|Short Description||Encrypts important user data and demands ransom in return.|
|Symptoms||The user may have his files encrypted without his consent and may see a ransom note with instructions on how to pay for them.|
|Distribution Method||Malicious Links Spam Mail|
|Detection Tool||Download Malware Removal Tool, to See If Your System Has Been Affected by Trojan.Ransomcrypt|
|User Experience||Join our forum to follow the discussion about Trojan.Ransomcrypt.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Trojan.Ransomcrypt is a Trojan horse that creates several different files in an infected computer and once it has control over the victim PC, scans for and encrypts imprortant data from the user. It has several different variants – T, S, R and the primary Trojan.Ransomcrypt version. The specific strength of this trojan is that it can scan for a wider range of file formats than other ransomware viruses. Experts advise affected users to immediately follow the instructions provided on the bottom of this page. It is highly recommended to remove any files that this trojan has created on the computer as fast as possible and try to decrypt their files using some of the methods linked at the end of this article.
Trojan.Ransomcrypt – How Did I Get Infected
The Trojan.Ransomcrypt variants are primarily distributed via spam mail campaigns. A spam email may contain several different files and resemble different reputable services that may fool users to think they are perfectly safe by resembling a reputable company or a person as a sender. One good example was the Windows 10 Fake Upgrade email spam. Users are strongly advised to beware and use external mail software that has spam filters. Microsoft Outlook and Mozilla Thunderbird are one of the most preferred email address managing software out there and some users prefer them.
Trojan.Ransomcrypt – More about It
Symantec researchers have identified several different variants, besides the main variant of this trojan. Once executed on the computer, the main variant of this infection creates this file and sets it as a wallpaper:
After this is done, the trojan horse begins to scan the computer for the most opened and important files in the user PC:
→.doc .jpg .rar .zip .txt .rtf .jpeg .html .htm .php .eml .3gp .7z
After establishing which files are important for users, the malicious program then encrypts all of the detected files on scan and copies them with an added .vscrypt extension to them. After doing so, the trojan then deletes the original files. What is good news about the original variant is that it uses one decryption key for all of the encrypted files, similar to the .bitcrypt extension ransomware.
After it has finished with the encryption of the targeted files, the cyber threat then changes the wallpaper to a message in Russian and restarts the infected PC. The message states the following:
→“Hello, I am a Trojan encoder, more specifically one of its variants ::) my author is a person whose nickname is KOPPEKTOP and he will gladly sell you a decypher for the files that I succeeded to encrypt on your computer for the small sum of 10 dollars it is around 350 rubles here are the details to connect to my account
Mail: firstname.lastname@example.org icq 481095
oh yes i almost forgot – do not clean the files with vscrypt extensions because taking them back will become impossible
Good luck yours trully Trojan encoder and KOPPEKTOP”
Removing Trojan.Ransomcrypt from Your PC and Restoring Your Files
In order to remove this ransomware from your computer you need to isolate it. The best method to do this is if you scan your computer via a live operation system, but it may also work in Safe Mode with a special Anti-Malware tool. In order to remove the trojan, please follow the step-by-step tutorial below to help you cope with it.
For a tutorial on how to scan your computer via a live OS, please check this forum post:
In order to try different methods to decrypt your files, please try the following posts:
How To Boot Into Safe Mode
1. Start Your PC in Safe Mode to Remove Trojan.Ransomcrypt.
For Windows XP, Vista, 7 systems:
1. Remove all CDs and DVDs, and then Restart your PC from the “Start” menu.
– For PCs with a single operating system: Press “F8” repeatedly after the first boot screen shows up during the restart of your computer. In case the Windows logo appears on the screen, you have to repeat the same task again.
– For PCs with multiple operating systems: Тhe arrow keys will help you select the operating system you prefer to start in Safe Mode. Press “F8” just as described for a single operating system.
3. As the “Advanced Boot Options” screen appears, select the Safe Mode option you want using the arrow keys. As you make your selection, press “Enter“.
4. Log on to your computer using your administrator account
While your computer is in Safe Mode, the words “Safe Mode” will appear in all four corners of your screen.
For Windows 8, 8.1 and 10 systems:
Step 1: Open the Start Menu
Step 2: Whilst holding down Shift button, click on Power and then click on Restart.
Step 3: After reboot, the aftermentioned menu will appear. From there you should choose Troubleshoot.
Step 4: You will see the Troubleshoot menu. From this menu you can choose Advanced Options.
Step 5: After the Advanced Options menu appears, click on Startup Settings.
Step 6: Click on Restart.
Step 7: A menu will appear upon reboot. You should choose Safe Mode by pressing its corresponding number and the machine will restart.
2. Remove Trojan.Ransomcrypt automatically by downloading an advanced anti-malware program.
To clean your computer you should download an updated anti-malware program on a safe PC and then install it on the affected computer in offline mode. After that you should boot into safe mode and scan your computer to remove all Trojan.Ransomcrypt associated objects.