Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Trojan.Ransomcrypt.R Completely

Name Trojan.Ransomcrypt.R
Type Ransomware
Short Description Encrypts important user data and demands ransom in return.
Symptoms The user may have his files encrypted without his consent and may see a ransom note with instructions on how to pay for them.
Distribution Method Malicious Links Spam Mail
Detection Tool Download Malware Removal Tool, to See If Your System Has Been Affected by Trojan.Ransomcrypt.R
User Experience Join our forum to follow the discussion about the Trojan.Ransomcrypt Variants.

ransomware-file-encryptionIn case you have been infected by Trojan.Ransomcrypt.R, you may have a problem opening your files. Trojan.Ransomcrypt.R is a trojan horse from the Trojan.Ransomcrypt family and it aims to make money in return of decryption keys of encrypted user data. The R. variant uses a strong encryption algorithm. Security engineers advise users not to comply with the ransom note left by Troja.Ransomcrypt.R. What is also highly recommended is to scan the computer with an advanced anti-malware tool preferably in Safe Mode that will detect and remove all of the objects associated and try and decrypt the files using other methods for which you can find more information after this article.

Trojan.Ransomcrypt.R – How Did I Get Infected?

The primary method for infection this trojan may use is to attach documents and malicious files altogether in an email message. Such messages may be either a part of massive spam or targeted mail specifically to deceive the user of the infected computer. Either way it is highly advisable to use special software with active shields against online infections and spam and an email client that has such filters embedded.

Trojan.Ransomcrypt.R In Detail

According to Symantec ,once Trojan.Ransomcrypt.R is activated on your computer, the troubles begin for you. This particular Trojan is observed to be inserted onto your computer by other malware, most likely a Trojan.downloader. As soon after it has been executed, this trojan creates these files in the %Temp% user folder:

→a.qq; VAULT.txt; VAULT.hta; revault.js

It also creates the following files in the User profile folder:

→CONFIRMATION.KEY
Application Data\VAULT.KEY
Application Data\VAULT.hta
Application Data\Desktop\VAULT.KEY
Desktop\vault.txt
Desktop\vault.hta

The trojan also creates registry objects to run some of the previously created files on system startup:

→HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”vlt notify” = “mshta %UserProfile%\Application Data\VAULT.hta”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”tnotify” = “notepad %Temp%\VAULT.txt”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”vltexec” = “wscript //B //Nologo %Temp%\revault.js”
Besides the startup registry entries, the ransomware also makes other registry entries:
HKEY_CLASSES_ROOT\Vaulted\Shell\Open\Command\”|default|” = “mshta.exe vbscript:Execute(“msgbox “” STORED IN VAULT:””&vbNewLine&”” %1″”&vbNewLine&vbNewLine&ChrW(10139)&”” Visit for key: http://restoredz4xpmuqr.onion””&vbNewLine&vbNewLine&”” [accessible only via Tor Browser: http://torproject.org]””,16,””VaultCrypt [Permission Error: No Key]””:close”)”
HKEY_CLASSES_ROOT\.vault\”|default|” = “Vaulted”

After it has set every setting the trojan then proceeds with the act of encryption:

→xls ;doc ;rtf ;pdf ;psd ;dwg ;cdr ;cd ;mdb ;1cd ;dbf ;sqlite ;jpg ;zip ;7z

The trojan then encrypts the files with the .vault extension. An encrypted file may look similar to this:

→C:\ImportantDocument.doc.vault

The user tries to open the files they see a message that the file has been encrypted. After encrypting the files, the trojan launches an executable file named enigma.exe in the %Temp% folder that has been downloaded from this http location:

→tj2es2lrxelpknfp.onion.city

The downloaded file is reported to steal information from the web browsers of the user and to send them to the location it has been downloaded from.

Removing Trojan.Ransomcrypt.R from Your PC

One way to get rid of this threat is by following the step-by-step instructions below. In case you wish to remove it the tech savvy way, check some of the advises in the discussion in our forum here:
Also, here are some methods for trying and decrypting the encrypted data yourself. Bear in mind, that if the encryption is strong you may not be able to decrypt your files. However decryption may vary from several hours to days.

Methods to decrypt files:
http://sensorstechforum.com/restore-files-encrypted-via-rsa-encryption-remove-cryptowall-and-other-ransomware-manually/
http://sensorstechforum.com/remove-rsa-2048-encryption-key-from-cryptowall-3-0/

Best way to scan and remove malware topic:

http://sensorstechforum.com/forums/malware-removal-questions-and-guides/safe-way-to-scan-your-computer-and-detect-malware/

1. Boot Your PC In Safe Mode to isolate and remove Trojan.Ransomcrypt.R
2. Remove Trojan.Ransomcrypt.R with SpyHunter Anti-Malware Tool
3. Remove Trojan.Ransomcrypt.R with STOPZilla AntiMalware
4. Back up your data to secure it against attacks and file encryption by Trojan.Ransomcrypt.R in the future
NOTE! Substantial notification about the Trojan.Ransomcrypt.R threat: Manual removal of Trojan.Ransomcrypt.R requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.