.cryptoid Files Virus (RICKROLL LOCKER) - How to Remove It

.cryptoid Files Virus (RICKROLL LOCKER) – How to Remove It

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article has been created to explain to you how you can remove the .cryptoid files virus from your computer and how you can restore files encoded by RICKROLL LOCKER.

A new ransomware, aimed at extorting users by encrypting their files and mocking them using the Rick Rolld meme has recently come out. The ransomware aims to append the .cryptoid file extension to the files encrypted by it and then drop a ransom note, aimed at getting victims to pay ransom in BitCoin to get their files recovered back to normal. If your computer has been infected by the RICKROLL LOCKER ransomware, we suggest you to read the article underneath.

Threat Summary

Name.cryptoid Files Virus
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on your computer and then extort you to pay ransom to get them back.
SymptomsFiles are encrypted with an added .cryptoid file extension. Ransom notes, called CRYPTOID_BLOCKED.txt, CRYPTOID_HELP.txt and CRYPTOID_MESSAGE.txt are dropped.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .cryptoid Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .cryptoid Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.cryptoid RICKROLL LOCKER – Update April 2019

Update! A decryption tool is now available for .cryptoid Files Virus! The tool was created by EMSIsoft and can be downloaded from the following link, wrapped inside an .exe file: decrypt_Aurora.exe. The tool is designed to decrypt the following variants of the cryptovirus: .ONI, .desu, .Aurora, .aurora, .Nano, .Animus and .cryptoid.

.cryptoid RICKROLL LOCKER – Infection

The main method via which the RICKROLL LOCKER ransomware virus infects computers is believed to be via malicious file that pretends to be a legitimate type of program or a game. Such files often pretend to be the following types of software:

  • Torrent download.
  • Portable version of program.
  • Some type of license activator.
  • Crack.
  • Patch.
  • Key Generator.

In addition to being uploaded online, the file may also be spread via being sent to victims by e-mail messages. Such spam e-mails often make the file seem it is an invoice, receipt, ticket, order confirmation or other type of important documents. The e-mails also contain convincing messages that you should open them, for example:

.cryptoid Files Virus – More Information

As soon as the .cryptoid ransomware infects your computer, the following file will be dropped and activated:

→ Name:tree.exe

In addition to the tree.exe file, dropped in %appdata% directory, other files could also be dropped under different names in the following directories:

  • %AppData%
  • %Local%
  • %Roaming%
  • %Temp%
  • %LocalLow%

The RICKROLL LOCKER ransomware virus may also drop it’s ransom note files, named like the following:


The ransom notes have the following message:

SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit).
We STRONGLY RECOMMEND you NOT to use any “decryption tools”.
These tools can damage your data, making recover IMPOSSIBLE.
AIso we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.
If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here: rickastley@keemail.me
Attach file is 000000000.key from %appdata% to email message.
Without it we will not be able to decrypt your files
And pay $400 on BTC-wallet Lex6qfkopz5wgbicrxpq4cALF S6yr8gLhx
Bf someone else offers you files restoring, ask him for test decryption.
only we can successfully decrypt your files; knowing this can protect you from fraud.
You will receive instructions of what to do next.

RICKROLL LOCKER – Encryption Process

Once it has infected your computer system, the .cryptoid RICKROLL LOCKER ransomware may start to encrypt files. The main files that are eligible for encryption are important files that are use quite often, such as:

  • Documents.
  • Videos.
  • Images.
  • Audio files.
  • Others.

Once the RICKROLL LOCKER ransomware encrypts the files on your computer, the ransomware may immediately append the .cryptoid file extension, making the files to begin appearing like the following:

Remove RICKROLL LOCKER and Try Restoring .cryptoid Files

Before you even start to try and remove files, encrypted by RICKROLL LOCKER ransomware, we would advise you to do a backup, just in case.

In order for you to be able to remove the virus files, belonging to RICKROLL LOCKER ransomware, we suggest you to try the first two steps from the manual removal below. If they fail to remove the .cryptoid files virus, we would suggest what most cybersecurity experts would advise you in doing and that is to run a scan of your PC, using an advanced anti-malware software. These tools aim to detect and remove everything that is related to RICKROLL LOCKER from your computer and they also aim to seucure it against future infections by viruses, like this one.

If you want to try and recover files that have been encrypted by the RICKROLL LOCKER, we would sugges that you try the alternative methods for file recovery we have added underneath this article. They may not be able to help you to recover all your files, but with their aid, you might be able to restore at least some of them.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share