A new ransomware, aimed at extorting users by encrypting their files and mocking them using the Rick Rolld meme has recently come out. The ransomware aims to append the .cryptoid file extension to the files encrypted by it and then drop a ransom note, aimed at getting victims to pay ransom in BitCoin to get their files recovered back to normal. If your computer has been infected by the RICKROLL LOCKER ransomware, we suggest you to read the article underneath.
|Name||.cryptoid Files Virus|
|Short Description||Aims to encrypt the files on your computer and then extort you to pay ransom to get them back.|
|Symptoms||Files are encrypted with an added .cryptoid file extension. Ransom notes, called CRYPTOID_BLOCKED.txt, CRYPTOID_HELP.txt and CRYPTOID_MESSAGE.txt are dropped.|
|Distribution Method||Spam Emails, Email Attachments, Executable files|
|Detection Tool|| See If Your System Has Been Affected by .cryptoid Files Virus |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .cryptoid Files Virus.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
.cryptoid RICKROLL LOCKER – Update April 2019
.cryptoid RICKROLL LOCKER – Infection
The main method via which the RICKROLL LOCKER ransomware virus infects computers is believed to be via malicious file that pretends to be a legitimate type of program or a game. Such files often pretend to be the following types of software:
- Torrent download.
- Portable version of program.
- Some type of license activator.
- Key Generator.
In addition to being uploaded online, the file may also be spread via being sent to victims by e-mail messages. Such spam e-mails often make the file seem it is an invoice, receipt, ticket, order confirmation or other type of important documents. The e-mails also contain convincing messages that you should open them, for example:
.cryptoid Files Virus – More Information
As soon as the .cryptoid ransomware infects your computer, the following file will be dropped and activated:
In addition to the tree.exe file, dropped in %appdata% directory, other files could also be dropped under different names in the following directories:
The RICKROLL LOCKER ransomware virus may also drop it’s ransom note files, named like the following:
The ransom notes have the following message:
SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit).
We STRONGLY RECOMMEND you NOT to use any “decryption tools”.
These tools can damage your data, making recover IMPOSSIBLE.
AIso we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.
If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here: firstname.lastname@example.org
Attach file is 000000000.key from %appdata% to email message.
Without it we will not be able to decrypt your files
And pay $400 on BTC-wallet Lex6qfkopz5wgbicrxpq4cALF S6yr8gLhx
Bf someone else offers you files restoring, ask him for test decryption.
only we can successfully decrypt your files; knowing this can protect you from fraud.
You will receive instructions of what to do next.
RICKROLL LOCKER – Encryption Process
Once it has infected your computer system, the .cryptoid RICKROLL LOCKER ransomware may start to encrypt files. The main files that are eligible for encryption are important files that are use quite often, such as:
- Audio files.
Once the RICKROLL LOCKER ransomware encrypts the files on your computer, the ransomware may immediately append the .cryptoid file extension, making the files to begin appearing like the following:
Remove RICKROLL LOCKER and Try Restoring .cryptoid Files
Before you even start to try and remove files, encrypted by RICKROLL LOCKER ransomware, we would advise you to do a backup, just in case.
In order for you to be able to remove the virus files, belonging to RICKROLL LOCKER ransomware, we suggest you to try the first two steps from the manual removal below. If they fail to remove the .cryptoid files virus, we would suggest what most cybersecurity experts would advise you in doing and that is to run a scan of your PC, using an advanced anti-malware software. These tools aim to detect and remove everything that is related to RICKROLL LOCKER from your computer and they also aim to seucure it against future infections by viruses, like this one.
If you want to try and recover files that have been encrypted by the RICKROLL LOCKER, we would sugges that you try the alternative methods for file recovery we have added underneath this article. They may not be able to help you to recover all your files, but with their aid, you might be able to restore at least some of them.