How to remove CryLock ransomware

CryLock ransomware – a new version of the infamous Cryakl cryptovirus

CryLock ransomware is a virus made for money extorsion – it encrypts victims' personal files and demands a ransom for decryption tools. This cryptovirus is a new version of Cryakl ransomware that was first detected earlier this year (April of 2020). Just like its predecessors, the virus encrypts all non-system data, like photos, documents, archives, etc., and appends a three-part extension to that data.

CryLock ransomware assigns extensions and file changes quite a bit differently than other strains – it appends a random three-letter string (although latest variants add no extension at all). The more typical trait is that it also uses a contact email and the user ID. There have been several versions seen in the wild, for example:

• file.doc.[darkmask@mailfence.com][fervis].[98252B9E-3FE98E00]
• file.doc.[flydragon@mailfence.com][sel4auto].[A15F580C-524AC4DB]

A ransom note pop-up window abruptly appears after the encryption process is completed. Within it, developers of the CryLock virus state that only they have the required tool for decryption and that the victims will have to pay them to receive it. To show proof that such a tool exists, the cybercriminals offer the victims to send them up to three files (no more than 5 MB) for a test decryption. Users should send the files by email to one of the provided addresses (edited due to its vulgar nature): grand@horsef***er.org or horsef***er@tuta.io.

The perpetrators also give a unique ID for all victims. Also, two timers are given: one that indicates the time left to pay the ransom or the payment will be increased; the other shows how much time is left until files are permanently lost. Additionally, like in Recoverydatas or Pay2Key ransomware, the creators of CryLock cryptovirus are warning their victims not to rename the encrypted files or try using any third-party decrypting software as that may lead to data being undecryptable.

In most cases, the cybercriminals are not lying about one thing – they're the only ones that can unlock encrypted files. But dealing with the criminals is the worst option a victim can do. Numerous reasons not to pay the ransom^[1]. Most likely, it will lead to a lose-lose situation where the unfortunate users will not only lose money but never regain access to their data too.

We recommend abolishing the virus from your infected device immediately. To remove CryLock ransomware with a push of a button, we advise using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Anti-malware software is a must these days, considering how many different malicious programs are created every day.

When CryLock ransomware removal is completed, users shouldn't forget to do a full system check-up. Experts^[2] suggest using the FortectIntego system tune-up tool to find any changes that the file-locking parasite has done to system files and its settings and restore them.

Money extortion message in the ransom note pop-up window:

Price is raised! Your files have been encrypted… Price is raised!Your files will be lost after

What happened?
All your documents, databases, backups and other important files have been encrypted due to a security problem with your PC. The only way to recover files is to purchase a unique private decryption key. If you want to recover files, write to us by e-mail: grand@horsef***er.org with the following details:
External IP
You unique ID [512064768-1578909375] [copy]
The price depends on how fast you write to us, on timers you can see how many time do you have before price increasing. After payment we will send you the tool that will decrypt all your files. In case of no answer in 24 hours write us to this e-mail: horsef***er@tuta.io [copy]

Any guarantees?
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 5Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.)

Attention!

Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Use trusted email clients (gmail.com, protonmail.com, aol.com, etc.) for communication; sometimes your letters do not reach us from corporate letters.
Communication with us lasts 2-4 weeks, then we block mail for communication
Your ID [512064768-1578909375] [copy] Write to grand@horsef***er.org [copy]

Places where different types of malware are usually hidden 

Malware such as ransomware, trojan horses^[3], and such are spread out through the internet and hidden in many different places. The most common way to get your computer system infected is by opening spam emails and visiting malicious sites, like torrent file-sharing platforms.

With so-called spam campaigns, cybercriminals send out millions of emails either with infectious email attachments or hyperlinks that redirect unaware users to malicious websites. If any of these options is opened, a payload file is downloaded into the device, and infection starts. Always have an updated anti-malware software watching your back.

Cybercriminals can disguise their created malware as any file type (.exe, .pdf, .jpeg, .txt, and so on). So torrent websites are an ideal place to hide their creations. They can name the files whatever they think will appeal to the soon to be victims and upload them. Users should never download any software, cracks (illegal activation toolkits), or any other suspicious material from these sites.

CryLock ransomware removal instructions and system repair guide

Having your system infected is a nightmare. The first step victims should do is to delete the malware immediately. We suggest SpyHunterCombo Cleaner and MalwarebytesMalwarebytes anti-virus software to remove CryLock ransomware automatically and prevent from future incidents. Unfortunately, removing the virus won't unlock your infected files (which means that, the file [darkmask@mailfence.com][fervis].[victim's_ID] or [flydragon@mailfence.com][sel4auto].[victim's_ID] will remain unchanged and still unusable), but it won't delete them also. If you had backups, don't rush to use them till you're done with the second step (below this paragraph). If you didn't have backups, export all contaminated files to offline storage, like a USB drive, and wait for a public decryption tool to be created.

The second step is to repair your devices corrupted system files and settings. We advise using the FortectIntego system tweaking tool to automatically detect and reverse any changes that the virus has done. Users that neglect the health of their computer systems after CryLock ransomware removal might experience severe lags, overheating, crashing, etc.