Scarab-Cybergod Ransomware

Scarab-Cybergod Ransomware is another threat from the Scarab Ransomware family. It looks like the malicious program’s developers want their victims to bargain with them for receiving decryption tools. Our researchers tested the malware and can confirm it is capable of enciphering user’s files with a robust encryption algorithm. However, knowing the hackers could trick their victims we advise against transferring any money to them. The safest option to get the affected files back is to replace them with backup copies. Thus, if you have copies of at least your most important data, we would recommend not to take any chances with this threat. You can find out how to remove Scarab-Cybergod Ransomware manually while following the instructions available a bit below this article, which you should read first if you wish to get to know this malicious application better.

One of the things we would like to discuss in this text about Scarab-Cybergod Ransomware is its possible distribution channels. Our researchers think the malware’s developers could be using the most popular methods, such as spreading the threat’s installer through email attachments, software installers, pop-ups, and so on. For instance, the hackers could send their victims' Spam emails saying it is crucial to open the attached files immediately. This is why it is advisable not to open any data sent by someone you are not familiar with or files you did not expect to get. Additionally, we would recommend keeping away from various file-sharing web pages as they could offer installers bundled with malware or display pop-ups providing threats as well. Besides, if you have not yet picked a reliable antimalware tool, it might be a good idea to do so at last as such a tool could help you guard the computer against various malicious applications.

Furthermore, when Scarab-Cybergod Ransomware enters the system, it might create some data we will list in the deletion instructions available below the article. After settling in, it is supposed to begin the encryption process during which the malware may encipher user’s photos, videos, various documents, archives, and other private files. Our researchers report each encrypted file should be not only marked with the .CYBERGOD extension, but also renamed. Apparently, the new title should be from 34 random characters. Therefore, victims might have some trouble while trying to identify the affected data. Once this process is over the malicious application may reveal its presence by placing a ransom note called From Jobe Smith.TXT in every directory containing enciphered data. Also, to get the victim’s attention the threat might change user’s Desktop wallpaper.

Scarab-Cybergod Ransomware’s ransom note (From Jobe Smith.TXT) should say the user can get his files back if he makes an offer to the hackers who created the malware. It would seem users are supposed to contact them via email and the message should contain not only the suggested sum the user is prepared to pay but also a unique ID number provided on the note and a couple of files the malicious application’s developers might encrypt to prove they have decryption tools. Needless to say, while they could have such tools, there is not knowing if they will bother to send them too you.

If you hate the idea you may have to gamble with your money we advise erasing Scarab-Cybergod Ransomware instead of paying the ransom. To remove it manually users should complete the instructions we added at the end of this article. On the other hand, if you want to use automatic features instead, you could acquire a trustworthy antimalware tool and set it to scan the computer. Soon after the scanning is over, you should see a list of detected threats and to remove them all at once you would only need to press the given deletion button. The moment the malware is gone, it should be safe to transfer backup copies or create new data on the computer.

Eliminate Scarab-Cybergod Ransomware

1. Tap Ctrl+Alt+Delete.
2. Launch Task Manager.
3. Look for the infection’s process.
4. Select the malicious process and press End Task.
5. Leave the Task Manager.
6. Click Win+E.
7. Find these locations:
   %TEMP%
   %USERPROFILE%\desktop
   %USERPROFILE%\downloads
8. Look for the malware’s installer, then right-click it and press Delete.
9. Search for this path: %APPDATA%
10. Find a file named helper.exe, right-click it and press Delete.
11. Then go to %UERPROFILE%
12. Find the image used to replace Desktop wallpaper, e.g., utgnHmbtI.bmp, right-click it and press Delete.
13. Locate all ransom notes and erase them too.
14. Exit File Explorer.
15. Press Win+R.
16. Insert Regedit and press Enter.
17. Navigate to this path: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
18. Search for a couple of value names created by the threat: one of them might have a random name and the other should be called whelp.
19. Right-click the malware’s created value names and press Delete.
20. Go to HKEY_CURRENT_USER\Software
21. Find a key with a random name.
22. Right-click a randomly named key, e.g., utgnHmbtI, and press Delete.
23. Close Registry Editor.
24. Empty Recycle bin.
25. Restart the system.