RedRoman Ransomware

It is impossible to say at this time who created RedRoman Ransomware, but this malicious infection appears to be a unique threat, not a clone of another well-known one. Of course, that does not mean that it works in unique ways. Just like most file-encrypting threats, this malicious ransomware invades Windows operating systems, encrypts files, and then demands money (the ransom) in return for an alleged decryptor. Although attackers who use encryptors should, in theory, have decryptors as well, that means nothing. Cybercriminals create ransomware to make money, and they do not care one bit about what happens next on the infected system. If you think that they would spend their time sending you decryptors and decryption instructions, you need to think again. Of course, you cannot restore files by removing RedRoman Ransomware, and you might not have backups to replace the corrupted files, but even if that is the case, you must not give in. Instead, you must focus on deleting the dangerous threat.

It is easy to identify the attack of RedRoman Ransomware because once this malware encrypts files, it attaches the “.REDROMAN” extension to all of the corrupted files’ names. These files are likely to be your precious photos, important documents, and files alike. Next to the corrupted files, you are likely to find a ransom note file. We have seen a few variants of this file, and their names were “RR_README.html,” “OPENTHIS.html,” and “README.html.” The message, of course, stays the same, regardless of the name. It opens with a statement that a “Critical Error” has occurred and that your files were “corrupted.” Now, if you want to restore them, you have to purchase $200 worth of Bitcoin (at the time of research, that was ~0.010 BTC) and send it to the attackers’ Bitcoin wallet – 14BfVG4vH71NLmhu7vFKi9EMmeZFoiAsYP (at the time of research, it was empty). The instructions in the RedRoman Ransomware ransom note suggest that once you pay the ransom, you must contact “Tech Support” at insupport@messagesafe.io to notify them about what has happened, and once your payment is confirmed, you will be sent a “file-repair tool.” Obviously, this is a scam. If you pay the ransom, you will not get anything in return.

You might think that recovering your personal files and deleting RedRoman Ransomware are the most important tasks, but it is pretty clear that securing your Windows operating system is just as important. In fact, maybe more so. Removing the ransomware is not a complicated task, and our research team can show you how to do it. Recovering files, however, appears to be impossible, and you can escape the attack unscathed only if you have backup copies of your files. If these copies are stored outside the infected computer, you have replacements, but make sure you remove RedRoman Ransomware before you access the backups or make any replacements. That said, if you get rid of the ransomware successfully, no one can predict when the next threat will invade. In fact, other threats might exist already. One of them could have dropped and executed the ransomware itself. Of course, it is more likely that the infection was introduced to you via a malicious downloader or a spam email attachment.

Needless to say, there is no time to waste in a situation like this. If you are sure that you want to focus on the removal of RedRoman Ransomware only, you might choose to get rid of this malware manually. The name of the launcher file is random, and it could have been dropped pretty much anywhere on your computer. If you can locate this file, delete it immediately. You must scan your system afterward. If you want to delete RedRoman Ransomware and also secure your system at the same time, we recommend that you implement a reliable anti-malware program, one that could automatically delete threats and also secure the system against malware attackers. Even if you secure your system, do not forget that spam emails and unreliable downloaders can hide malware. Also, make it a habit to back up important files because you never know when you might need their copies.

RedRoman Ransomware Removal

1. Delete recently downloaded suspicious files. You can look for them here first:
   • %USERPROFILE%\Desktop
   • %USERPROFILE%\Downloads
   • %TEMP%
2. Delete the ransom note file. It could be named OPENTHIS.html, README.htm, or RR_README.html.
3. Empty Recycle Bin and quickly install a trustworthy malware scanner.
4. Perform a full system scan to see if leftovers exist.