Ranscam Ransomware

Posted by Max Lehmann on July 15, 2016

What is Ranscam Ransomware?

On the surface, Ranscam Ransomware looks like your usual ransomware program that encrypts files and then wants your money. However, this one is slightly different from the applications we now (unfortunately) encounter on daily basis. This program does not encrypt your files; it just wants you to believe so.

Nevertheless, this program is still a dangerous infection that can literally change your system’s landscape, so now is no time to heave a sigh of relief. You have to remove Ranscam Ransomware at once because the longer this program remains on your system, the more damage it can cause. And you certainly would not want to deal with the aftermath.

Where does Ranscam Ransomware come from?

During our research, we have found that we have seen a similar (if not identical) program before. Apparently, Ranscam Ransomware is another version of CryptoFinancial Ransomware. So, technically, we have now two infections that share the same features.

Where EXACTLY this program comes from, we cannot be sure. For the most part, ransomware applications tend to be distributed via spam email. It means that all that annoying mail you receive in your junk box (and sometimes even the main inbox!) should be ignored and deleted no questions asked. Especially the spam messages that come with attachments: those are the most dangerous ones. Right before you got infected with Ranscam Ransomware, you must have opened some recently downloaded file, and that was what triggered the payload.

What does Ranscam Ransomware do?

As already established in the first paragraph, this ransomware program is not interested in file encryption. Or, to put it simply, it is too simple to be able to do that. However, this does not mean it cannot put you on your toes.

When it infects your computer, Ranscam Ransomware opens a full-screen window that virtually locks you out of your desktop. This full-screen message says the following:

YOUR COMPUTER AND FILES ARE ENCRYPTED
YOU MUST PAY 0.2 BITCOINS TO UNLOCK YOUR COMPUTER
YOUR FILES HAVE BEEN MOVED TO A HIDDEN PARTITION AND CRYPTED.
ESSENTIAL PROGRAMS IN YOUR COMPUTER HAVE BEEN LOCKED AND YOUR COMPUTER WILL NOT FUNCTION PROPERLY.
ONCE YOUR BITCOIN PAYMENT IS RECEIVED YOUR COMPTUER AND FILES WILL BE RETURNED TO NORMAL INSTANTLY.

For starters, 0.2 Bitcoin is around $130 USD and, from our experience, we can tell that this is below the average ransom amount that such programs usually ask for. Second, the message is nothing but likes. As you already know, the files have not been encrypted, and they have not been moved to a hidden partition. It is true that Ranscam Ransomware may hide some of the folders, but the ransomware DELETES your files.

Also, it cannot restore them even if you do pay the ransom. So it is more than obvious that you should ignore this notification and focus on the task at hand. Your task is to terminate the infection, restore your files and protect your system from similar intruders in the future.

How do I remove Ranscam Ransomware?

Technically, there are two ways to delete this infection: manual and automatic. We will tell you how to remove the infection manually in the instructions below, but even if you are confident you can do that on your own, we would strongly recommend that you scan your PC with the SpyHunter free scanner after manual removal. Just to be sure that you have deleted all the malicious files and such.

What if you do not want to do that on your own? Well, then you can acquire a computer security tool of your choice to terminate all the malicious threats. This ransomware program does not lock the Normal mode, so you should have no problem launching a security program.

Now, what about your files? The good news is that nothing is actually deleted even if you terminate files with the Shift+Delete function. Anyone with a decent file recovery program could restore the affected files. Thus, you should address a technician or invest in reliable file recovery software to get your files back. If you have your files saved on a cloud drive or an external HDD it is even better: you can simply copy them back into your computer.

Should you have any further questions about this infection or your computer’s security, please do not hesitate to leave us a comment. We are always ready to assist you.