.infovip@airmail.cc Files Virus (Scarab) – How to Remove and Restore Data

.infovip@airmail.cc Files Virus (Scarab) – How to Remove and Restore Data

This article has been created in order to best explain to you how you can remove the .infovip@airmail.cc version of the recently updated Scarab ransomware virus and show you how you can recover files, encrypted by this virus on your computer.

A new version of the notorious Scarab ransomware virus has appeared, following the recent wave of Scarab virus variants hitting the web. The malware aims to encrypt the files on the computers that are infected by it and then get victims to read it’s text file, called “HOW TO RECOVER ENCRYPTED FILES-infovip@airmail.cc.txt”, which aims to convince victims that they must pay a hefty ransom fee in BitCoin in order to recover the encrypted files. If you are one of the victims of this version of Scarab Ransomware, we advise that you read this article and learn how you can remove this virus from your computer and how you can restore the encrypted files by it.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on your computer and make you pay a hefty ransom to decrypt those files.
SymptomsFiles are encrypted and no longer able to be opened and to them, the file extension .infovip@airmail.cc.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .infovip@airmail.cc


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .infovip@airmail.cc.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.infovip@airmail.cc Virus – Distribution

In order to effectively infect the computers of users, the Scarab ransomware virus may come in your computer as a result of malicious spammed e-mails, created in order to send you various types of messages, that pretend to be a lot of different seemingly legitimate files. These types of files often pretend to be invoices, receipts or other files that look as if they come from big companies. The often used companies by the crooks are PayPal, DHL, FedEx and other big names and they also take advantages of random events, such as GDPR or the World Cup 2018, for instance.

In addition to this, the ransomware may also come on your computer by other, more passive means, instead via e-mail. These methods include uploading the file on third-party websites, including sites that aim to get victims to download and open it. To reach this goal, the file usually may pretend to be:

  • Setup of a program.
  • Game patch or software crack.
  • License activator.
  • Key generator.
  • Portable program.

Scarab Ransomware – Analysis

Similar to it’s previous versions, the Scarab ransomware aims to drop it’s payload after infecting your PC. The malicious payload files of this virus may exist in the following Windows directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %SystemDrive%
  • %Temp%

Scarab Ransomware is the type of malware which aims to extort you in return for your files. To reach it’s goals, the malware creates mutexes and other types of objects on your computer, that allow it to act as an administrator. These tasks may include:

  • Mutex creation.
  • Interfering with Windows system files.
  • Interfering with Windows Registry Editor.
  • Creating scheduled tasks.

In addition to this, the .infovip@airmail.cc files variant of Scarab ransomware may also drop it’s ransom note. It’s called “HOW TO RECOVER ENCRYPTED FILES-infovip@airmail.cc.txt” and it’s main purpose is to get victims to pay the ransom. The note has the following message:

The file is encrypted with the RSA-2048 algorithm, only we can decrypt the file.
Your files are encrypted!
Your personal identifier:
[redacted hex] ====================================================================================================
To decrypt files, please contact us by email:
The file is encrypted with the RSA-2048 algorithm, only we can decrypt the file.

Furthermore, Scarab ransomware may also delete the files on your computer possibly by executing a script which inserts the following command and enters it in Windows Command Prompt in the backgorund without you noticing:

Scarab Ransomware – Encryption Process

The encryption process of this virus is conducted with the aid of Rivest-Shamir-Adleman encryption algorithm(RSA) with a 2048 bit strenght. This basically means that each file contains a part of it that is encrypted, enough that it renders the targeted file to no longer be able to be opened on the victim’s computer. Te files that are encrypted on the victim PC are reported to be of the following file types:

  • Documents (Microsoft Office, Adobe Reader, etc.).
  • Image files (.jpg, .png, .bmp).
  • Video files (.avi, .mp4).
  • Audio files (.mp3, .wav).
  • Archives (.7z, .rar).
  • Other files, associated with often used programs.

The files, that are encrypted by this ransomware are no longer able to be opened by the users and they are appended the e-mail of the cyber-criminals as a file extension:

Remove Scarab Ransomware and Restore .infovip@airmail.cc Files

In order to remove this ransomware virus from your computer, we advise that you read the following article. It aims to help you by explaining you how you can remove the malicious files of this virus either automatically or manually. If manual removal is not something you feel confident in, it Is strongly advisable to remvoe this variant of Scarab ransomware automatically from your computer. The most effective way of removal according to security researchers is believed to be via downloading and installing an advanced anti-malware software on your computer which will scan for and remove any malicious files that are detected on your PC and furthermore make sure to ensure that your computer stays protected in the future as well.

In addition to this, if you want to restore the files that have been encrypted by this ransomware infection on your computer, it is advisable that you try the recovery methods underneath in step “2. Restore files, encrypted by .infovip@airmail.cc Virus”. They may not be 100% effective, but may help you to restore as many files as possible.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share