Crptxxx Ransomware – Remove and Restore .Crptxxx Files

Crptxxx Ransomware – Remove and Restore .Crptxxx Files

This article will help you remove Crptxxx ransomware completely. Follow the ransomware removal instructions at the bottom of the article.

Crptxxx is a ransomware cryptovirus that uses a User Account Control bypass to prevent Windows from seeing that it is an unauthorized application and from blocking its access to your computer. Malware researchers have seen the malware active in the wild. Your files will become encrypted and the Crptxxx cryptovirus will encrypt your files, supposedly with the AES algorithm. Keep reading below to see how you could potentially try to recover some of your files.

Threat Summary

Short DescriptionThe ransomware encrypts files on your computer and demands payment for unlocking them.
SymptomsThe ransomware will encrypt your files and put the extension .crptxxx after it finishes its encryption process.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Crptxxx


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Crptxxx.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Crptxxx Ransomware – Infection Spread

The Crptxxx ransomware could spread its infection via different methods. A payload file that initiates the malicious script for this ransomware, which in turn infects your computer machine, is circling the Internet and a few active malware samples have been found by malware researchers. You can see the VirusTotal detections of different security vendors for one of those samples by checking the below screenshot:

Crptxxx ransomware might also deliver its payload file on social media networks and file-sharing services. Freeware that is found on the Web could be presented as helpful but at the same time might hide the malicious script for the virus in question. Refrain from opening right after you have downloaded them, especially if they come from sources like suspicious e-mails and links. Before opening such files, you should first scan them with some security tool, while also doing a check of the size and signatures of the files for anything that seems unusual. You should read the tips for ransomware prevention written in the forum section.

Crptxxx Ransomware – More Information

Crptxxx is a cryptovirus of the ransomware variety. The virus uses a UAC (User Account Control) bypass to prevent Windows from alerting you that it is an unauthorized application and from blocking its access to your computer device. Files will get encrypted with a custom-made extension, which is .crptxxx.

Crptxxx ransomware could make entries in the Windows Registry to achieve persistence, launch and repress processes in Windows. Some entries are designed in a way that will start the virus automatically with each launch of the Windows Operating System, such as the example given right here below:


The ransom note will be placed in your computer system after the encryption process is complete. The note is written in English and gives details about how to contact the criminals behind the ransomware. The note is inside a file named HOW_TO_FIX_!.txt.

The name of the ransom note had another two variants in the past, which were:

  • README.txt

You can view the ransom note that appears after the file encryption process right here:

That ransom note reads the following:

All your files have been encrypted with AES
If you want to restore them, use this instructions:
1) Download tor browser
2) Run tor and go to: http://dokg5gcojuswihof.onion
Or you can use tor2web services
In login panel enter your personal ID: %id%
Follow next instructions on website
If server is down – try connect later
!! Decoders from other users are not compatible with your data, because each users unique encryption key !!
!! Do not try to decrypt your data using third party software, it may cause permanent data loss. !!

The note of the Crptxxx ransomware states that your files are encrypted and to get them back you have to use the services of the TOR network. This is how those TOR pages look like:

A sum for the ransom payment is not specified, but can be found on the tor2web pages provided inside the ransom note. However, you should NOT under any circumstance pay these cybercriminals. Your files may not get recovered, and nobody could give you a guarantee for that. To add to that, note that if you provide money to these criminals, they will likely get motivated to create more ransomware or do other criminal activities.

Crptxxx Ransomware – Encryption Process

The complete list with file extensions that the Crptxxx ransomware seeks to encrypt is provided down below. File with around 100 different extensions will get encrypted and those are:

→.1c, .3fr, .accdb, .ai, .arw, .bac, .bay, .bmp, .cdr, .cer, .cfg, .config, .cr2, .crt, .crw, .css, .csv, .db, .dbf, .dcr, .der, .dng, .doc, .docm, .docx, .dwg, .dxf, .dxg, .eps, .erf, .gif, .htm, .html, .indd, .iso, .jpe, .jpeg, .jpg, .kdc, .lnk, .mdb, .mdf, .mef, .mk, .mp3, .mp4, .mrw, .nef, .nrw, .odb, .ode, .odm, .odp, .ods, .odt, .orf, .p12, .p7b, .p7c, .pdd, .pdf, .pef, .pem, .pfx, .php, .png, .ppt, .pptm, .pptx, .psd, .pst, .ptx, .r3d, .rar, .raw, .rtf, .rw2, .rwl, .sql, .sr2, .srf, .srw, .tif, .wb2, .wma, .wpd, .wps, .x3f, .xlk, .xls, .xlsb, .xlsm, .xlsx, .zip

Every file that gets encrypted will receive the same extension appended to itself, and that is the .crptxxx extension. Presumably, your data will get encrypted with the AES encryption algorithm, if the statement about that in the ransom note is true.

The Crptxxx virus is very likely to erase the Shadow Volume Copies from the Windows operating system by utilizing the following command:

→vssadmin.exe delete shadows /all /Quiet

If that command is executed, the encryption process will be more impactful, leaving very few options for the recovery of the locked data. Read on through and check out what kinds of ways you can try to potentially restore some of your files.

Remove Crptxxx Ransomware and Restore .Crptxxx Files

If your computer got infected with the Crptxxx ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share