AIR Ransomware Removal Guide

You might invite AIR Ransomware into your Windows operating system by opening malicious email attachments or downloading unreliable files offered on suspicious websites. Unfortunately, cybercriminals are smart, and they know the tricks that can help them fool gullible Windows users into letting malware in. Once inside the system, the ransomware effectively hides itself by changing the location. So, even if you realize that the file you downloaded was not what you expected it to be, you might have a hard time locating and removing it. According to our researchers, the .exe file is moved to the %WINDIR% directory, and its name is random. The file is moved only after it performs encryption on all of your personal files, and if that is done successfully, unfortunately, you might never get them back. When we analyzed this malware, a legitimate decryptor did not exist, and you could not restore files by deleting AIR Ransomware.

You can see which personal files AIR Ransomware has encrypted by glancing at their names because the ".{number}.ex_parvis@aol.com.AIR" extension must be appended. Documents, images, videos, music files, and archives – among many other types of files – can become unreadable. The threat specifically avoids the folders that contain system files, but those that contain personal files are hit hard. On top of that, the infection deletes shadow volume copies, and so even if you have a system restore point, you will not be able to use it to get your files back. In fact, when it comes to backup, it appears that your files are safe only if you have copies of personal files stored online or on external drives. If you do, all you need to worry about is the removal of AIR Ransomware and the protection of your Windows operating system. Of course, you want to access your backups and replace the corrupted files only after you remove the threat.

AIR Ransomware creates two files. One of them is called “Tulips.jpg,” and you should find it next to the launcher file, in %WINDIR%. This file is meant to be set as the Desktop wallpaper, and it displays a text message that is the shortened version of the message represented via “TRY_TO_READ.html.” This file is likely to be dropped on the Desktop, and you can safely open it before removing it. This message informs that files were encrypted and that the victim needs to send a unique ID number to one of three email addresses (ex_parvis@aol.com, ex_parvis@tutanota.com, or ex_parvis@protonmail.com) to decrypt the files. Obviously, your files would not be magically restored if you sent an email. The attackers would quickly respond with additional instructions, and these are likely to push you to pay money. This is why we classify the infection as “ransomware.” Obviously, if you have backups, you do not need to pay attention to the demands of AIR Ransomware creators at all, but even if you cannot replace your files, we do not recommend communicating with the attackers or paying money. Most likely, that would be a complete waste of your savings.

Since we know the location of AIR Ransomware, removing this malware manually appears to be completely doable. All you have to do is remove the launcher and the two additional files that are used to deliver the attackers’ message. If you are not able to follow the instructions below, you do not need to perform manual removal. Instead, you can install an anti-malware tool that will take care of this automatically. In fact, this is the superior option because besides cleaning your system – and there could be other threats that require it – it would also enable reliable protection. Without a doubt, if you want to see your system malware-free in the future, you need full protection. You also need to be prepared for cyber attacks that could happen in the future, and storing backups outside the computer is part of that. If there is anything at all that you would like to ask or discuss further, the comments section is open, and you should not hesitate to use it.

How to delete AIR Ransomware

1. Launch Explorer by tapping Win and E keys at once.
2. Type %WINDIR% into the quick access field at the top and tap Enter.
3. Right-click the file named Tulips.jpg and choose Delete.
4. Right-click the [unique name].exe file (the launcher) and choose Delete.
5. Now move to the Desktop.
6. Right-click the file named TRY_TO_READ.html and choose Delete.
7. Exit Explorer and Empty Recycle Bin.
8. Install and run a malware scanner that will be able to determine if or not your system is clean.