Severity scale:  

Exocrypt ransomware. How to remove? (Uninstall guide)

removal by Jake Doevan - - | Type: Ransomware

Exocrypt is a malicious program that belongs to ransomware category

Exocrypt ransomware virus locks data

Exocrypt ransomware is a malicious program that claims to be created for educational purposes. Recently, security experts reported about its second version called as Exocrypt XTC v2.0.[1] Each of these crypto-viruses[2] are set to lock personal victim's files and block the access to them until he or she pays the ransom. Ransomware is still using AES encryption algorithm to create a hardcoded password for archived data on the victimized PC.

Name Exocrypt ransomware
Alternative name XTC ransomware
Versions Exocrypt XTC v2.0
Type of malware Ransomware
Main file Exocrypt.exe
Distribution Spam email attachments, fake software updates
Danger level High. Locks data and asks for redemption
Encryption used AES
Related files Exocrypt.exe
To eliminate this ransomware, download Reimage and run a scan with it.

Following the encryption, the virus scans the system for compatible file types and renders AES-256 cryptography[3] to make them inaccessible. It’s not clear yet what file extension it uses, but experts consider it to be .xtc. In most of the cases, the Exocrypt ransomware infiltrates on PCs via malicious email attachments or fake software updates. It seems current that extortionists do not take advantage of exploit kits and unprotected Remote Desktop services.

As soon as all the detected data is encrypted by Exocrypt XTC v2.0, user receives a .html ransom note which, once opened, demands $50 that should be paid in Bitcoins within 24 hours. While the ransom is believed to be one of the smallest ones, the time given for exchanging currencies and performing a transaction is quite limited.

The ransom note of the first version reads:

All your personal files have been encrypted, your photos, videos and documents are no longer accessible, don't cry yet because I have not deleted them… Yet…
In order for me to decrypt your files for you, you must pay a small fee to the following bitcoin address, payment will only be accepted in bitcoin to insure anonymity… Try anything funny, and your files will be permanently encrypted forever.
Good luck.
$50 in BTC *** [Decrypt]

The second version notes its victims:

This ransomware was made for educational purposes, we will not send out any copies of this virus, unless it is for forensic purposes! 

No matter what is reported, you should realize that you are dealing with a serious virus. It’s not advisable to pay the ransom anyway. Even if you have some Bitcoin coins in your digital wallet, do not rush to give them away for criminals. No one can assure you that you’ll get your files back after the payment. Instead of that, scan your PC with Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus, Malwarebytes Anti Malware or another professional anti-malware and remove Exocrypt ransomware permanently.

By the way, do not fall into a panic if Exocrypt removal is not permitted. Ransomware-type viruses use scripts to disable security programs to evade removal. To bypass the restriction, you should restart your PC into Safe Mode with Networking and then try to run a scan.

Most common ways how ransomware enters the system

As we have already pointed out, this ransomware virus spreads either inside spam email as an attachment or as obfuscated software updates. Both ways criminals render social engineering strategies to convince potential victims that the attachment or installer is reliable.

They impersonate legitimate companies, such as Amazon, eBay, etc. or camouflage legitimate products that belong to Microsoft, Adobe, and similar. The[4] team of security researchers points out the following precautionary measures that you should take to protect the system from ransomware attack:

  • Always use professional security software and make sure it’s up-to-date;
  • Exploit the Real-time protection feature of the security program;
  • Do not open email messages from unknown senders or companies you do not recognize having business with;
  • Be careful with peer-to-peer (P2P) networks as instead of a video, audio file or software you can end up with the virus.
  • Finally, restrain from clicking on questionable ads, even if they promote popular products for a small prize.

Home users should rely on professional anti-virus to remove Exocrypt ransomware

IT specialists that are oriented to cybersecurity and viruses are well-equipped and skilled in running various scripts to remove Exocrypt and similar ransomware. If you are not that tech-savvy, we would not recommend trying to eliminate this pest manually as you may not only lose personal files permanently but also damage your PC.

Upon Exocrypt removal, use your backups to unlock files encrypted by XTC virus or render third-party software recovery tools. But before that, double check if the virus has been removed by running a repeatable system’s scan with an anti-malware. Otherwise, your files will be encrypted again.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Exocrypt ransomware you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Exocrypt ransomware. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.
Press mentions on Reimage

Manual Exocrypt virus Removal Guide:

Remove Exocrypt using Safe Mode with Networking

To unblock your anti-virus and run a scan that is essential to ransomware removal, you need to restart your PC into Safe Mode with Networking. Our team has submitted a step-by-step tutorial for those who have never tried safe mode.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Exocrypt

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Exocrypt removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Exocrypt using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Exocrypt. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Exocrypt removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Exocrypt from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

There's currently no information about what changes this virus causes on the affected system. Besides, it's unknown whether it deleted Volume Shadow Copies and Previous Windows versions. Therefore, we would strongly recommend you to try each method on how to decrypt files encrypted by Exocrypt ransomware one-by-one. 

If your files are encrypted by Exocrypt, you can use several methods to restore them:

Try Data Recovery Pro

This software features a powerful scan engine and is capable of exploited deleted, corrupted or encrypted files. Thus, it's worth giving a try. 

Exploit previous Windows versions

Exocrypt malware is a severe cyber infection, which may initiate various system's changes, including removal of the System Restore Points that you've created before the attack. However, there's only one way to check that – try to enable the previous Windows version. 

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Use ShadowExplorer

ShadowExplorer is a piece of software capable of detecting Volume Shadow Copies stored on Windows OS and recovering the corresponding files if required. 

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

When the Exocrypt decryptor occur, we will notify you immediately.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Exocrypt and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions