Severity scale:  

Remove Red ransomware (Free Instructions) - Removal Guide

removal by Alice Woods - - | Type: Ransomware

Red ransomware – a cryptovirus that encrypts personal data by using AES encryption algorithm

Red virusRed ransomware is another cryptovirus which emerged from the infamous Scarab ransomware family. It encrypts files using AES encryption algorithm[1] and adds .Red extension to every document that it locks up. For example, if you have a file named, it turns to The virus places HOW TO RECOVER ENCRYPTED FILES ransom note into each of the affected folders soon after encryption. In the message, hackers ask victims to contact them via email address and pay ransom in Bitcoin cryptocurrency.

Name Red 
Type Ransomware
Category Scarab
Extension .red
contact email
Encryption code AES algorithm is used to encrypt files
Damage caused Encrypted data, breaks through security systems, etc.
Distribution ways Spam emails, malicious sites, malspam, etc.
Elimination To eliminate the cryptovirus use Reimage Reimage Cleaner Intego.

Unlike some of its previous versions, a Scarab-Red virus is still not decryptable. Nonetheless, paying ransom is not recommended. As usual, these criminals might simply take your money and send no decryption key in return. This way, you will end up with locked up files and lost money. Therefore, instead of contacting cybercriminals you should remove Red ransomware and then try to recover your data in other ways.

The file locking virus can inflict various damage to your PC, such as:

  • Make personal files Inaccessible;
  • Remove Shadow Volume Copies;
  • Alter Windows Registry;
  • Block security software;
  • Open a path for other viruses to infiltrate the system.

.red ransomware-type virus is often distributed through links inside spam emails or their attachments. They are often disguised by using legitimate-looking names, such as “invoice.pdf,” or “restore account.html” and similar. Victims are sometimes easily tricked into opening these attachments, as the from address usually looks genuine, as well as logos and styling of official companies are used.

Ransomware is one of the most persistent and devastating computer infections which should not be underestimated. Cybercriminals often create new versions of popular viruses merely to extort money out of victims. And, even though as little as 2-4% of victims pay the ransom, it is usually enough to make a (at least a small) fortune, especially if the virus is wide-spread.

As we mentioned above, do not pay a ransom. Even if Scarab-Red ransomware encrypted our files, you still have a hope to restore them. First of all, if you have a back-up, you are safe! Just make sure you do not connect to your backed up data before you perform Red ransomware removal, regardless if it is remote cloud storage or an external device. 

If you do not possess a copy of your data, it can still be saved by using Shadow Volume Copies, as the virus might fail to remove them in some cases. Additionally, you can use third-party software which could help you with file recovery (although chances are quite low).

Remember, deleting severe infections like ransomware is not recommended! Only IT professionals can execute that task, as malware's code is extremely complicated. Therefore, unless you are a programmer or a hacker yourself, stick to anti-virus software. Out team suggests using Reimage Reimage Cleaner Intego or Malwarebytes – these programs are designed to fight malware.


Red ransomwareRed virus is a member of the Scarab family and benefits from desperate users by urging them to pay a ransom in order to get a decryption key for their locked files. Keep your important files safe by avoiding ransomware

According to the research of IT professionals[2], a cryptovirus usually comes hidden inside a phishing email. If you received a spam email – better delete it permanently. Ransomware is usually hidden within a deceptive hyperlink or is attached directly to the email. The attachments usually come in .doc, .pdf, .html, .zip, .exe or other file types.

Free programs shared online can infect your computer with dangerous malware as well. Even if the application is legitimate, hackers may inject its executable with malicious code and upload it on a file-sharing website. This practice has been noted in torrent hosting sites.[3]

Additionally, make sure you download and install an antivirus tool. It will help you deal with most cyber threats that you might encounter online. Most importantly, always keep it up-to-date, as virus database is updated almost on a daily basis.

Rely on professional tools in order to get rid of Red ransomware

To remove Red virus from your Windows, you need to use a trustworthy anti-malware tool. We suggest you choose from one of these programs: Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner, or Malwarebytes

You should definitely proceed with the Scarab-Red ransomware removal no matter how long the process will take. Without getting rid of the cryptovirus, you will not be able to use your PC properly.

For file decryption, check our last section below. You will find an array of tools you can use to attempt file recovery, as well as descriptions of how to use them. If you have a backup, get your files from there.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove Red virus, follow these steps:

Remove Red using Safe Mode with Networking

Reboot your PC to Safe Mode in order to get rid of the cryptovirus:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Red

    Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Red removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Red using System Restore

Try using the System Restore feature in order to disable the harmful activity. After that, perform some system scans:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Red. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage Reimage Cleaner Intego and make sure that Red removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Red from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

Now you are going to read data recovery methods which are provided by tech security experts. As your PC is occupied by a serious ransomware-type virus, be sure that professional help is required.

If your files are encrypted by Red, you can use several methods to restore them:

Use Data Recovery Pro to get back your files

This decryption program offers its help in recovering important data. You will be able to restore deleted or encrypted files by following this guide:

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Red ransomware;
  • Restore them.

Try Windows Previous Versions feautre

This is another professional tool which should help you get your important files back. Notice, it only will work if the System Restore function was activated before the cyber attack.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Restore your files with ShadowExplorer:

This program will recover individual files. However, it will work only if the cyberthreat did not manage to erase the Shadow Volume Copies of encrypted files.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

There is no official Red decryptor yet.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Red and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes

Do not let government spy on you

The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices. Avoid any unwanted government tracking or spying by going totally anonymous on the internet. 

You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using Private Internet Access VPN.

Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.

About the author
Alice Woods
Alice Woods - Likes to teach users about virus prevention

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Alice Woods
About the company Esolutions


Your opinion regarding Red ransomware