Do you know what VapeLauncher is?
VapeLauncher is an extremely dangerous computer infection that can lock up most of your files and then demand that you pay a ransom fee. The program is part of a big crypto ransomware family, and you can be sure that the application is really good at what it does. On the other hand, it does not mean that you have to pay the ransom fee because paying does not mean the infection will automatically provide the decryption tool. The way out of this situation is to remove VapeLauncher from your computer and then invest in a reliable antispyware tool.
It goes without saying that the best protection against this infection is genuine prevention. For that, you need to know how this program spreads around. The most commonly used distribution method is spam email campaigns. It means that VapeLauncher and other similar applications enter target computer within spam email attachments. Users think that the malware installers are some important documents and open them without any second thought. Thus, it would be possible to avoid such infections if you were more careful about the attachments you download and open. If you are not sure whether a file is safe or not, you can always can it with a security application.
If VapeLauncher enters your computer, and you launch the installer, it is practically impossible to reverse the process. When you execute the malicious file, it automatically creates a copy of itself and leaves it in the %PROGRAMFILES(x86)% directory. The name of the file will be random, just as the installer’s filename. And the moment this program starts running on your computer, it will delete the Shadow Volume Copies. Shadow Volume Copies would allow you to restore most of your files with the help of a professional, but the ransomware needs to make sure you cannot do that, since it needs to be sure you would pay the ransom fee.
VapeLauncher screenshot
Scroll down for full removal instructions
When the encryption is complete, the infection generates a pop-up that appears on your screen. This pop-up displays a list of encrypted files. Aside from displaying the list, the program also keeps a file with the encrypted file names in the Common Files folder, the %ProgramFiles(x86)% directory. As you can see from the message on your screen, this program requires you to pay about $200USD in Bitcoints to retrieve your encrypted files. Does it mean that the application really issues the decryption key if users pay the ransom? That is highly debatable. Even if the program does intend to do so, we can never know when it loses connection with its control and command center because the proxy servers used for such connections are seldom stable.
VapeLauncher will use the AES-256 encryption algorithm to encrypt your files in the %USERPROFILE% directory. Every single affected file will have the .encrypted extension added to them. However, please bear in mind that the extension will not be added to the end of the filename. It will probably be in between the filename and the original extension. For example, image.encrypted.jpg. Needless to say, it will be impossible to open the encrypted files. It also possible that the files bigger than 30MB in size will not be encrypted by this program, yet we cannot be sure. It is very likely that the ransomware configuration can be changed along the way.
Another fact worth noting is that VapeLauncher tries its best to prevent you from restoring your files. As mentioned, it deletes the Shadow Volume Copies. Aside from that, the ransomware program also overwrites and deletes all the files from your Recycle Bin.
Is there a way to restore your files then? Yes, provided you have a file backup stored in some external or virtual storage device. Then you can remove VapeLauncher and delete all the encrypted files and then copy and paste the healthy files back into your computer. You may also have most of your recent files saved in your inbox or outbox, so please give it a thorough checkup before giving up.
Also, it is never too late to invest in an external hard drive where you could keep copies of your files. And when you remove VapeLauncher, do not forget to run a full system scan afterwards with a powerful antispyware application.
How to Delete VapeLauncher
- Open your Downloads folder and locate the malicious file.
- Delete the file and press Win+R simultaneously.
- Enter %ProgramFiles(x86)% and click OK.
- Go to the Common Files folder.
- Find the malicious executable file and remove it.
- Press Win+R and enter %WinDir% into the Open box.
- Click OK and go to System32\Tasks.
- Locate a 10-random-digit task file and remove it.
- Launch a full system scan with a security tool of your choice.
In non-techie terms:
It is hard to miss an infection like VapeLauncher. You will do yourself a favor if you remove this ransomware application from your system ASAP. It may not be possible to restore your affected files, but that should not stop you. Your job right now is to get rid of the infection. Please note that paying the ransom may not be the option because no one can guarantee the people behind the program would give you the decryption key even if you do pay. Thus, you should rely on a licensed security application to deal with the situation at hand.