Severity scale:  
  (99/100)

HollyCrypt ransomware virus. How to remove? (Uninstall guide)

removal by Olivia Morelli - - | Type: Ransomware
12

Ridiculous HollyCrypt ransomware demands: Bitcoins or Vodka 

HollyCrypt virus seems to be yet another descendent of HiddenTear — the open-source ransomware which first emerged as an educational tool but was later assimilated by hackers as a basis for malicious ransomware construction. In general, this malware example is no different from other ransomware samples — it aims to get inside the target computer system silently, encrypt files there, append specific file extensions to them and drop a ransom note to inform the victim about the attack and possible consequences of it. The sample that we have analyzed adds .hollycrypt file extensions to encrypted data, and leaves a ransom note dubbed read_this_shit.txt in the C:\Users\(username)\Desktop directory. The authors of the ransom note also show off a dark sense of humour by demanding the victim to send them “some bitcoins or vodka” in exchange for the data recovery software. The email that is left in the ransom note is Hollyman137@gmail.com. Please take note that this virus differs from HolyCrypt ransomware, which first appeared in July 2016.

No matter that the cyber attack culprit promises to provide the decryption tool after the payment is made, there is no reason to believe what he/she says. You might never see your files again even after paying the ransom. We do not recommend you to take risks and strongly suggest to remove HollyCrypt malware without any doubt. Of course, a proper tool should be used for that, and we recommend using Reimage. We must warn you that leaving this ransomware on the system is a very bad idea because it might download additional malware on the system. Besides, ransomware can be installed together with Trojans and other types of malicious software, so to clean the computer entirely, you should initiate HollyCrypt removal as quickly as possible. Use instructions presented below the article to restart your PC in a Safe Mode with Networking and start deleting the virus right away.

HollyCrypt virus asks for a unique ransom

The main strategies of ransomware dispersion:

HollyCrypt ransomware spreads in a bundle with malicious software updates (typically Java or Flash Player updates advertised via vague websites), also via malicious email campaigns and with the help of exploit kits. These distribution techniques help criminals inject ransom-demanding viruses into victims’ computers without their notice. The easiest and surprisingly the most efficient way to infect someone else’s computer with malware is to send a malicious email to them. Such emails typically contain a file attachment that contains ransomware payload. Once downloaded and opened, it can automatically activate malicious script and download HollyCrypt payload to the computer. Sadly, as soon as the malicious attachment is opened, there is no way back — the ransomware starts its malicious processes and ravages through the computer rapidly encrypting files. Of course, users who have decent and up-to-date anti-malware programs on their computers are less likely to be affected by such viruses.

Preparing for the HollyCrypt removal:

Before you remove HollyCrypt virus, prepare your PC for that. You might need to start the elimination in Safe Mode with Networking first to be able to activate the malware removal tool. This might be an unnecessary step, but we have provided HollyCrypt removal instructions just in case. If for some reason you cannot eliminate this virus, please contact our support team for help. We also want to add that ransomware is a complicated program and it cannot be uninstalled that easily. That is why we do not recommend to remove HollyCrypt manually, but rather use an automatic malware removal tool.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove HollyCrypt ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall HollyCrypt ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

Manual HollyCrypt virus Removal Guide:

Remove HollyCrypt using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove HollyCrypt

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete HollyCrypt removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove HollyCrypt using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of HollyCrypt. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that HollyCrypt removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove HollyCrypt from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

There are several motives why you should not pay the ransom. Firstly, ransomware analysts are working hard to discover decryption tools and might be able to find one for HollyCrypt ransomware soon. Secondly, paying the ransom only benefits ransomware authors, and not you. You might never receive decryption tool after paying – so think twice before buying Bitcoins.

If your files are encrypted by HollyCrypt, you can use several methods to restore them:

Data Recovery Pro to the rescue!

Data Recovery Pro is a tool that can efficiently recover deleted, corrupted, or encrypted files. Keep in mind that it cannot crack very hard encryption ciphers, but you should still try it out.

How can Windows Previous Versions feature help you with data recovery?

If you always think ahead and have enabled System Restore function before any virus hit your PC, you should definitely try out the Windows Previous Versions feature method to recover your important documents. Please note that using this technique, you won’t be able to restore your entire computer, but you might be able to save a couple of your documents.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer to the rescue!

In some cases, ransomware creators forget to delete Volume Shadow Copies, which can completely restore encrypted files. To check if these copies have been affected or not, use ShadowExplorer.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from HollyCrypt and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions


  • Joshua

    This is not funny. How to restore files. Please answer.

    • esse

      Files are kaput. I cannot restore mine, too. I hope youre not planning to pay the ransom????

      • Joshua

        no im not but hopefully someone can decrypt them for me..

  • Madden

    I cannot believe I lost all my files like in a few seconds this virus was quick!!! oh lord what imma gonna do now…