How to remove CryptXXX 4.0 ransomware virus

Beware: CryptXXX 4.0 virus has been released!

It’s official – CryptXXX 4.0 ransomware has been released, and this time its developers have fixed flaws in its code, making the virus even more powerful. It seems that the authors of this ransomware have decided to release an even more complicated version of CryptXXX since they have lost a lot of potential income by unintentionally releasing free decryption keys for users who have been attacked by .Crypz and .Cryp1 versions of this virus. In addition to that, CryptXXX 4.0 version provides a fixed decryptor as well. Of course, the victim has to pay a certain sum of money to get it.

CryptXXX malware family contains of CryptXXX 2.0, CryptXXX 3.0, but now the fourth member has been discovered. The fourth version of CryptXXX scans the computer system thoroughly, and also all removable drives plugged into the compromised computer. No matter if these are USBs, CDs or hard drives, this malware will corrupt data stored on them as well. The encryption that this virus uses is currently the strongest one – RSA4096. The virus uses a public encryption key to encode victim’s files, and only the authors of this ransomware know what is the unique decryption code (individual for each victim). Once CryptXXX 4.0 ransomware encrypts victim’s files, it creates and saves ransom notes in .bmp, .txt and .html formats. These ransom notes inform the victim what has happened and that all files were locked with strong RSA-4096 encryption, and even provides a link to Wikipedia page about this encryption. The rest of the ransom note provides traditional decryption instructions: the user has to download Tor browser to access the payment website, buy Bitcoins and transfer them to a provided Bitcoin address. Then the victim gets a unique decryption key and can restore all encrypted data.

If you have been infected with this virus, we would like to encourage you to not pay the ransom. Cyber criminals ask for a considerable amount of money, and by paying them, you would support their illegal activities and fund their further ransomware projects. We understand that people want to recover their files, and that is absolutely normal, but we advise you to think twice before reaching out for your credit card. If you do not want to pay the ransom, then remove CryptXXX 4.0 virus with a malware removal program, for example, FortectIntego. Sadly, it would be way too hard to delete this virus manually, so we do not recommend you to attempt to do that.

CryptXXX 4.0 distribution methods

CryptXXX 4.0 developers are advanced programmers and IT experts, and although it might sound like a compliment to them, it is sad that these guys are using their skills for such illegal activities. It seems that they spread CryptXXX 4.0 via compromised legitimate websites, which then redirects victims to Neutrino Exploit Kit. Cyber criminals exploit websites that have slightest security vulnerabilities, and it was noticed that they target pages that have added Revslider slideshow plugin (for WordPress) to them. For example, when the user clicks on a video or a slideshow presentation to start it, they will be redirected to Neutrino Exploit Kit. Cyber criminals have automated the process of scanning websites for vulnerabilities by utilizing SoakSoak botnet, which is running since 2014.

However, this ransomware still spreads using traditional malware distribution methods as well. You can get it via email, disguised as an official letter, invoice, or another document from a well-known company. Typically, crooks create email addresses that look secure and send emails to victims from them. We advise you to carefully investigate who is the sender of an email, and if you do not know it personally, do NOT open the email or its attachments.

How to remove CryptXXX 4.0?

If your computer has become infected with CryptXXX 4.0 ransomware, then do not waste time and remove it from your computer without a delay. Use a powerful anti-malware tool to delete it from your system, but keep in mind that it is not so simple to download and install it while the virus is monitoring your computer. Follow these CryptXXX 4.0 removal instructions to learn how to deactivate the virus and run your PC in a Safe Mode.