Severity scale:  

Remove ransomware (Removal Guide) - Decryption Steps Included

removal by Jake Doevan - - | Type: Ransomware – a ransom-demanding virus which offers free decryption of three files virus is a dangerous file locking virus which appears to be a new variant of the Scarab ransomware family. This threat also spreads via phishing messages and modifies the Windows Registry[1] to start its damaging activity. virus encrypts files by using unique algorithms such as AES or RSA and renames the locked document by adding random characters. Moreover, this cyber threat produces a ransom-demanding message named HOW TO RECOVER ENCRYPTED FILES.TXT which urges for Bitcoin in exchange for the unlocking tool and offers free decryption of three small files. Furthermore, the note provides and email addresses which are the way to contact the criminals.

Related to Scarab ransomware
Category Ransomware
Extension Renames the encrypted file by using random characters
Ransom No particular price is given, however, the crook urges for Bitcoin cryptocurrency
Email addresses and 
Encryption code RSA/AES
Offers Criminals offer three files for free decryption
Distribution Phishing emails are the most common ransomware spreading source
Damage fixing Fix the damage done by this ransomware by installing Reimage Reimage Cleaner Intego

Once installed, ransomware[2] uses unique ciphers to lock up important documents. Such codes differ each time when the virus infects a different user. This is the main reason why decryption keys are almost impossible to discover even for highly-experienced tech experts. Nevertheless, all keys are stored on remote servers which makes them unreachable for other people, except the criminals themselves.

The ransom message looks like this:

Your files are now encrypted!

Your personal identifier: –
All your files have been encrypted due to a security problem with your PC.

Now you should send us email with your personal identifier.
This email will be as confirmation you are ready to pay for decryption key.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

Contact us using this email address:,

Free decryption as guarantee!
Before paying you can send us up to 3 files for free decryption.
The total size of files must be less than 10Mb (non archived), and files should not contain
valuable information (databases, backups, large excel sheets, etc.).

How to obtain Bitcoins? 
* The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 
'Buy bitcoins', and select the seller by payment method and price: 
* Also you can find other places to buy Bitcoins and beginners guide here: 

* Do not rename encrypted files. 
* Do not try to decrypt your data using third party software, it may cause permanent data loss. 
* Decryption of your files with the help of third parties may cause increased price 
(they add their fee to our) or you can become a victim of a scam.

Crooks who spread viruses such as ransomware may not always provide particular details about the ransom price. However, in almost all cases, criminals demand cryptocurrency such as Bitcoin, Ethereum, Monero, and others, only. Such cryptocurrency transfers give strong guarantees that the entire transfering process will remain safe and untrackable.

If you overcome this ransomware infection, you need to remove virus from your computer system instantly. After you do that, you can fix the damage done by this cyber threat by using Reimage Reimage Cleaner Intego or any other similar anti-malware tool if you are likely too. Make sure you do not perform the data recovery method before you eliminate the infection. Get rid of the virus first and then check out our suggested third-party software for file restoring.

Another reason to complete the removal is that some ransomware-related viruses have an ability to open paths for other malware forms to spread easily. In some cases, you can get your computer system infected even with a Trojan[3]. If such thing happens, the elimination process will become even more difficult to perform. So, please be aware of such possible consequences and terminate the infection ASAP. ransomware is a virus which is a new version of Scarab ransomware.

Take precautionary measures against ransomware infections

According to malware experts[4], ransomware has one main distribution source – spam emails. Cybercriminals often drop dubious messages to numerous random users. Such emails come with harmful attachments, which once opened, launch the virus-related content straightly to the victim's computer system. So, if you ever overcome a suspicious-looking email from a questionable sender – better eliminate it permanently for your own safety.

Moreover, you should avoid visiting third-party websites, for example, P2P networks. These pages can include damaging content which might be a hidden virus. For automatical computer protection, we advise investing in a reliable antivirus program. Computer security software is necessary for every user as it keeps the computer system protected all the time if updated regularly.

Terminate ransomware

If you want to remove virus from your computer system, you need to download and install a reliable anti-malware tool and perform the elimination process. After you do that, we suggest using Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner, or Malwarebytes to fix the damage that was done by the ransomware infection. Note that, manual elimination is not possible for this case as the virus might be too hard to remove on your own.

After you perform the removal, you should not forget to complete some system backups to make sure that all virus-related content was disabled correctly. Moreover, you can start thinking about the data recovery process. We have provided some methods which might be helpful in this case. You can find them below this article.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove virus, follow these steps:

Remove using Safe Mode with Networking

Reboot your computer to Safe Mode with Networking by using these guiding steps:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove

    Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove using System Restore

Turn on the System Restore feature to deactivate the ransomware virus:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage Reimage Cleaner Intego and make sure that removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

Recover locked data by trying our suggested methods. It is better to try all other options than paying the demanded ransom as you risk being scammed.

If your files are encrypted by, you can use several methods to restore them:

Try Data Recovery Pro and restore important documents:

This data restoring method might be helpful if you use it as shown in the instructions.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by ransomware;
  • Restore them.

Maybe Windows Previous Versions feature will be helpful in data recovery:

This method will work only if you have enabled the System Restore feature before the ransom attack emerged.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Try using Shadow Explorer if the virus did not erase Shadow Volume Copies of corrupted data:

However, if the Shadow Volume Copies of your locked files were erased or damaged in a certain way, there are almost no chances that this method will work.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

There is no official decryptor found yet.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes

Access your website securely from any location

When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. It is a hassle when your website is protected from suspicious connections and unauthorized IP addresses.

The best solution for creating a tighter network could be a dedicated/fixed IP address. If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for server or network manager that need to monitor connections and activities. This is how you bypass some of the authentications factors and can remotely use your banking accounts without triggering suspicious with each login. 

VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world. It is better to clock the access to your website from different IP addresses. So you can keep the project safe and secure when you have the dedicated IP address VPN and protected access to the content management system.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.

About the author
Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions


Your opinion regarding ransomware