Ramsey ransomware / virus (Easy Removal Guide) - Decryption Methods Included
Ramsey virus Removal Guide
What is Ramsey ransomware virus?
Ramsey – a new variant of Jigsaw ransomware that aims at Turkish-speaking computer users
Ramsey is a Turkish version of Jigsaw ransomware. This file-encrypting virus uses RSA-2048 and RSA-256 algorithms to encrypt files on the attacked computer. Malware aims at various audio, video, image, text and many other files, and append the .ram file extension to each of the encrypted files. Once this task is completed, it opens a ransom note written in the Turkish language. It arrives in a program window that includes the main information about data encryption, provides data decryption conditions and instructions, gives Bitcoin wallet address, provides contact email address (ramsey34.ramsey34@vfmail.net) has “View encrypted files” button and a timer that counts how much time has left until deletion of one random file. Ramsey ransomware asks to pay 100 Turkish Lira or at least 25 USD. Otherwise, victims will experience a tremendous damage. Nevertheless, the size of the ransom is not huge; you should not transfer it. Even the small amount of money is a motivation for cyber criminals to continue their cyber crimes and create even more dangerous viruses. Instead of paying the ransom, you should try Jigsaw decryptor,[1] use backups or try alternative recovery methods that are safe and do not require having business with cyber criminals. But first, you need to scan the computer with FortectIntego or other security tool and remove Ramsey from the system.
Malware arrives on the system as an obfuscated Ramsey_Ransomware.exe[2] file. Once it’s executed on the system, Ramsey starts completing its tasks. The virus might make modifications in the system in order to run on system startup, make Registry entries, and install many malicious files. Only when it strengthens its presence on the device, it starts data encryption procedure. As you can see, ransomware not only damages your files but makes the system vulnerable too. Thus, it might open the backdoor and help other malware to launch other successful cyber attacks. It’s another reason why we do not recommend delaying Ramsey removal. It may lead to more computer and privacy-related problems than you already have.
Sneaky distribution ways of the ransomware virus
Ramsey might be using several distribution and infiltration strategies, such as malicious spam emails and their attachments, malvertising, exploit kits, fake software updates and downloads. Cyber criminals use clever social engineering techniques to trick people into opening an infected email attachment. They might pretend to be from reliable organizations or companies (e.g. banks, hospitals, delivery services, etc.), and inform about serious issues. More information about the problem is usually provided in the attached document or users have to click on a button and visit a crafted site. Once they are tricked to do that, Ramsey payload is dropped and executed on the system. The malicious executable might be installed when a person clicks on a malware-laden ad or installs software from unknown file-sharing sites or torrents. Besides, ransomware might also be capable of using system vulnerabilities and outdated software to enter the system. Thus, you should not only behave carefully online but keep your software up-to-date too to avoid crypto-malware.
Safe way to remove Ramsey from the device
Ramsey removal has to be performed using reputable and powerful malware removal program. Trying to locate and delete virus-related entries manually might lead to irreparable system damage because various malicious files might be installed on different system locations and hidden under legitimate system file names. Thus, you might accidentally delete safe files instead of dangerous. In order to avoid such problems, you should install FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes and scan the computer. But first, you may need to reboot the computer to the Safe Mode with Networking. It helps to disable the virus, install your chosen security software and remove Ramsey automatically without any obstacles.
Getting rid of Ramsey virus. Follow these steps
Manual removal using Safe Mode
In order to run automatic Ramsey removal, please reboot the computer to the Safe Mode with Networking first.
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Ramsey using System Restore
If you are having difficulties with ransomware removal, try System Restore method.
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Ramsey. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove Ramsey from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.The official Ramsey Decryptor is not released. Currently, the only safe and effective data recovery solution is backups. However, if you have never backed up your files, you should try Jigsaw decryptor or alternative recovery methods after virus removal.
If your files are encrypted by Ramsey, you can use several methods to restore them:
Restore files with .ram extension using Data Recovery Pro
This professional tool is designed to restore corrupted, accidentally deleted and some of the encrypted files. Thus, it might help you in data recovery as well.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Ramsey ransomware;
- Restore them.
Take advantage of Windows Previous Versions feature
If System Restore method has been enabled before Ramsey ransomware attack, you could recover some of the encrypted files by following these steps:
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Recover files using ShadowExplorer
If ransomware left Shadow Volume Copies of the targeted files on the system, ShadowExplorer might be helpful in data recovery as well.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
Jigsaw Decryptor
The original version of the Ramsey ransomware virus is decryptable. Thus, you should try its decryptor. Hopefully, it will help to restore your files too. You can download decryptor from here.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Ramsey and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Protect your privacy – employ a VPN
There are several ways how to make your online time more private – you can access an incognito tab. However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of Private Internet Access VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise. Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and Private Internet Access VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers – human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence. In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. Data Recovery Pro is one of the leading file recovery solutions you can find on the market – it is likely to restore even lost emails or data located on an external device.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Catalin Cimpanu. Jigsaw Ransomware Defeated Again, Free Decrypter Available. Softpedia. Free Downloads Encyclopedia.
- ^ The analysis of Ramsey_Ransomware.exe. Virus Total. Free Online Virus, Malware and URL Scanner.