Razy Ransomware

If Razy Ransomware has entered your operating system, it is most likely that it has already encrypted your personal files. This infection comes from the same group of malware as Anonymous Ransomware, R980 Ransomware, and NoobCrypt Ransomware, but, in some ways, it is more malicious than the rest of them. This devious ransomware does not create a decryption key to make the recovery of your personal files possible. This means that there is no point in paying the ransom fee demanded from you. Even if you pay it, you will not get your files back! Obviously, the only logical thing to do is to remove Razy Ransomware. We suggest reading the report to learn more about this clandestine threat, but you can also move straight to the removal guide below if you want to erase the ransomware as soon as possible.

Unsurprisingly, Razy Ransomware travels via spam emails. The launcher of this devious threat is camouflaged as a harmless attachment, and victims open it without suspecting a problem. This is why you should NEVER act carelessly with spam emails, even when they appear to be sent by authentic, trusted senders. Once the attachment is opened, the ransomware is launched, and no copies are created, which should make the removal process a little easier. Of course, it is important to know which file is responsible for encrypting files, and, for example, if you have downloaded and opened several files at the same time, it might be difficult for you to identify the culprit. All in all, this ransomware is unlikely to wait to start the encryption of your files, so you should be able to recognize which malicious Razy Ransomware file needs to be deleted.

The encryption of the files is silent, and most users recognize the attack only after they are introduced to a shocking computer-generated voice message activated via the css.vbs file created on your Desktop. This message calls for your attention and informs that “Your documents, photos, databases and other important files have been encrypted.” According to our researchers, this is something that the victims of the Cerber Ransomware will deal with as well. While the audio message is warning you, Razy Ransomware creates razydecrypt.jpg, which is a picture that orders to open index.html, which is the second file. This file opens a web page that provides two different links. One of them should redirect to www.lolololololol.de, but it does not exist. The second link redirects to mobrise.com, a site that should help you build mobile-friendly websites, which, of course, has nothing to do with ransomware or ransom payments.

According to our researchers, Razy Ransomware requests a ransom payment of 50 Euros; however, as we have already mentioned, there is no point in paying this ransom. In fact, even if you wanted to pay it, there is no way to do that because lolololololol.de appears to be inactive. Even if this website was active, and you were able to make the payment, and if the decryption key existed, paying the ransom is risky because there are no guarantees that cyber criminals would bother to decrypt your files. Speaking of files, you might notice the “.razy” extension attached to them. Our research has also shown that the names of these files might be modified, which might make it difficult for you to identify which files were encrypted. All in all, if you are sure that the most valuable files are backed up on an online storage cloud or a flash drive, you have nothing to worry about, and you can move on to deleting Razy Ransomware.

Use the manual removal guide below carefully. The main executable (the launcher) might have a misleading name, and you do not want to erase the wrong file by accident. If you do not think you can delete Razy Ransomware yourself successfully, install an anti-malware tool you trust. Using this tool is highly beneficial because it can do far more than just remove the ransomware. Once it eliminates this threat, it can also clean your Windows operating system from all other threats, and, most important, it can prevent them from attacking again. Surely, you do not want a malicious ransomware attacking you and your files again, and so using a trustworthy security tool is crucial.

Razy Ransomware Removal

1. Identify the malicious .exe file that has launched the infection.
2. Right-click this file and choose Delete.
3. Right-click and Delete these files found on the Desktop.
   • css.vbs
   • index.html
   • razydecrypt.jpg