/download/
Откройте через Tor Browser сайт – hxxp://sonarmsniko2lvfu.onion   (сайт не будет работать через обычный браузер, только через ТОР)
Зарегистрируйтесь и напишите нам.

*Наш ник в Sonar'e – savefile365

====================

Ваш идентификатор (ID)

–

If you had backups, use SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to automatically remove Scarry ransomware from your device and restore your data from backups. To strengthen their malicious impact on the system, ransomware usually modifies system files to block antivirus and similar software from working correctly.

After successful Scarry ransomware removal, use FortectIntego tool to automatically revert such changes and restore system functionality. This threat can trigger various changes and alterations in system folders, files, to even functions.

Popular methods hackers use to infect computers

Cybercriminals employ many diverse ways to spread their created malware. Most commonly, ransomware is distributed via file-sharing platforms, such as The Pirate Bay, BitTorrent, and email spam attachments. Viruses can be camouflaged as .jped, .pdf, .exe, .txt, and other file types. Upon getting entry into a computer system, ransomware starts the encryption process immediately.

Torrent sites are a very common method to spread infections, as users from all over the world can upload anything into them. Unaware people might think that they're downloading a new movie, game cheat codes, or some illegal software activation kit (aka “crack”), but in reality, they're getting themself in a lot of trouble.

Spam emails are another beloved way of the cyberthieves to administer their creations.^[2] Uninformed users get their computer systems contaminated when opening mischievous hyperlinks and malicious email attachments. Always keep in mind that offenders are trying to trick users by sending them officially looking emails. Never download a file without scanning it first.

Scarry file virus removal requires AV detection engines

Ransomware removal should be trusted to professionals because trying to delete it manually could cause more harm. To remove Scarry ransomware, use apps like SpyHunterCombo Cleaner and MalwarebytesMalwarebytes; this software will automatically remove the malicious content from infected devices.

However, this process won't decrypt files. You need tools that can detect^[3] Scarry ransomware virus and get rid of it properly. Users should always keep backups in several different locations in case of emergencies like this. Use the aforementioned trustworthy anti-malware software to keep you safe while browsing.

The family that the virus belongs to is known to modify system files to run uninterrupted on the infected devices. After Scarry ransomware removal we recommend using FortectIntego to perform a powerful system scan and automatically restore any damage the virus has done to the device.