OoPS ransomware / virus (Bonus: Decryption Steps) - Virus Removal Instructions

What is OoPS ransomware virus?

OoPS crypto-virus locks your files in a ZIP archive with an elaborate password

OoPS functions as a file-encrypting threat which employs AES^[1] algorithm to corrupt 45 different file types. It aims at MS Office, image, audio, video, and other popular files. The virus adds these files to a password-protected ZIP archive and appends .ramen file extension. Recently, another version of the malware has been detected – OopsLocker virus.

Undoubtedly, people standing behind this cyber threat offer to get back access to encrypted data by paying the ransom. How much money they ask to pay is currently unknown. However, taking this risky deal is not recommended because you might end up with money loss too. Thus, after the attack, we highly recommend focusing on OoPS removal.

It’s important to delete all malicious components from the system to protect your device from further damage or cyber attacks. The best way to do it is running a full system scan with FortectIntego pr Malwarebytes.

The virus arrives on the system as obfuscated “OoPS Ramenware.exe” file. Once it’s executed, malware makes modifications on system and instals various malicious components in %AppData%, %Roaming%, %Local%, %LocalLow% and %Temp% directories. Malware might also modify Windows Registry and affected several sub-keys in order to run as soon as a computer is turned on.

Before starting data encryption, OoPS ransomware might also get administrative privileges of the device. What is more, it might delete Shadow Volume Copies of the targeted files and backups. Thus, data recovery is nearly impossible without specific decryption software.

We want to remind that purchasing it from cyber criminals is not recommended. They might not have working decryption software, you might be tricked into installing malicious software, or they might simply disappear as soon as they receive the ransom. We believe it’s better to remove OoPS and lose your files than risking to lose the money as well.

Another version – OopsLocker – strikes

On July 18th, a new version has been detected roaming around. The malware which introduces itself as OopsLocker threat. As the previous version, it targets Windows OS users via RDP and spam emails. Its trojan, Deepscan.Generic.Ransom.Wcryg!c, may also lurk for victims in corrupted domains. After the infiltration, the infection encodes files and marks them with .oops file extension.

Luckily, at the moment the activity of the malware is quite low. The malware seems to be rather a test version. Its GUI is not highly sophisticated. It warns users several times not to make any modifications to the files. In exchange to the data, the felons require paying 0.1 bitcoins to the indicated Bitcoin address. In case of technical issues, they provide only4you@protonmail.com address.

Furthermore, the malware also drops the following files: \oops\,oops.exe
EncryptedFiles.txt, EncryptedKey, and KeyHash. Once you notice one of them make a rush to reboot the system. Since the malware is still undeveloped, you may disrupt its processes. Then, proceed to OopsLocker removal. Malware elimination tools will help you detect and delete all associated files. Let us remind you once again not to pay the ransom.

OoPS ransomware adds targeted files to the ZIP archive and appends .ramen file extension that prevents users from accessing them.

The virus lurks for unsuspecting users in spam attachments

OoPS ransomware is mostly distributed via malicious spam email campaigns.^[2] Criminals use social engineering techniques and pretend to be from well-known companies, such as PayPal, FedEx, Amazon, etc. Also, they might claim to be representatives from banks and governmental organizations. Thus, crooks can easily trick victims into opening an obfuscated attachments or click on an infected link.

Once a person does that, the malicious payload is dropped and executed on the system. Besides, OoPS might also enter the system as fake updates or software. Usually, they are promoted as crucial components or useful programs in unknown file-sharing sites, P2P networks or torrents. In order to avoid this cyber threat, you always have to think twice before opening suspicious email attachment and choose reliable sources for software downloads and updates.

Before clicking on content provided in an unknown email, look up for grammar and spelling mistakes, strange phrases, lack of credentials, and similar details that might reveal criminals. In order to protect your computer from OoPS ransomware, you should also choose reliable sources for software downloads and updates.

Options to eliminate OoPS crypto-malware

OoPS is a complex cyber infection that makes system modifications and installs numerous malicious files on the system. Thus, you cannot simply “uninstall” it. We would like to discourage you wasting time on attempts to get rid of the threat manually.

It may lead to irreparable system damage. Malware might use the names of legitimate files and affect system processes. Thus, you might accidentally delete crucial system files. In order to remove OoPS ransomware safely, you should employ a reputable malware removal program, such as FortectIntego, or Malwarebytes. Dannish users^[3] should be especially cautious of the threat

Before installing one of these tools, you may need to reboot the computer to the Safe Mode because malware might stop you from this activity. How to deal with obstacles and run automatic elimination are explained in the instructions below. After OoPS removal, you can restore files from backups or try additional recovery methods.