How to Remove Scarab Ransomware

The Scarab ransomware was discovered in June 2017 by Michael Gillespie, a malware security researcher. There are various variants of the ransomware, and each has its tactics. The most prominent variant of Scarab ransomware is the Scarabey ransomware, which was discovered in December 2017. These two variants are distributed differently. While the Scarab is distributed via the Necurs botnet, Scarabey is distributed manually via RDP by being dropped on systems.

What is Scarab Ransomware?

Scarab is a type of ransomware that infects systems and locks different types of data stored there. Like any other ransomware out there, Scarab demands a payment in the form of Bitcoin promising to allow the victim access to the encrypted data.

What Can Scarab Ransomware Do?

Upon infiltration, Scarab ransomware spreads to infect the whole system, and then encrypts the data stored there. The encrypted files are appended with the “.[resque@plague.desi].scarab” extension after infection with Scarab ransomware.

After the data has been encrypted, a message is sent to the victim, asking him/her to pay a ransom. There are threats stated in the ransom note that says delays in making the payment will cause the price to go up or all the data to be deleted permanently.

There is a high likelihood that heeding the ransom demands and making a payment doesn’t guarantee that your data will be decrypted. Unfortunately, unlocking the data is impossible without a decryption key. To avoid being scammed, you need to remove the Scarab ransomware and recover your data using other methods. The only way for you to get your data back is by restoring your files from a backup.

Scarab Ransomware Variants

Like we previously mentioned, Scarab keeps appearing with new variants, thanks to the regular updates that are done pretty much every month. There are more than 20 different variants of this ransomware-type virus that extorts money from its victim. Some of the variants include:

• Scarab-Amnesia
• Scarab-Walker
• Scarab-Recovery ransomware
• Scarab-Decrypts ransomware
• Leen ransomware
• Bomber ransomware
• Danger ransomware
• Scorpio ransomware
• Cov19 ransomware virus

Scarab Ransomware Removal

This removal process may appear lengthy, but it’s quite simple. Simply follow the Scarab ransomware removal instructions carefully.

Option 1: Removing Scarab ransomware using safe mode with networking

This method is quite effective, especially if your device is out of control. Follow these steps:

Step 1: Restart the computer in “Safe Mode with Networking.”

Windows 7/Vista/XP

1. Click on “Start.”
2. Choose “Shutdown.”
3. Select “Restart,” and then click “OK.”
4. Press F8 severally during the computer startup process.
5. A “Advanced Boot Options” window will pop up.
6. Choose “Safe Mode with Networking.”

Windows 8/10

1. Press the Power button.
2. Long-press the “Shift” key and click on “Restart.”
3. Go to “Troubleshoot.”
4. Go to “Advanced Options.”
5. Choose “Startup Settings.”
6. Click on “Restart.”
7. When the computer restarts, a startup window will show.
8. Hit the F5 key to “Enable Safe Mode with Networking.”

Step 2: Remove the ransomware

After the “Safe Mode with Networking” has been activated, download and install a reputable anti-malware tool and use it to scan your computer.

Once the Scarab ransomware removal is complete, all its malicious files will be deleted.

Option 2: Removing Scarab ransomware using System Restore

Step 1: Restart the computer in “Safe Mode with Command Prompt.”

Windows 7/Vista/XP

1. Click on “Start.”
2. Select “Shutdown.”
3. Choose “Restart,” and then click on “OK.”
4. During the computer’s startup process, press F8 repeatedly.
5. In the “Advanced Options Boot” window, select the “Command Prompt.” option.

Windows 10/11/8

1. Press the Power button.
2. Click on “Restart” as you long-press the “Shift” key.
3. Go to “Troubleshoot.”
4. Select “Advanced Options” then “Startup Options.”
5. Click on “Restart.”
6. When the computer comes back on, the “Startup Settings” window will show.
7. Select “Enable Safe Mode with Command Prompt.”

Step 2: Restore your system files and settings.

1. Into the command line of the Command Prompt window, type “cd restore.”
2. Hit the “Enter” key.
3. Next, type “rstrui.exe.”
4. Press the “Enter” key once more.
5. A new window will pop up. Confirm the last restore point before the Scarab infection by clicking “Next”.
6. In the final step, click “Yes” to start the system restore.

After restoring your system, it’s still advisable that you use a reputable security program to scan your computer. This is to double-check that the Scarab removal process was successful.

Conclusion

Scarab is a dangerous file-encrypting ransomware that belongs to a large group of crypto-viruses that lock the victims’ files and make ransom demands. If you realize that your computer is infected, it’s advisable that you first remove the Scarab ransomware infection, and then fix the damage caused by the virus. As soon as the files are locked, they’re with a unique extension, after which a ransom note is sent to the victim. The most commonly locked files include pictures, videos, music files, and other documents.