How to remove Crypted Pony ransomware

Crypted Pony ransomware is a ransomware virus that encrypts files by using AES algorithm and then appends a long marker

Crypted Pony (also called Pony, Pony_XXX, 05ntoar0) is the ransomware that focuses on file encryption and demanding the 0,5 BTC for the alleged decryption key. Typically, ransomware viruses mark encoded files with short extensions, but this version is using .crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx. Then, the virus displays a ransom note in an HTML window where you can additionally see the contact email, Bitcoin wallet address, and other information needed for the payment transfer. However, the promised response with a Pony decoder might not even get to you when you pay, so make sure you ignore this ransom warning message which is called IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.HTML. The ransom note of Pony ransomware is also displaying the victim's personal identifier and gives the opportunity to switch the language to English, Russian or Italian. This fact means that virus developers are ready to target a large part of the world.

Crypted Pony ransomware virus has also been called Pony ransomware, Pony_XXX ransomware and all those names come from the file extension that victims' files get after encryption process. The appendix in a pattern .crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx marks files that are no longer usable because encryption is the process when the original code of the file gets changed.^[1]

Additionally, when analyzing the main ransomware payloads and executables from malware samples, various researchers have been this particular virus 05ntoar0 ransomware. Executable files associated with the attack at the time of writing: 05ntoar0.exe; pony.exe; chrome.pif.exe, or even any other random file name. 

Based on these few variants of payload files Pony ransomware can also be detected in a handful of heuristic names during a full system scan and malware removal. One of the samples analyzed online reveals at least 39 detection results that show how the threat can be identified.^[2]

There are no previously known threats that Crypted Pony ransomware can be associated with so we cannot assume any functions or features based on previous versions. However, this is a cryptovirus that has a few features belonging to the ransomware category:

• encrypts files like photos, documents, videos, databases;
• alters registry entries;
• adds new system files;
• disables or launches system functions;
• keeps AV tools and system security features from running properly.

Since Crypted Pony ransomware developers can disable system security features, functions or even antivirus programs, you need to take precautionary measures like rebooting the system in the Safe Mode with Networking and then scanning the computer thoroughly using the anti-malware program.

Other researchers^[3] and we always recommend choosing a reputable anti-malware tool to fight all cyber threats. Especially when performing Pony ransomware removal. This is the method when your device gets cleaned thoroughly and entirely.

But remember to remove Crypted Pony ransomware using FortectIntego or similar tool and then double-check to make sure the device is appropriately cleaned and you can safely recover your files using data backups. Do not trust cybercriminals and their alleged decryptor, terminate malware and restore data using data recovery software or file backups.

Ransomware payload gets dropped without your knowledge

There is no specific information about the distribution technique used in this particular virus attack but the main method used to spread these threats, in most cases, is spam email including malicious files. Microsoft Word or Excel documents, PDFs, or archives, executables can get distributed via legitimate-looking emails.

When you open the email that, in the first place, looks safe you risk getting content on the device that you know nothing about. Especially when you open the file attached to the email or even download it. Often when you open the document or PDF, you get a suggestion to enable content like macros.^[4] Once it happens malicious script launches on the system and infects the device with ransomware directly or any other malware that is designed to distribute cryptovirus further.

You can avoid these cyber infections if you pay more attention to unexpected emails. You can tell if the email is suspicious when you see the unfamiliar sender or subject lines like Invoice or Order information. Also, don't fall for the trick when malicious actors use well-known names of companies and services on these emails.

Get rid of the possible intruders and all malicious Crypted Pony ransomware files with a full system scan

You can terminate background processes or data and programs associated with Crypted Pony ransomware virus, but for that, you need a proper anti-malware tool that detects, indicates and deletes all potential threats, cleans the system further and even improves the performance.

We can recommend FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes for this job because programs have all the needed features that you need to remove Pony ransomware. It is simple and easy, and you need to choose reliable software and run a full system scan. Then you can see the results and delete malware. After the successful Crypted Pony ransomware removal, double-check if the system is malware-free. This way you can be sure that ransomware is terminated and your recovered files are safe.