HollyCrypt ransomware / virus (Free Instructions)
HollyCrypt virus Removal Guide
What is HollyCrypt ransomware virus?
Ridiculous HollyCrypt ransomware demands: Bitcoins or Vodka
HollyCrypt virus seems to be yet another descendent of HiddenTear — the open-source ransomware which first emerged as an educational tool but was later assimilated by hackers as a basis for malicious ransomware construction. In general, this malware example is no different from other ransomware samples — it aims to get inside the target computer system silently, encrypt files there, append specific file extensions to them and drop a ransom note to inform the victim about the attack and possible consequences of it. The sample that we have analyzed adds .hollycrypt file extensions to encrypted data, and leaves a ransom note dubbed read_this_shit.txt in the C:\Users\(username)\Desktop directory. The authors of the ransom note also show off a dark sense of humour by demanding the victim to send them “some bitcoins or vodka” in exchange for the data recovery software. The email that is left in the ransom note is Hollyman137@gmail.com. Please take note that this virus differs from HolyCrypt ransomware, which first appeared in July 2016.
No matter that the cyber attack culprit promises to provide the decryption tool after the payment is made, there is no reason to believe what he/she says. You might never see your files again even after paying the ransom. We do not recommend you to take risks and strongly suggest to remove HollyCrypt malware without any doubt. Of course, a proper tool should be used for that, and we recommend using FortectIntego. We must warn you that leaving this ransomware on the system is a very bad idea because it might download additional malware on the system. Besides, ransomware can be installed together with Trojans and other types of malicious software, so to clean the computer entirely, you should initiate HollyCrypt removal as quickly as possible. Use instructions presented below the article to restart your PC in a Safe Mode with Networking and start deleting the virus right away.
The main strategies of ransomware dispersion:
HollyCrypt ransomware spreads in a bundle with malicious software updates (typically Java or Flash Player updates advertised via vague websites), also via malicious email campaigns and with the help of exploit kits. These distribution techniques help criminals inject ransom-demanding viruses into victims’ computers without their notice. The easiest and surprisingly the most efficient way to infect someone else’s computer with malware is to send a malicious email to them. Such emails typically contain a file attachment that contains ransomware payload. Once downloaded and opened, it can automatically activate malicious script and download HollyCrypt payload to the computer. Sadly, as soon as the malicious attachment is opened, there is no way back — the ransomware starts its malicious processes and ravages through the computer rapidly encrypting files. Of course, users who have decent and up-to-date anti-malware programs on their computers are less likely to be affected by such viruses.
Preparing for the HollyCrypt removal:
Before you remove HollyCrypt virus, prepare your PC for that. You might need to start the elimination in Safe Mode with Networking first to be able to activate the malware removal tool. This might be an unnecessary step, but we have provided HollyCrypt removal instructions just in case. If for some reason you cannot eliminate this virus, please contact our support team for help. We also want to add that ransomware is a complicated program and it cannot be uninstalled that easily. That is why we do not recommend to remove HollyCrypt manually, but rather use an automatic malware removal tool.
Getting rid of HollyCrypt virus. Follow these steps
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove HollyCrypt using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of HollyCrypt. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove HollyCrypt from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.There are several motives why you should not pay the ransom. Firstly, ransomware analysts are working hard to discover decryption tools and might be able to find one for HollyCrypt ransomware soon. Secondly, paying the ransom only benefits ransomware authors, and not you. You might never receive decryption tool after paying – so think twice before buying Bitcoins.
If your files are encrypted by HollyCrypt, you can use several methods to restore them:
Data Recovery Pro to the rescue!
Data Recovery Pro is a tool that can efficiently recover deleted, corrupted, or encrypted files. Keep in mind that it cannot crack very hard encryption ciphers, but you should still try it out.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by HollyCrypt ransomware;
- Restore them.
How can Windows Previous Versions feature help you with data recovery?
If you always think ahead and have enabled System Restore function before any virus hit your PC, you should definitely try out the Windows Previous Versions feature method to recover your important documents. Please note that using this technique, you won’t be able to restore your entire computer, but you might be able to save a couple of your documents.
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
ShadowExplorer to the rescue!
In some cases, ransomware creators forget to delete Volume Shadow Copies, which can completely restore encrypted files. To check if these copies have been affected or not, use ShadowExplorer.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from HollyCrypt and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices. Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using Private Internet Access VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.