Category Ransomware

Articles about removing ransomware that blocks Windows or browsers and can encrypt your data and demand ransom.

How to remove Zenis Ransomware and decrypt your files

Zenis is a new virus, which encrypts all data files on a user PC and after that developers demand a ransom for decryption. This type of viruses called Ransomware and has a very high level of damage to docs, music, videos, photos, and databases on a users machines. We strongly recommend you not to pay to cybercriminals, because real decrypting is not guaranteed and payments can increase a number of new virus threats in future. Zenis ransomware show other typical features of ransomware: it adds a random symbols suffix (for example .Zenis-******) for every encrypted file and creates a file Zenis-Instructions.html. Use this article to remove Zenis Ransomware completely from Windows 10, 8, 7 and decrypt your files.

How to remove Arrow Ransomware and decrypt .arrow files

Arrow Ransomware is a new version of encryption virus from notorious Dharma/Crysis ransomware family. Ransomware uses AES and RSA algorithms to encrypt user files and add .arrow extension to affected files. Actually, it appends a complex suffix, that looks like this: .id-{8-symbols-alphanumeric-id}-{e-mail}.arrow. Ransom is 0.1 BitCoin, that currently equals to ~$1000. However, this amount may vary depending on cryptocurrency exchange rate. Arrow Ransomware targets most important user data, which makes it effective for malefactors. These are MS Office documents, OpenOffice, PDF, text files, databases, photos, music, videos, image files, archives, web page files and other web files, educational, application and specialized files, and other files.

How to remove GandCrab2 Ransomware and decrypt .crab files

GandCrab2 is a successor of previous wide-spread ransomware-type virus GandCrab. This virus encrypts user data using AES-256 and RSA-2048 encryption algorithms. GandCrab2 Ransomware appends .CRAB extension to affected files. Following successful encryption ransomware demands ~$400 in Dash cryptocurrency. Ransom note also states, that this amount will double, if not paid in 48 hours.

How to remove GandCrab Ransomware and decrypt .GDCB files

GandCrab is crypto ransomware encrypts user data using AES-256 (CBC mode) encryption algorithm. and RSA-2048 for the key, and then demands a ransom of 1-3 Dash (crypto-currency) to buy GandCrab Decryptor from extortionists and restore files. GandCrab Ransomware appends .GDCB extension to encrypted files. After finishing encryption process virus creates GDCB-DECRYPT.txt file with ransom-demanding content. GandCrab Ransomware stimulates users to pay the ransom by giving limited time period, after the end of which ransom amount doubles.

How to remove Rapid Ransomware and decrypt .rapid or .paymeme files

Rapid Ransomware is encryption virus that encodes user files using AES algorithm. After successful encryption ransomware appends .rapid or .paymeme extensions to affected files. It also creates text files ("!!! README !!!.txt", "! How Recovery Files.txt", "How Recovery Files.txt", "recovery.txt", ) with ransom note and contact e-mails. This version wants 0.4 BitCoins which is around $5000, but we strongly recommend you not to pay money to malefactors, as you can put your bank credentials at risk. Rapid Ransomware also deletes shadow copies of files, so it will be impossible to restore files from shadow copies. However other instructions given on this page can be very useful and help you in your particular case. Follow the guide below to remove Rapid Ransomware and decrypt .rapid or .paymeme files in Windows 10, Windows 8/8.1 or Windows 7.

How to remove File Spider Ransomware and decrypt .spider files

File Spider Ransomware is crypto-virus, that uses the AES-128 and RSA-2048 encryption algorithm to encrypt user files. After this, ransomware appends .spider extension to affected files and creates HOW TO DECRYPT FILES.url, that opens the browser window with the ransom-demanding message. File Spider Ransomware targets most important user data. These are MS Office documents, OpenOffice, PDF, text files, databases, photos, music, videos, image files, archives, web page files and other web files, educational, application and specialized files, and other files.

How to remove Scarab Ransomware and decrypt .scarab and .scorpio files

Scarab Ransomware is encryption virus, that encodes your files using AES cryptography and appends .scarab extension. Following successful infection and encryption Scarab Ransomware creates IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.TXT file. And puts it on the desktop. It demand ransom between $500 and $1000 in BitCoins. Latest versions remove shadow copies of files, restore points and system state backups, not allowing users to restore files using any of this methods. At the moment files hit by Scarab Ransomware are non-decryptable. We will update this article, as soon as decryption tool appears.

How to remove Nemesis Ransomware and decrypt .nemesis, .63vc4, .t5019 files

Nemesis Ransomware is a successor of CryptON Ransomware and is very likely developed and distributed by the same team of hackers. Files are encrypted using mix of RSA, AES-256 and SHA-256 or SHA-512 encryption algorithm. Other version of Nemesis Ransomware are known under the names Cry9, Cry128, Cry36, X3M. Newer version add randomly generated extensions. After encryption ransomware creates file ### DECRYPT MY FILES ###.html with instructions to pay the ransom.