How to Kill Rapid Ransomware (Crypto-Malware/Ransomware)

What is Rapid ransomware? And how does it carry out its attack?

A new Rapid ransomware variant was released recently which uses the .RPD extension in marking its encrypted files. This new malware strain follows the Rapid 3 variant which was released not too long ago in May 2018. Just like its predecessor, this new variant will drop its malicious payload in the system and downloads more malicious files and drop them into system folders. This allows Rapid ransomware to launch and repress processes in the Windows environment. In addition, it also alters some registry keys and sub-keys which allows it to run automatically on every system boot.
After the changes are applied, Rapid ransomware scans the computer for the very same files which have the following extensions:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip
Once it finds files with the extensions listed above, Rapid ransomware will begin the encryption process by applying the AES encryption algorithm. After the encryption, it adds the .RPD suffix to each one of the compromised files. It then displays its ransom note stating:
“[ RAPID RANSOMWARE ] Hello, dear friend!
All your files have been ENCRYPTED
The only way to decrypt your files is to receive the private key and decryption program.
To get the key and decryption program see instruction below:

Download Tor browser – https://www.torproject.org/
Install Tor browser
Run Tor Browser
In the Tor Browser open website: http://vgon3ggilr4vu32q.onion/?id=BTC

Note! This page available via Tor Browser only!

Follow the instruction at this website

On our page, you can see all the instruction how to decrypt your system and decrypt for free 1 file!
ATTENTION!
Do not try to decrypt your data using third-party software, it may cause permanent data loss.”
If you are one of the unfortunate users who got infected with this new Rapid variant, you must not follow the instructions on its ransom note as it could only lead you to the crooks behind this threat, which will demand a huge ransom from you. The best way to deal with this kind of threat is by killing its processes and malicious components from your computer and try alternative ways to recover your files.
How is the malicious payload of Rapid ransomware distributed?
Like other Rapid variants, the malicious payload for this one might also be distributed using malicious spam email campaigns. Thus, you have to be more cautious in downloading attachments from emails no matter who sent them as crooks tend to disguise their malware-laden emails to trick users into opening them.
Carefully follow each one of the removal instructions given below to kill Rapid ransomware from your computer.
Step 1: Tap the Ctrl + Alt + Delete keys to open a menu and then expand the Shut down options which is right next to the power button.
Step 2: After that, tap and hold the Shift key and then click on Restart.
Step 3: And in the Troubleshoot menu that opens, click on the Advanced options and then go to the Startup settings.
Step 4: Click on Restart and tap F4 to select Safe Mode or tap F5 to select Safe Mode with Networking.
Step 5: After your PC has successfully rebooted, tap Ctrl + Shift + Esc to open the Task Manager.

Step 6: Go to the Processes tab and look for rapid.exe or info.exe and then end its process.

Step 7: Exit the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.

Step 8: Look Rapid Ransomware and then uninstall it.

Step 9: Close Control Panel and tap Win + E keys to open File Explorer.
Step 10: Navigate to the following locations and look for the malicious components created by Rapid ransomware such as [random].exe and rapid.exe as well as other files associated to this threat and make sure to delete them all.

%APPDATA%
%TEMP%
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 11: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use [product-name], this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 12: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 13: Navigate to the listed paths below and look for the registry keys and sub-keys created by Rapid ransomware.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
HKEY_CURRENT_USER\Control Panel\Desktop

Step 14: Delete the registry keys and sub-keys created by Rapid ransomware such as info.exe.
Step 15: After that, close the Registry Editor and empty the Recycle bin.
You need to continue the removal process of Rapid ransomware using a reliable program like [product-name] after you’ve covered the steps provided above. How? Follow the advanced removal steps below.
Perform a full system scan using [product-code]. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in the URL address, [product-url] in the Run dialog box and then tap Enter or click OK.
After that, it will download the program. Wait for the download to finish and then open the launcher to install the program.
Once the installation process is completed, run [product-code] to perform a full system scan.