Exocrypt ransomware (Removal Guide) - May 2018 update
Exocrypt virus Removal Guide
What is Exocrypt ransomware?
Exocrypt is a malicious program that belongs to ransomware category
Exocrypt ransomware is a malicious program that claims to be created for educational purposes. Recently, security experts reported about its second version called as Exocrypt XTC v2.0.[1] Each of these crypto-viruses[2] are set to lock personal victim's files and block the access to them until he or she pays the ransom. Ransomware is still using AES encryption algorithm to create a hardcoded password for archived data on the victimized PC.
| Name | Exocrypt ransomware |
|---|---|
| Alternative name | XTC ransomware |
| Versions | Exocrypt XTC v2.0 |
| Type of malware | Ransomware |
| Main file | Exocrypt.exe |
| Distribution | Spam email attachments, fake software updates |
| Danger level | High. Locks data and asks for redemption |
| Encryption used | AES |
| Related files | Exocrypt.exe |
| To eliminate this ransomware, download FortectIntego and run a scan with it. | |
Following the encryption, the virus scans the system for compatible file types and renders AES-256 cryptography[3] to make them inaccessible. It’s not clear yet what file extension it uses, but experts consider it to be .xtc. In most of the cases, the Exocrypt ransomware infiltrates on PCs via malicious email attachments or fake software updates. It seems current that extortionists do not take advantage of exploit kits and unprotected Remote Desktop services.
As soon as all the detected data is encrypted by Exocrypt XTC v2.0, user receives a .html ransom note which, once opened, demands $50 that should be paid in Bitcoins within 24 hours. While the ransom is believed to be one of the smallest ones, the time given for exchanging currencies and performing a transaction is quite limited.
The ransom note of the first version reads:
All your personal files have been encrypted, your photos, videos and documents are no longer accessible, don't cry yet because I have not deleted them… Yet…
In order for me to decrypt your files for you, you must pay a small fee to the following bitcoin address, payment will only be accepted in bitcoin to insure anonymity… Try anything funny, and your files will be permanently encrypted forever.
Good luck.
24:00:00
$50 in BTC *** [Decrypt]
The second version notes its victims:
This ransomware was made for educational purposes, we will not send out any copies of this virus, unless it is for forensic purposes!
No matter what is reported, you should realize that you are dealing with a serious virus. It’s not advisable to pay the ransom anyway. Even if you have some Bitcoin coins in your digital wallet, do not rush to give them away for criminals. No one can assure you that you’ll get your files back after the payment. Instead of that, scan your PC with FortectIntego, SpyHunter 5Combo Cleaner, Malwarebytes or another professional anti-malware and remove Exocrypt ransomware permanently.
By the way, do not fall into a panic if Exocrypt removal is not permitted. Ransomware-type viruses use scripts to disable security programs to evade removal. To bypass the restriction, you should restart your PC into Safe Mode with Networking and then try to run a scan.
Most common ways how ransomware enters the system
As we have already pointed out, this ransomware virus spreads either inside spam email as an attachment or as obfuscated software updates. Both ways criminals render social engineering strategies to convince potential victims that the attachment or installer is reliable.
They impersonate legitimate companies, such as Amazon, eBay, etc. or camouflage legitimate products that belong to Microsoft, Adobe, and similar. The usunwirusa.pl[4] team of security researchers points out the following precautionary measures that you should take to protect the system from ransomware attack:
- Always use professional security software and make sure it’s up-to-date;
- Exploit the Real-time protection feature of the security program;
- Do not open email messages from unknown senders or companies you do not recognize having business with;
- Be careful with peer-to-peer (P2P) networks as instead of a video, audio file or software you can end up with the virus.
- Finally, restrain from clicking on questionable ads, even if they promote popular products for a small prize.
Home users should rely on professional anti-virus to remove Exocrypt ransomware
IT specialists that are oriented to cybersecurity and viruses are well-equipped and skilled in running various scripts to remove Exocrypt and similar ransomware. If you are not that tech-savvy, we would not recommend trying to eliminate this pest manually as you may not only lose personal files permanently but also damage your PC.
Upon Exocrypt removal, use your backups to unlock files encrypted by XTC virus or render third-party software recovery tools. But before that, double check if the virus has been removed by running a repeatable system’s scan with an anti-malware. Otherwise, your files will be encrypted again.
Getting rid of Exocrypt virus. Follow these steps
Manual removal using Safe Mode
To unblock your anti-virus and run a scan that is essential to ransomware removal, you need to restart your PC into Safe Mode with Networking. Our team has submitted a step-by-step tutorial for those who have never tried safe mode.
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Exocrypt using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Exocrypt. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove Exocrypt from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.There's currently no information about what changes this virus causes on the affected system. Besides, it's unknown whether it deleted Volume Shadow Copies and Previous Windows versions. Therefore, we would strongly recommend you to try each method on how to decrypt files encrypted by Exocrypt ransomware one-by-one.
If your files are encrypted by Exocrypt, you can use several methods to restore them:
Try Data Recovery Pro
This software features a powerful scan engine and is capable of exploited deleted, corrupted or encrypted files. Thus, it's worth giving a try.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Exocrypt ransomware;
- Restore them.
Exploit previous Windows versions
Exocrypt malware is a severe cyber infection, which may initiate various system's changes, including removal of the System Restore Points that you've created before the attack. However, there's only one way to check that – try to enable the previous Windows version.
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Use ShadowExplorer
ShadowExplorer is a piece of software capable of detecting Volume Shadow Copies stored on Windows OS and recovering the corresponding files if required.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
When the Exocrypt decryptor occur, we will notify you immediately.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Exocrypt and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important – recover your lost files
Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ New Exocrypt version sample. MalwareHunter Team.
- ^ Best anti-ransomware tools and decryptors 2018. Tech World from IDG.
- ^ AES and RSA Encryption. Boxcryptor. Enables people to benefit from new technology.
- ^ Usunwirusa. Usunwirusa. The latest virus and spyware news.