RIP Ransomware

Posted by Sarah Stewart on December 9, 2016

What is RIP Ransomware?

Malicious infections enter your computer when you expect it the least. RIP Ransomware is one of those programs that can successfully put a halt to your usual operations by encrypting your files. The main reason this program enters your computer is money. The criminals who created the program expect you to pay the ransom fee the moment you see the ransom note. Of course, you should refrain from doing that because the chances are it will not solve your problem. The sooner you remove RIP Ransomware from your computer, the better. And this is why we have come up with this description: to help you get rid of the infection. test test

Where does RIP Ransomware come from?

When it comes to malware infections, prevention is just as important as treatment, so researchers and computer security-related bloggers always point out how important it is to bar malware programs from entering target systems. To do that, you need to know how they spread around.

Unfortunately, there is no one exact source that would be responsible for the RIP Ransomware distribution. Ransomware programs employ various distribution methods that cannot point out to a particular domain or so. Instead, they make use of spam campaigns to reach multiple users worldwide, pretending to be notifications from online shops or financial institutions.

The point is that it is not safe to open attachments from unfamiliar senders. If you feel you have to open a particular file, you should really consider scanning it with a security application because that would (most probably) save you the trouble of getting infected with ransomware or any other dangerous program.

What does RIP Ransomware do?

Technically, RIP Ransomware does not differ much from most of the encrypting ransomware infections. The program scans the affected system looking for the files it can encrypt, and once the encryption is complete, it drops the ransom note for the user to see.

The program employs the AES-256 encryption to lock up the target files. This is one of the most commonly used encryption algorithms, and it is often employed to protect sensitive data. But, as you can see, cyber criminals make use of it as well, trying to rip off regular computer users.

It will not be hard to notice the affected files because all of them will have a new extension added. For example, if you have a file cat.jpg, then after the encryption, the filename will look like this: cat.jpg.R.I.P. It goes without saying that the system will no longer be able to read the affected files, and RIP Ransomware will make you think that the only way to restore them is paying the ransom.

The important.txt file that opens automatically once the encryption is complete says the following:

All your files has been encrypted with a strong AES-256 ciphers
Send 0.2 BTC to this address: 1KdiPSdmqn7BsQFs9kqXdRqygruQeGzCx
Once you make your payment send a message in this email address: dj.elton@hotmail.co.uk

0.2 BTC is around $150USD so overall the ransom fee is not too high, but that does not mean you should pay it. Albeit there is no public decryption tool available at the moment, succumbing to the cyber criminal threats would only give them what they want, without a real guarantee that you would get your files back.

How do I remove RIP Ransomware?

Instead of giving your money away to these criminals, you should delete RIP Ransomware and then look for others ways to retrieve your files. How about a file backup? Do you have an external hard drive where you regularly save copies of your files? Or perhaps you keep a list of your most important documents in cloud storage? If that is so, you can just delete the infected files and transfer the healthy copies back without any further ado. Of course, please keep in mind that you should do that only when you remove RIP Ransomware from your computer. Because the ransomware may encrypt healthy files once it detects them, too.

As far as the removal is concerned, you may have to look for ransomware files in various system directories, and for some users it could be challenging because the filenames will be random. So if you want to save yourself the trouble of digging through your system, you can terminate the infection with a licensed antispyware tool.

Manual RIP Ransomware Removal

Press Win+R and enter %AppData% into the Open box.
Click OK and navigate to Microsoft\Windows\Start Menu\Programs\Startup.
Remove the random-name .exe file from the folder and press Win+R.
Enter %ALLUSERSPROFILE% into the Open box and press OK.
Go to Microsoft\Windows\Start Menu\Programs\Startup.
Delete the random-name .exe file from the folder and press Win+R.
Enter %WINDIR% and click OK. Go to the SysWOW64 folder.
Delete the random-name .exe file and go a step back to the WINDOWS directory.
Open the System32 folder and delete the same random-name file.
Press Win+R again and type regedit. Click OK to open Registry Editor.
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
On the right side, right-click and remove values that have this data:
%WINDIR%\Syswow64\[random-name].exe
%WINDIR%\System32\[random-name].exe