Kangaroo Ransomware

Posted by Lisa Blanc on November 7, 2016

What is Kangaroo Ransomware?

Have you encountered a suspicious pop-up on your Desktop named Kangaroo Ransomware? If you have, do not click the “Copy and Continue” button under any circumstances. If you do not follow this advice, the malicious ransomware will start encrypting your personal files, and there might be no turning back after that. If the pop-up has appeared, the ransomware has already infected your operating system, which, according to Anti-Spyware-101.com malware experts is done by exploiting the RDP (Remote Desktop Protocol). If malware can be dropped onto your computer remotely, there is no doubt that your entire operating system is vulnerable. It is even possible that other malicious threats have invaded your operating system. Obviously, if they have, you will need to remove them as well. Right now, we want to focus on deleting Kangaroo Ransomware. Even if you are unable to decrypt/recover your files, eliminating this malicious threat is crucial, and so you should not postpone this task. test test test

How does Kangaroo Ransomware work?

When researching Kangaroo Ransomware, we have noticed that this malicious infection is very similar to other well-know ransomware threats, such as Apocalypse Ransomware and Esmeralda Ransomware. For one, all of these infections evade the same types of files, including .exe, .lnk, .com, .bin, or .dll. Although it’s great that the ransomware does not lock up system files (it also avoids all files in the Windows directory), these are the files that are easiest to replace. The malicious ransomware targets personal files instead because they are more valuable and vulnerable. Unless you have your photos, videos, documents, and other personal files backed up, you are in trouble if the devious ransomware slithers in. This infection is even capable of deleting shadow volume copies, which means that you will not be able to recover your files using a system restore point either. In fact, the devious Kangaroo Ransomware can stop you from doing anything as it can lock your screen using a window that takes over the entire screen.

The initial notification that Kangaroo Ransomware displays is meant to trick you into agreeing to have your files encrypted. Once that is done, and the screen is locked, you are introduced to a notification indicating that your files were encrypted for security reasons. This notification is quite believable, and some users might be tricked into thinking that they are dealing with a different kind of problem, not a ransomware invasion. The purpose of feeding you false information is to make you disclose your unique ID and initiate communication with kangarooencryption@mail.ru. You might email this address hoping to retrieve decryption software – “Unlock-Password and Kangaroo Decryption Software” – but that is just a scam to make you pay a ransom. Does this software exist and will it help you recover your files? That is unknown, which is why our research team cannot recommend following the demands of cyber criminals. Note that the same demands are included in the {encrypted file name}.Instructions_Data_Recovery.txt file. Of course, you will discover this file – as well as the “.crypted_file” extension added to the corrupted files – only if you unlock your operating system. The good news is that unlocking it is not the most difficult task.

How to delete Kangaroo Ransomware

If you reboot your operating system in Safe Mode with Networking, you will be able to install anti-malware software or proceed with the manual removal of Kangaroo Ransomware. Needless to say, we suggest using anti-malware software because it can fully erase all existing threats, and, as we discussed already, other threats might have invaded your operating system. Furthermore, this software can guarantee reliable protection that your operating system needs so much. If you decide to follow the steps in the guide below, you should still consider installing anti-malware software because cyber criminals are inventive, and they can exploit different security backdoors to infiltrate malware without your knowledge. Another thing you should do after you get rid of malware is to set up a backup system to ensure that malware cannot remove or permanently corrupt your files in the future. Anti-Spyware-101.com research team is ready to answer your questions. If you have any, leave them in the comments box.

Removal Instructions

Reboot Windows XP/Windows Vista/ Windows 7:

Restart the PC, wait for BIOS screen to load, and immediately start tapping F8 key.
When the boot menu appears, select Safe Mode with Networking using arrow keys and then tap Enter.
When the PC boots up, delete the malicious ransomware components (see guide below).

Reboot Windows 8/Windows 10:

Click Power (Windows 10 users need to click the Windows logo on the Taskbar first. Windows 8 users need to access the Charm bar and click Settings first).
Simultaneously tap the Shift key and select Restart.
Move to the Troubleshooting menu and click Advanced options.
Select Startup Settings and then click Restart.
When the boot menu appears, select F5 for Safe Mode with Networking.
When the PC boots up, delete the malicious ransomware components (see guide below).

Remove Kangaroo Ransomware

First, detect and Delete the malicious .exe launcher (you can use a malware scanner to find it).
Simultaneously tap Win+E keys to access Windows Explorer.
Type %PROGRAMFILES% (or %PROGRAMFILES(x86)%) into the bar at the top and tap Enter.
Open the folder named Windows NT.
Delete the copy of the malicious launcher (in our case it was named explorer.exe).
Simultaneously tap Win+R keys to launch the RUN dialog box.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
Delete the value named Windows Explorer if the value data reveals the malicious .exe file.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
Delete the value named LegalNoticeText if the value data includes the ransom note.