Remove Trojan.Ransomcrypt.R Completely - How to, Technology and PC Security Forum |

Remove Trojan.Ransomcrypt.R Completely


with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by Trojan.Ransomcrypt.R and other threats.
Threats such as Trojan.Ransomcrypt.R may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

Short DescriptionEncrypts important user data and demands ransom in return.
SymptomsThe user may have his files encrypted without his consent and may see a ransom note with instructions on how to pay for them.
Distribution MethodMalicious Links Spam Mail
Detection ToolDownload Malware Removal Tool, to See If Your System Has Been Affected by Trojan.Ransomcrypt.R
User ExperienceJoin our forum to follow the discussion about Trojan.Ransomcrypt.R.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

ransomware-file-encryptionIn case you have been infected by Trojan.Ransomcrypt.R, you may have a problem opening your files. Trojan.Ransomcrypt.R is a trojan horse from the Trojan.Ransomcrypt family and it aims to make money in return of decryption keys of encrypted user data. The R. variant uses a strong encryption algorithm. Security engineers advise users not to comply with the ransom note left by Troja.Ransomcrypt.R. What is also highly recommended is to scan the computer with an advanced anti-malware tool preferably in Safe Mode that will detect and remove all of the objects associated and try and decrypt the files using other methods for which you can find more information after this article.

Trojan.Ransomcrypt.R – How Did I Get Infected?

The primary method for infection this trojan may use is to attach documents and malicious files altogether in an email message. Such messages may be either a part of massive spam or targeted mail specifically to deceive the user of the infected computer. Either way it is highly advisable to use special software with active shields against online infections and spam and an email client that has such filters embedded.

Trojan.Ransomcrypt.R In Detail

According to Symantec ,once Trojan.Ransomcrypt.R is activated on your computer, the troubles begin for you. This particular Trojan is observed to be inserted onto your computer by other malware, most likely a Trojan.downloader. As soon after it has been executed, this trojan creates these files in the %Temp% user folder:

→a.qq; VAULT.txt; VAULT.hta; revault.js

It also creates the following files in the User profile folder:

Application Data\VAULT.KEY
Application Data\VAULT.hta
Application Data\Desktop\VAULT.KEY

The trojan also creates registry objects to run some of the previously created files on system startup:

→HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”vlt notify” = “mshta %UserProfile%\Application Data\VAULT.hta”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”tnotify” = “notepad %Temp%\VAULT.txt”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”vltexec” = “wscript //B //Nologo %Temp%\revault.js”
Besides the startup registry entries, the ransomware also makes other registry entries:
HKEY_CLASSES_ROOT\Vaulted\Shell\Open\Command\”|default|” = “mshta.exe vbscript:Execute(“msgbox “” STORED IN VAULT:””&vbNewLine&”” %1″”&vbNewLine&vbNewLine&ChrW(10139)&”” Visit for key: http://restoredz4xpmuqr.onion””&vbNewLine&vbNewLine&”” [accessible only via Tor Browser:]””,16,””VaultCrypt [Permission Error: No Key]””:close”)”
HKEY_CLASSES_ROOT\.vault\”|default|” = “Vaulted”

After it has set every setting the trojan then proceeds with the act of encryption:

→xls ;doc ;rtf ;pdf ;psd ;dwg ;cdr ;cd ;mdb ;1cd ;dbf ;sqlite ;jpg ;zip ;7z

The trojan then encrypts the files with the .vault extension. An encrypted file may look similar to this:


The user tries to open the files they see a message that the file has been encrypted. After encrypting the files, the trojan launches an executable file named enigma.exe in the %Temp% folder that has been downloaded from this http location:


The downloaded file is reported to steal information from the web browsers of the user and to send them to the location it has been downloaded from.

Removing Trojan.Ransomcrypt.R from Your PC

One way to get rid of this threat is by following the step-by-step instructions below. In case you wish to remove it the tech savvy way, check some of the advises in the discussion in our forum here:
Also, here are some methods for trying and decrypting the encrypted data yourself. Bear in mind, that if the encryption is strong you may not be able to decrypt your files. However decryption may vary from several hours to days.

Methods to decrypt files:

Best way to scan and remove malware topic:

1. Boot Your PC In Safe Mode to isolate and remove Trojan.Ransomcrypt.R
2. Remove Trojan.Ransomcrypt.R with SpyHunter Anti-Malware Tool
3. Remove Trojan.Ransomcrypt.R with STOPZilla AntiMalware
4. Back up your data to secure it against attacks and file encryption by Trojan.Ransomcrypt.R in the future
NOTE! Substantial notification about the Trojan.Ransomcrypt.R threat: Manual removal of Trojan.Ransomcrypt.R requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share