Rpd Ransomware Removal Guide

Rpd Ransomware is a dangerous computer infection that will encrypt most of your files, and then it will demand that you pay ransom to get your files back. This is how encrypting ransomware infections work: They scare users by appearing suddenly, and then they lock their data, and they are not joking around. While it is not difficult to remove Rpd Ransomware from your computer, it might be more challenging to restore your files. If you have a file backup in an external hard drive, the problem is more or less solved. Nevertheless, you have to understand that you might say good-bye to some of your files.

According to our research team, Rpd Ransomware is another variant of the first Rapid Ransomware infection, and this new version uses the AES encryption algorithm to lock up target files. Just like its predecessor, this program encrypts almost every single file extension, but it does not touch Windows system files. In other words, the infection still needs your system to function properly so that you could transfer the ransom fee. Even after the infection, your computer would still work, but you will not be able to access your files.

It is very likely that Rpd Ransomware spreads through spam email attachments, so it means that users download and install the infection themselves. Spam email messages that distribute ransomware programs trick users into thinking that the attachment in question is a very important file, and users simply must open it. Therefore, security experts always emphasize that it would be a good idea to scan the downloaded files with a security tool before opening them. Also, you should ask yourself whether you really have been expecting a certain email message before you open the attached file. Perhaps the message is completely random, and it has nothing to do with you?

Either way, if you get infected with Rpd Ransomware, this program automatically deletes Shadow Volume Copies, making it impossible to restore the files without an external backup. Then it creates a copy of itself in the %APPDATA% directory, and there is also a Point of Execution for the file, as well as for the ransom note. It means that even if you restart your computer, the program will auto-start with your system and the ransom note will be displayed automatically.

The ransom note says the following:

Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email – asgard2018@cock.li
and tell use your unique ID – [ID-XXXXXXXX]

As you can see, there is no ransom fee indicated in the note, but you can be sure that the criminals will notify you about it once they reply to your message. Does it mean that you need to pay the ransom? Absolutely not, you have to remove Rpd Ransomware from your system following the instructions below immediately.

If you have an external file backup, delete the encrypted files and then transfer the healthy ones back into your computer. However, make sure that your system is absolutely clean before you transfer the files back. So use a powerful security tool to secure your PC.

How to Remove Rpd Ransomware

1. Press Win+R and type %WinDir%. Click OK.
2. Go to System32/Tasks.
3. Delete the Encrypter file from the folder.
4. Go to your Downloads folder.
5. Delete the most recently downloaded files.
6. Press Win+R and type %AppData%. Click OK.
7. Remove the copy of the ransomware file and the ransom note.
8. Press Win+R and type regedit. Click OK.
9. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
10. On the right pane, right-click and delete these values:
    :Ecrypter_074
    :userinfo
11. Scan your computer with SpyHunter.