Scarab-Good Ransomware

Cyber criminals have already developed hundreds of different ransomware infections. Scarab-Good Ransomware is one the newest members of the wide ransomware family. Ransomware infections both differ from each other and are similar at the same time. Their appearance differs, they drop different files with completely different messages, but one thing remains the same – these infections are developed by cyber criminals to obtain money from users. They usually force users to transfer money by locking their Desktops or encrypting their personal files. Scarab-Good Ransomware is one of those threats that encrypt users’ personal files. If it ever infiltrates your computer, it will encrypt your files in the blink of an eye. As a consequence, you could no longer open any important files, including documents, pictures, music, and more. You must delete Scarab-Good Ransomware from your computer ASAP, but your data, unfortunately, will not get back to normal. Yes, your all files will stay completely encrypted. We can only list two ways to fix them. First, you can use a special decryptor purchased from cyber criminals. Needless to say, this is not what we recommend that you do. Second, it will not be a problem to restore files if you have copies of all those affected files. Make sure you delete the ransomware infection first and only then fix ruined personal files.

As mentioned, there are so many different ransomware infections available. As a consequence, it is sometimes quite difficult to recognize which one has infiltrated the system. Speaking about Scarab-Good Ransomware, it can be easily recognized by the filename extension it appends to encrypted files. Specifically speaking, you will find the extension .good in the place of original files’ extensions, and, on top of that, all these files will be renamed upon the successful entrance of the ransomware infection. What you will see is a long string of random characters in the place of a file’s name. You can try to rename them all back and remove the appended extension, but not a single file on your PC will be unlocked. Cyber criminals behind Scarab-Good Ransomware want that you contact them if you decide that you need your files back. Without a doubt, they will ask you to pay a ransom. You must decide what to do yourself, but in case you need some help, we want to encourage you to keep the money you are planning to send. There are no guarantees that your files will be unlocked, i.e. the decryptor might not work. Also, we want you to know that you might not even get the decryptor from malware developers.

Not much is known about the distribution of Scarab-Good Ransomware. It is mainly because the malicious application is quite new and far from prevalent malware. Needless to say, our specialists still have their own personal opinion about its distribution. They say that this threat should also be distributed via malicious attachments. If it is true, it means that you might find malicious software installed on your computer after you open an ordinary-looking email attachment. The problem is they do not look harmful at all, meaning that it is extremely hard to recognize a malicious attachment and prevent malware from affecting the system. Also, Scarab-Good Ransomware might be dropped on your system by cyber criminals. This is especially true if you use an RDP connection whose credentials are weak. Without a doubt, it is always easier to affect systems with no antimalware tools installed, so we highly recommend that you do not keep your system unprotected.

There are no free tools to unlock files encrypted by Scarab-Good Ransomware with available. We do not recommend that you send money to malicious software developers either. You can still restore all affected files from your backup for free. The ransomware infection must be erased fully from the system first. Do not worry if you have not erased any infections in your life – our manual removal guide will show you what you need to do to disable it. Make sure you do not skip a single removal step!

How to remove Scarab-Good Ransomware

1. Open Windows Explorer.
2. Type %APPDATA% in the URL bar and click OK.
3. Remove OSK.exe (if it has not removed itself yet).
4. Delete HOW TO RECOVER ENCRYPTED FILES.txt from %USERPROFILE%.
5. Close Windows Explorer and press Win+R.
6. Type regedit and click OK.
7. Right-click on the HKEY_CURRENT_USER\Software\ccmQiiBtihuM (a random name is used) registry key and select Delete.
8. Access HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
9. Delete the value named ccmQiiBtihuM (its name might be different).
10. Empty Trash.