How to remove Crypton ransomware virus

Crypton is a file encrypting malware that tries to persuade victims to pay ransom

 Crypton ransomware^[1] was first spotted in November 2016. Since then, it keeps coming back with different file extensions and improved code. The crypto-malware uses a complicated encryption algorithm to lock up documents, audio, video, and other files. Each version of the virus adds a different file appendix, such as  _crypt, .encrptd, and [file_name].id-[victim’s ID] _steaveiwalker@india.com_.

The latest variant of Crypton was spotted in May 2018, and it appends .ransomed@india.com extension to all files. Regardless of the version, malware always drops a ransom note either in .txt or .html format, which includes instructions on how to pay hackers in bitcoin cryptocurrency and reclaim encoded data.

The virus mainly targets English, Russian, and Portuguese^[2] computer users, although it can emerge anywhere in the world. Authors of the CryptON ransomware use Remote Desktop Services (RDP)^[3] brute force attacks to hack into computers and install malware.

The first task the virus does is the deletion of system recovery points in order to make data encryption a complicated procedure. However, malware researchers managed to help victims of ransomware and created a free decryptor.

However, Crypton virus is still in the wild and encrypts all popular files saved on the affected computer. It uses AES-256 encryption cipher to lock files and gets a key with SHA-256. During the encryption, malware can append one of the following file extensions:

•  _crypt
• .encrptd
• .id-[id]_locked
• .id-[id]_locked_by_krec
• .id-[id]_locked_by_perfect
• .id-[id]_x3m
• .id-[id]_r9oj
• .id-[id]_garryweber@protonmail.ch
• .id-[id]_steaveiwalker@india.com_
• .id-[id]_julia.crown@india.com_
• .id-[id]_tom.cruz@india.com_
• .id-[id]_CarlosBoltehero@india.com_
• .id-[id]_maria.lopez1@india.com_
• .ransomed@india.com

Once CryptOn finishes its work, it drops .txt and .jpg files on the infected computer. The first one, “Readme_encrypted.txt” file, contains the only line saying “These files are encrypted! Follow the instructions on the screen. ID:XXXXXX.” The rest of the essential information about what happened and how to reclaim the encrypted files is placed directly on the infected computer’s desktop. The message goes as follows:

Attention!
All data on you PC is encrypted!

To decrypt your data, you need to pay the amounts shown below.
Please note that the payment confirmation may take some time (from 1 hour to 1 day).
All this time, the program must be running and have an internet connection.
After the successful confirmation of payment – decoding will start automatically.
Read more about how to make a payment using Bitcoin can be found on the internet network.
In destination address – specify the Bitcoin address, listed below.
Keep in mind that the services may charge a fee for the payment, it is important that we must …
It is not recommended to attempt to recover the data, or remove this program! This can lead to a complete
loss of your data forever! To restore data, you must be connected to the Internet.
Status:
Bitcoin address: ***
Payment amount: ***
check payment status

The authors of the ransomware virus do not specify the size of the ransom. It might differ based on the amount and importance of the encrypted files. However, following hackers’ orders is not needed. After CryptOn removal, you can use a free Emsisoft decryptor for recovering affected files.

To remove the virus from the machine, you need to obtain a professional malware removal program and run a full system scan. We recommend SpyHunterCombo Cleaner, MalwarebytesMalwarebytes for this task because it does not only cleans malware but fixes the damage to the system as well.

Developers of Crypton created a special campaign to attack computer users in Portugal

At the beginning of 2017, researchers reported a new version of the malware. It was named CryptON CyptoLocker virus because it seems to be a version of CyptoLocker ransomware, a popular crypto-malware that has been ravaging through computers back in 2014.^[4]

This variant is primarily targeted towards Portuguese-speaking users and addresses them in this particular language when explaining the purposes of the attack and terms of data recovery. Following the data encryption procedure, the virus drops a ransom note called COMO_ABRIR_ARQUIVOS.txt.

Additionally, it renames the encrypted files like so: [file_name].id-[victim’s ID]_steaveiwalker@india.com_. However, this version of malware is decryptable too. So, if your files got encrypted, you should focus on Crypton ransomware removal instead of paying the ransom.

The newest version of CryptON uses RDS services to get into machines

As reported by ransomware researcher S!Ri^[5], the newest version of the virus abuses victim's Remote Desktop Services connected to the internet to hack into the computer. As soon as cybercrooks get hold of the machine, they physically execute the malicious payload.

This variant of CryptON appends .ransomed@india.com file extension to all encrypted files. As usual, files are not damaged, they are just encoded. In order to recover data, users are prompted to contact hackers via ransomed@india.com email, via the support website online (both Tor and non-Tor versions) or the bitmessage. The rest of the HOWTODECRYPTFILES.htm consists of the instructions pointing at how to install the Tor browser.

Unfortunately, this version of CryptON, unlike few previous ones, is not decryptable. However, we suggest trying third-party software or restoring files from a backup.

Distribution methods of the ransomware virus

The file-encrypting virus has several versions that are being spread using different techniques, such as:

• Remote Desktop Services (RDP) attacks;
• a fake keygen for EaseUS Data Recovery software;
• malicious spam emails.^[6]

To avoid cyberattacks, it is recommended to protect or disable RDP services, avoid downloading cracked or illegal programs and be careful with emails. The latter method is especially popular among developers of ransomware, so you should learn how to distinguish legitimate emails from dangerous ones.

Additionally, updating programs and operating systems, as well as installing a professional antivirus program, are also important precautions. However, you should still create backups in case something bad happens.

Uninstall CryptON ransomware virus

Security programs like FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes are needed for CryptON removal. This cyber threat is capable of installing numerous malicious components, affecting legitimate system processes, and hide under safe-looking file names. So, professional help is needed for cleaning up the computer.

However, you might be unable to remove the threat with anti-malware easily. The virus might block security tools, but you can still get rid of this problem. All you need to do is to reboot the computer to Safe Mode with Networking as explained below and perform a system scan a couple of times.

Once your computer is virus-free, you can use a free CryptON decryptor or use backups for data recovery. Other possible solutions are given below too.