Scarabey Ransomware Removal Guide

Do you know what Scarabey Ransomware is?

Scarabey Ransomware can hit you hard by encrypting all your photos, audios, documents, databases, and more. Our researchers examined this dangerous threat closely in our internal lab and they found that this is a new version of the well-known Scarab Ransomware. It seems that this new malicious infection mainly targets Russian speakers suggested by its ransom note, which is written in Russian. Although you have a choice to pay the ransom to be able to recover your files, we believe that this is rather risky. More often than not, cyber criminals disappear into thin air after they receive money from victims. Even if this may seem as the only solution for you to get your files back, we ask you to reconsider. As a matter of fact, we advise you to remove Scarabey Ransomware from your system as soon as possible. Please read on to learn more about this dangerous infection and how you can defend your PC against similar ones in the future.

It is possible that you did not infect your computer with this beast directly; not that it helps you now. These cyber crooks may exploit your remote desktop software if you have any installed. It is important to know that if such an application is not securely configured, such criminals can relatively easily use it to access your system. For example, you may use weak passwords, which can be cracked. These attackers may use brute force attack to figure out your password but in certain cases they may also use social engineering. In any case, once they gain access to your computer, it is only a matter of minutes for them to plant this malicious program and initiate the attack. Obviously, it is not possible for you to delete Scarabey Ransomware before it finishes its encryption since you will not even notice that it is present on your computer.

Another popular method among cyber villains is spam campaigns. The malicious executable file can be disguised and attached to a spam mail and sent out to thousands of potential victims. This attachment may look like an image or a text document since even the file type icon can be adjusted to fool you. However, when you try to open this file, you directly infect your system in this case and doom your system. Why would you want to see such a file at all? Well, this spam can be very convincing and deceptive. You may actually think that you are presented with an urgent matter that you need to handle right away, such as an unsettled invoice and credit card detail issues. Hopefully, you see now why it is important that you do not open e-mails you are not expecting to get or ones that may be out of place somehow. Keep in mind that you cannot delete Scarabey Ransomwar without possibly losing your files.Scarabey Ransomware Removal GuideScarabey Ransomware screenshot
Scroll down for full removal instructions

As we have mentioned, this dangerous ransomware attacks Russian computer users and encrypts their files with a virtually impossible-to-crack encryption algorithm. Well, at least, no malware hunter seems to have been able to decrypt it so far. Of course, it is always a possibility that a free decryptor will emerge in the near future unless it is absolutely impossible to decrypt a threat. You can recognize the encrypted files easily since they get a ".scarab" extension. This ransomware drops its ransom note ("Инструкция по расшифровке.txt") on your desktop.

This note is in Russian. It basically tells you how you can pay for the decryption of your files. You have to send your ID as well as maximum 2 small files for free decryption to "Support56@cock.li" and wait for a reply with your decrypted files. Then, you have to transfer the demanded ransom fee, which could be as low as 50 dollars in Bitcoin. You are threatened that if you do not pay in time, 24 files will be erased every 24 hour. If you do not pay for 72 hours, all your files will be deleted. While these threats may sound frightening and real, we suggest that you ignore them and act right now unless you decide to pay up. We recommend that you remove Scarabey Ransomwar immediately because it is highly unlikely that you will get the decryption tool anyway.

It is not too complicated to eliminate this ransomware infection. We have prepared the necessary steps below. If you follow our guide, you should be able to stop this threat. Please note that this does not mean that your files will be decrypted and usable. If you do not have a backup, chances are you are going to lose all the encrypted files to this attack. If you want to defend your PC against similar dangers in the future, it may be time to install a trustworthy anti-malware program, such as SpyHunter.

Remove Scarabey Ransomware from Windows

  1. Tap Win+E.
  2. Delete the malicious .exe file (check your download folders).
  3. Delete "%APPDATA%\sevnz.exe" and "Инструкция по расшифровке.txt", the ransom note text file from your desktop.
  4. Empty the Recycle Bin.
  5. Reboot your system.

In non-techie terms:

Scarabey Ransomware is vicious program that targets Russian computer users and encrypts their files to extort money for the decryption. Our researchers have found that this is a new version of Scarab Ransomware, a previous dangerous hit. You can lose all your popular file types in this malicious attack if you do not store a backup on a removable drive. You have 48 hours to pay the demanded ransom and these attackers threaten to delete 24 files every 24 hour. If you do not comply within 72 hours, all your files are said to be deleted. While this may sound frightening to you, we must warn you that paying these cyber criminals may not get you the decryption tool or key in the end anyway. Therefore, we recommend that you remove Scarabey Ransomware from your system as soon as possible. If you cannot seem to protect your PC effectively, we suggest that you start using a professional anti-malware program.