How to remove ViACrypt ransomware virus

ViACrypt makes the best of Windows RASMAN functionality

ViACrypt virus functions as crypto-ransomware^[1] that encrypts victims’ personal files using an exquisite RSA-1024 algorithm and adds .via extensions to files. Its final step is to drop a ransom note titled “Your system has been encrypted! please read further instruction!.txt” on the computer desktop to demand a ransom payment. Also, “your_encryption_public_key.rkf” file is created during this time.

While crypto-malware is an extremely dangerous Windows infection, you should not panic, as there might be a possibility that you could restore your data using alternative methods and avoid paying criminals. In fact, they might not even provide the required decryption key even if you pay them, so keep that in mind when you think that you have run out of options.

ViACrypt belongs to a group of very dangerous computer viruses which prevent victims from accessing their personal files by enciphering their contents using military-grade encryption algorithms.

The threat begins the system infiltration by deploying its dropper file called crawl.exe in the %APPDATA% folder of the PC. It then makes changes to Remote Access Connection Manager (RASMAN) ^[2] settings to establish a connection to the secret hacker server. Later on, the rest of the payload files get downloaded on the device.

Once all the crucial elements are delivered into the computer, the threat starts looking for different files to encrypt. After this process is over, it becomes virtually impossible to remove ViACrypt from the PC without any consequences. For that purpose, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes will come in handy.

Among the files that this threat drops on the PC is the ransom note and the public key used for the data decoding called your_encryption_public_key.rkf.

The ransom note contains the following message:

Your system files has been encrypted and only way to recover them is by purchasing unlocking key.
Steps to gain access for files:
1) Please follow this page: xxxx://sigmalab.lv/other/crypt/payment_request.php
2) Upload your public encryption key
3) Download decryption key
4) Drag and drop key on crawl.exe
5) Wait for files to be unlocked in background

Consider whether following these instructions is a convenient option for you. This data recovery method is suggested by perpetrators who have encrypted your PC in the first place, so it is highly risky to trust them with its recovery.

In fact, cybersecurity experts recommend performing virus removal instead and wait for some safer data recovery solution to come about. Professional malware investigators often come up with free ransomware decryption tools, so it is likely that one can be invented for this malware.

Currently, the malware is very active in Latvia ^[3]. Even the ransom payment site is written in this language.

Things determining crypto-malware infiltration process

The main vectors of ransomware distributions are infectious spam email attachments and compromised online downloads. We should note that ransomware is more commonly infects outdated operating systems which no longer receive security patches from the vendor. So, the main factors that help ransomware to infiltrate PCs are the following:

• Carelessly downloading software from random websites
• Using outdated and unsupported operating system
• Keeping outdated software installed on the computer
• Downloading and opening suspicious email attachments
• Employing illegal endpoint security utilities to protect your device

If you find yourself doing any of these things, make sure you fix the situation without further delay because continuing these faulty activities may cost you your files. You can be certain that the hackers behind malware will exploit these vulnerabilities.

Choosing the right software for ransomware termination

When infected, there is nothing you should prioritize malware removal, although it also depends on your backup situation. While you shouldn't start from data recovery, you should make copies of locked files if no backups are available to you. Only then proceed to remove the virus from your system using reputable security tools.

To be safe, launch a professional antivirus software and allow it to scan your entire system looking for malicious ransomware components. It should take the app a few minutes to remove the ViACrypt virus and for you to return to the safe computer using again.

When you get rid of the virus, you may check out data recovery solutions suggested by our experts below the article.