Replacement for Gravity's RO patcher. Works faster and doesn't consume your entire memory for just seeing it crashing, aside from this, it works almost exactly as the official patcher does, so that it shouldn't break, unless Gravity changes something vital to their patcher. It is free of any cost and works on every 32-bit and 64-bit Microsoft. Windows. platform. If you get a new computer or update the hardware significantly, use the License Transfer Utility to export your license beforehand. After the hardware change, use the License Transfer Utility again to import the license file back to the machine. See Transfer Perpetual Licenses. Still need help?
RAGNAROK ransomware on a rise in 2020
Contents
- RAGNAROK ransomware on a rise in 2020
I've seen this twice now, randomly, while working. And yes, after 10 minutes Revit quits. I'm on subscription (or whatever it's called now) and am connected to the internet, working on cloud-hosted projects. I am one person working at home with one license. Any idea what causes this and how to. For years, my friend Judy owned an out-of-state driver's license. When she moved to New York for a temporary job, she ended up staying. To avoid the bureaucracy of New York’s DMV, every few.
RAGNAROK is a malicious ransomware-type virus which encrypts files on victim’s computer. The data encryption restricts access to these files. The virus marks affected files with .ragnarok extension and leaves a ransom note called !!ReadMe_To_Decrypt_My_Files.txt in every folder. The ransomware suggests contacting the attackers via [email protected], [email protected] or [email protected] to get a specific ransom price. The note threatens to make victim’s data public if the cybercriminals’ requirements aren’t followed.
RAGNAROK ransomware asks for approximately 1 Bitcoin for one infected PC, or 5 Bitcoins for computers on infected server. As specified in the ransom note, the attackers will specify an exact sum of money in Bitcoin after receiving victim’s ID.
Currently, there are no known ways to decrypt .ragnarok extension files for free. Victims who have data backups should remove the virus as soon as possible and restore data using external data storage devices.
Threat Summary
The behavior of the ransomware explained
Once executed on the target system, Ragnorak file virus first checks the language ID of Windows. It has a language exclusion list that shuts down the malicious process and doesn’t perform encryption if the victim’s PC is set to one of the listed languages:
- 0419 = Russia;
- 0423 = Belarus;
- 0444 = Russia;
- 0442 = Turkmenistan;
- 0422 = Ukraine;
- 042c = Azerbaijan;
- 0426 = Latvia;
- 043f = Kazakhstan;
- 0804 = China.
It must be noted that ransomware developers who are based in Russia or other CIS countries rarely exclude China.
If the ransomware detects any other language ID, it gives a greenlight for the attack to begin. The first thing that it does is attempt to disable Windows Defender by adding group policies in Windows Registry. The ransomware injects the following rules:
- HKLMSOFTWAREPoliciesMicrosoftWindows Defender “DisableAntiSpyware” = 1
- HKLMSOFTWAREPoliciesMicrosoftWindows DefenderReal-Time Protection “DisableRealtimeMonitoring” = 1
- HKLMSOFTWAREPoliciesMicrosoftWindows DefenderReal-Time Protection “DisableBehaviorMonitoring” = 1
- HKLMSOFTWAREPoliciesMicrosoftWindows DefenderReal-Time Protection “DisableOnAccessProtection” = 1
These attempts will be unsuccessful if the victim has Windows 10 Tamper Protection feature on.
Next, Ragnarok malware tries to delete Volume Shadow Copies (to prevent data recovery), then disables Windows auto startup repair feature, and turns off Windows Firewall by executing these commands via cmd:
- /c vssadmin delete shadows /all /quiet
- /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- /c bcdedit /set {current} recoveryenabled no
- /c netsh advfirewall set allprofiles state off
When the preparation tasks are completed, the ransomware begins data encryption. It uses AES encryption to generate the encryption key, which is then encrypted with a packed RSA4096 key. This ensures that only the virus’ developers can restore the encryption key.
The ransomware skips executive files, also .dll and .sys files, and the files that have already been encrypted by the virus (those with .ragnarok extension). As usual, the ransomware bypasses files essential for operating system to function.
The ransomware targets unpatched Citrix ADC servers
RAGNORAK virus is known to be targetting Citrix ADC servers with unpatched vulnerability which is known under CVE-2019-19781 code. Although the vulnerability is now patched, networks who fail to install the update are open to attacks and the said ransomware infection. The Citric vulnerability has also been exploited by Sodinokibi ransomware developers.
The EternalBlue vulnerability in Citrix ADC servers allow the attackers to perform arbitrary code execution remotely. In particular, the attacker can insert a specific DLL that is capable of downloading and launching Ragnorak ransomware payload on the computer or the whole computer network instantly.
Remove RAGNAROK ransomware virus safely
You must remove RAGNAROK ransomware virus and possibly related malware from your computer system as soon as possible. The easiest and safest way to root out such threats from Windows computer is by performing the removal in Safe Mode.
The tutorial below explains how to boot your PC in Safe Mode and run your security software from there. This will ensure a successful RAGNORAK removal.
When it comes to .ragnarok decryption, currently there are no tools that can recover files for free. In addition, we suggest being aware of scammers who might take your money and simply pay the ransomware developers instead of you. However, the security experts will keep investigating the virus and report back as soon as any routine flaws are noticed.
OUR GEEKS RECOMMEND
RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. If you decide to purchase the full version of software, it will fix detected issues automatically and might revert certain virus damage to your system.
RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any detections are found, the software will eliminate them. Learn more about the software's features in its full review.
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
RAGNAROK Ransomware Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove the virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it:
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart.Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove RAGNAROK Ransomware files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable malware removal program. In addition, we suggest trying System Mechanic Ultimate Defense, which includes data recovery tool and many other useful features.
Special Offer
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10 users
Your Using Outdated Licence File Ragnarok Tv
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart.Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
You Are Using Outdated License File Ragnarok
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Related posts:
- Remove ESCAL Ransomware (Virus Removal Guide) ESCAL ransomware descriptionContentsESCAL ransomware descriptionRansom note contents explainedRansomware distribution and...
- Remove QEWE Ransomware Virus (2021 Decrypt Guide) QEWE ransomware virus attacks personal files to demand ransom in...
- Remove REHA Ransomware Virus (2021 Guide) REHA ransomware is the 199th variant of DJVU file-encrypting virusContentsREHA...