Ribd ransomware is a money extortion-based malware that profits cybercriminals
Ribd ransomware is a computer virus that encrypts all pictures, videos, documents, and other files on the targeted system and then demands a ransom to be paid for a decryption key that could bring data back to normal. Like any other ransomware, cybercriminals are demanding payment in cryptocurrency (Bitcoins) – they ask for as much as $980, although this price might be dropped if the contact is made within the first 72 hours after the infection took place.
When this virus encrypts all personal files, including documents, pictures, audio/video files, databases, etc., it also renames them by appending a .ribd extension to their original names. So a file named “1.pdf”, it would now appear as “1.pdf.ribd”.
The main goal of any ransomware developer is to get paid. Criminals urge victims to contact them via two given emails (helpteam@mail.ch and helpmanager@airmail.cc). This information, along with personal ID and payment details is compiled into a text file _readme.txt, which is dropped on the desktop and other locations within the operating system.
Since this infection is a variant of the Djvu ransomware family, there is a chance that a successful file restore can be performed with a decryption tool created by security researchers in Emsisoft. Even if this option does not work, do not rush to pay the attackers, as there are alternative methods you could try for file recovery – we list them at the bottom of this page.
| name | Ribd ransomware |
|---|---|
| Type | Cryptovirus, file-locker |
| Family | Djvu/STOP ransomware |
| appended extension | .ribd |
| Ransom note | _readme.txt |
| Ransom amount | Decryptor price depends on whether the victims contact the hackers within 72 hours. If they do, a 50% discount is applied to lower the price to $490. The original price is $980. |
| Criminal contact details | helpteam@mail.ch and helpmanager@airmail.cc |
| Distribution | File-sharing platforms, spam emails, deceptive ads, fake installers |
| Malware removal | To safely eliminate any cyber threat from your device, and prevent future infections, use trustworthy anti-malware software |
| System repair | Cryptoviruses encrypt only personal data but do extensive damage to system files and settings. That may lead to various abnormal pc behavior, such as crashing, freezing, severe lag, etc. Restore any damage that the system sustained by using the powerful FortectIntego system repair tool |
Djvu ransomware family is one of the most pervasive and productive of them all. Since its introduction in late 2017, it launches new versions each week. Although they bear many similarities, they have differences too. Here are some examples of the latest variants:
One of the similarities is that all the latest family members use RSA 2048 encryption technology making them extremely hard to decode. The other one is that all their ransom notes are almost identical. Victims are pushed into paying the ransom by stating that there's no other way to regain their files.
The hackers behind the virus are trying hard to convince people that the necessary decryption tool exists and that it will be delivered. They offer free decryption of one file and provide a link to a video where the decryptor can be seen in action. Lastly, a 50% discount is offered for everyone who contacts within 72 hours.
Ransom note, which is dropped on the system as soon as malware finishes its job, reads the following:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-Wl6WKEBetp
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
helpteam@mail.chReserve e-mail address to contact us:
helpmanager@airmail.ccYour personal ID:
Paying the ransom might seem like the easiest way out of this uncomfortable predicament, but people have to remember one thing – ransomware attacks can be stopped only if no one pays the criminals.[1] As long as they get paid, the attacks will continue. Ransomware creators can send you another virus instead of a decrypter.
Furthermore, cyber criminals might be wrong by stating that there are no other methods to recover your files. As we've mentioned before, companies constantly work to provide ransomware victims with free decryption software so they wouldn't have to pay the criminals a dime.
Therefore, you should remove Ribd ransomware from your infected computer immediately. You will need a trustworthy anti-malware tool for that. If you had one, it clearly failed you by letting the infection through. Upgrade your cybersecurity level by downloading reliable security tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.
Launch the anti-malware tool and perform a full system scan. Please keep the virus databases of that tool updated frequently so it could stop infections in the future. One of the most important tips is not to ignore antivirus' warnings, especially when you are trying to download a file from a high-risk website.
Djvu ransomware family is known for altering system settings, host files, and other key aspects of the device. These changes might result in various system irregularities, such as BSoD, severe lag, freezing, etc. Fix all these issues with one powerful FortectIntego tool. Then, you can proceed with the next steps that would help you to remediate your system – we provide all the instructions below.
Most pervasive ransomware uses torrents and cracks to spread
Since Djvu family ransomware has been around for a few years now, cybersecurity experts have envisioned many to its peculiarities. One of which is that they are mostly distributed through file-sharing platforms and particularly popular torrent portals.
There are more than a few reasons for that. Most importantly, these websites don't have end-to-end security, meaning anyone could upload anything to them, and no one ever inspects it. Therefore, people who try to get some licensed software for free could get a big surprise with their downloads.
Ransomware creators upload their creations by camouflaging them as the latest game cracks,[2] unlocked expensive software, and other trickery that would draw the attention of an unaware visitor. As soon as the virus payload file is executed, the whole system is infected within a couple of minutes.
Therefore, we highly advise our readers to stay away from file-sharing platforms. Please don't try to trick the system by getting copyrighted products for free, as you could get in a lot of trouble. Download all software only from its developers or official distributors.
.Ribd file recovery options
Let's make things clear: once ransomware encrypts files, the only method that would 100% be able to recover them is the unique key created by the attackers. Unfortunately, they are not willing to give it up for free since it's the main objective of the virus. This is one of the main reasons ransomware is so devastating, hence backups and precautionary measures are so important.
Many users mistakenly believe that they can remove .ribd extension as soon as they perform a scan with anti-malware. Unfortunately, security software is not equipped with file restoration functionality – its only goal is to find and remove all the malicious files caused by the infection.
In other words, you will not restore the encrypted files just by performing a full system scan with security software. At the same time, you should not lose hope, as few alternative methods could help some victims. Here are examples:
- Emsisoft STOP/Djvu decryptor
- Third-party recovery software.
Keep in mind that both of these options are not optimal and might not be successful. However, you should definitely try these solutions before considering the payment to criminals, as, remember, it ultimately proves to criminals that the ransomware business works. Consequently, each payment simply encourages the attackers to infect more victims and extort more money.
Anti-malware can help you get rid of the virus, although it won't restore your data
It does not matter how your Windows machine was infected. Now the most important thing is not to panic. Your data may be encrypted, but you can possibly recover it. Our suggested recovery tools, posted below, might help you to regain access to it.
If they don't, copy all essential data to an offline storage device and wait for a decryption tool to be made available to the public. Then you can remove the virus. To do that automatically, use trustworthy tools such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Either of these apps will protect your systems from such perils in the future.
In some cases, due to modifications done to the system files and settings, security tools can't be launched. Thus to proceed with Ribd ransomware removal, you'll need to reboot your device in Safe Mode with Networking. If you're not entirely sure how that's done, look below this article for our free instructions.
And lastly, to revert any changes done to your device's system and prevent it from exhibiting any abnormal behavior, cybersecurity experts from LesVirus.fr[3] highly recommend using the FortectIntego system repair tool. Download the app, launch it, perform a full system scan, and let it do the rest.
Was this guide helpful?
Be the first to comment