How to remove Rapid (2.0) Ransomware and decrypt .rapid or .paymeme files

What is Rapid Ransomware

Rapid Ransomware is nasty virus, that encrypts user files using AES encryption algorithm and demands ransom for decryption. All affected files get .rapid extension, in some versions .paymeme suffix is added. Rapid 2.0 Ransomware appends extensions, that contains 5 random letters in uppercase. Extension is unique for every PC. Unlike other similar ransomware threats, it does not do one-time encryption, but continues to encode every new file on victims computer, whether it was just created or copied. That is why, it is strongly NOT recommended to plug in any removable drives. After initial encryption, Rapid Ransomware creates text file ! How Recovery Files.txt with following message:

ALL YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!

=================================================

Rapid 2.0 Ransomware has different note:

- ALL YOUR FILES ARE ENCRYPTED BY RAPID 2.0 RANSOMWARE -
Dont worry, you can return all your files!
Attention!
All your files documents, photos, databases and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase a Rapid Decryptor.
This software will decrypt all your encrypted files and will delete Rapid from your PC.
To get this software you need write on our e-mail:
1. supp1decr@cock.li
2. supp2decr@cock.li (if first email unavailable)
What guarantees do we give to you?
You can send one of your encrypted file from your PC and we decrypt him for free.
But we can decrypt only 1 file for free. File must not contain valuable information
Attention!
Dont try to use third-party decryptor tools because it will destroy your files.


Amount of ransom varies from $500 to $1500 and have to be paid in BitCoins. Using BitCoin payments and TOR websites, makes it difficult to find location of malefactors. Rapid 2.0 Ransomware does not encrypt files if it detects the Russian version of Windows. In order to prevent decryption and strengthen harmful effect Rapid Ransomware removes shadow copies of files, adds itself to the system’s startup to encrypt new files after rebooting the PC. It also ends the processes sql.exe, sqlite.exe, oracle.com, if they are running on the system. However, using instructions below you will be able to remove Rapid Ransomware and decrypt .rapid or .paymeme files with special tips and tricks we describe.

How Rapid Ransomware infected your PC

Rapid Ransomware uses spam mailing with malicious .docx attachments. Such attachments have malicious macros, that runs when user opens the file. This macros downloads executable from the remote server, that, in its turn, starts encryption process. After encryption, the shadow copies of the files are deleted by the command: vssadmin.exe vssadmin delete shadows /all /quiet. Virus assigns certain ID with the victims, that is used to name those files and supposedly to send decryption key. In order to prevent infection with this type of threats in future we recommend you to use SpyHunter 5 or Norton Antivirus.

Download Rapid Ransomware Removal Tool

To remove Rapid Ransomware completely, we recommend you to use Norton Antivirus from Symantec. It detects and removes all files, folders and registry keys of Rapid Ransomware.

How to remove Rapid Ransomware manually

It is not recommended to remove Rapid Ransomware manually, for safer solution use Removal Tools instead.

Rapid Ransomware files:

!!! README !!!.txt
! How Recovery Files.txt
recovery.txt
info.exe
mstsc.exe

Rapid Ransomware registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Encrypter"="%AppData%\info.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "userinfo"="%AppData%\recovery.txt"

How to decrypt and restore .rapid or .paymeme files

Use automated decryptors

Use following tool from Kaspersky called Rakhni Decryptor, that can decrypt .rapid or .paymeme files. Download it here:

There is no purpose to pay the ransom, because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

If you are infected with Rapid Ransomware and removed it from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:

Use Stellar Phoenix Data Recovery Pro to restore .rapid or .paymeme files

1. Download Stellar Phoenix Data Recovery Pro.
2. Select location to scan for lost files and click Scan button.
3. Wait until Quick and Deep scans finish.
4. Preview found files and restore them.

Using Windows Previous Versions option:

1. Right-click on infected file and choose Properties.
2. Select Previous Versions tab.
3. Choose particular version of the file and click Copy.
4. To restore the selected file and replace the existing one, click on the Restore button.
5. In case there is no items in the list choose alternative method.

Using Shadow Explorer:

1. Download Shadow Explorer program.
2. Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
3. Select the drive and date that you want to restore from.
4. Right-click on a folder name and select Export.
5. In case there are no other dates in the list, choose alternative method.

If you are using Dropbox:

1. Login to the DropBox website and go to the folder that contains encrypted files.
2. Right-click on the encrypted file and select Previous Versions.
3. Select the version of the file you wish to restore and click on the Restore button.

How to protect computer from viruses like Rapid Ransomware in future

1. Get special anti-ransomware software

Use ZoneAlarm Anti-Ransomware

ZoneAlarm Anti-Ransomware Dashboard

ZoneAlarm Anti-Ransomware Alert

ZoneAlarm Anti-Ransomware Blocked

Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.

2. Back up your files

Regardless of success of protection against ransomware threats, you can save your files using simple online backup. Cloud services are quite fast and cheap nowadays. There is more sense using online backup, than creating physical drives, that can get infected and encrypted when connected to PC or get damaged from dropping or hitting. Windows 10 and 8/8.1 users can find pre-installed OneDrive backup solution from Microsoft. It is actually one of the best backup services on the market, and has reasonable pricing plans. Users of earlier versions can get acquainted with it here. Make sure to backup and sync most important files and folders in OneDrive.

3. Do not open spam e-mails and protect your mailbox

Malicious attachments to spam or phishing e-mails is most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications, and provides very high level of anti-spam protection.