How to remove MoneroPay ransomware

Files encrypted by MoneroPay can be decrypted for free

MoneroPay (also known as SpriteCoin ransomware) is a malicious program that encrypts files using AES cryptography^[1] and appends .encrypted file extension to each of them. However, at the beginning of February 2018, researchers managed to crack malware’s code and created a free decryptor.^[2]

Malware spreads as SpriteCoin package — a supposedly new cryptocurrency written in JavaScript.^[3] For this reason, it also has an alternative name – SpriteCoin ransomware.

As soon as people download SpriteCoin.zip file from the Internet, malware shows Downloading blockchain message on the affected computer's screen. Meanwhile, Spritecoind.exe stealthily starts encrypting the most valuable data on the victimized system. Thus, users barely suspect something shady until this nasty procedure is over.

Following data encryption, malware opens MoneroPay window which serves as a ransom note where victims are asked to pay 0.3 Monero for a decryption key:

Your files are encrypted. 

If you close this window, you can always restart and it should appear again. 
All your files have been encrypted by us. This means you will be unable to access or use them. In order to retrieve them, you must send 0.3 monero (about $ 120 USD) to: 
[wallet address] 
Make sure you include your payment ID: XXX
Use CTRL + C to copy both 
IF YOU DO NOT INCLUDE YOUR PAYMENT ID, YOUR FILES CAN NOT BE DECRYPTED. Do not waste your time. 
If you have paid, click on the DECRYPT button to return your files to normal. Do not worry, we'll give you your files back if you pay. 

Even though the price of MoneroPay decryptor is considerably low, you should not pay the ransom. Note that criminals often try to calm you by saying not to worry and that your files are safe. However, this is merely an attempt to convince you that making the transaction is the only choice. Additionally, researchers created a free decryption tool and paying the ransom should not be even considered.

Hence, you have to remove MoneroPay (a.k.a. SpriteCoin virus) and recover your files using backups. In case you do not store them in the cloud or another external drive, you can use a free MonorePay decryptor. However, if some of the files remain corrupted, feel free to try alternative techniques to get back your data. They are provided at the end of this article.

We highly recommend FortectIntego for MoneroPay removal. This is the safest and fastest option to eliminate this high-risk computer threat. However, if you have another robust security software, it might also help you during the termination procedure. 

Malware spreads as a fake cryptocurrency wallet

As we have already mentioned, MoneroPay ransomware spreads inside the package of SpriteCoin – a fake cryptocurrency wallet. Usually, ransomware arrives as fake software updates or spam emails. However, criminals switched their distribution techniques to benefit from people who seek to make profit out of cryptocurrencies.

The obfuscate ransomware can be placed on shady websites, hacker forums or peer-to-peer (P2P) networks^[4]. Likewise, you should avoid not only visiting such sites but also downloading any content stored there. Note that the executable of the file-encrypting virus can look innocent or even legitimate. Thus, make sure that you pay close attention when it comes to downloading software to your computer.

Additionally, it is wise to stay away from promotional ads online. Even though they look attractive and genuine, in most cases such advertisements might lead you to a suspicious website or directly download the ransomware once clicked. Thus, use a professional antivirus tool to protect your computer.

Delete MoneroPay ransomware and recover your files for free

Firstly experts from BedyNet.ru^[5] warn that manual MoneroPay removal should not be considered. This ransomware is a tricky computer threat which might stealthily let other dangerous viruses enter your system. Thus, do not risk damaging your PC permanently and opt for automatic elimination.

You can get rid of MoneroPay ransomware with the help of powerful anti-malware software. We strongly recommend using FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes to help you. They are designed to be easy to use for a regular or inexperienced computer user. You will finish the elimination procedure with only a few clicks.

After you remove MoneroPay (SpriteCoin virus), you can download a decryption software and recover your files. You can find more information about this process below.