Crying Ransomware

If the working version of Crying Ransomware ever finds a way to your system, you will find your files encrypted. It will also open an annoying window and create a .txt (READ_IT.txt) file on Desktop. It does not enter systems with the intention of locking users’ files only, of course. It seeks to extract money from users, so the first thing it does is the encryption of personal files like images, documents, videos, music, etc. It seems that not all the versions of this ransomware infection work well, i.e. encrypt users’ files, but it does not mean that such a corrupted version can be kept enabled on your computer. It is because it might be updated, and it could help other malicious applications to enter your PC easily. Luckily, this HiddenTear-based ransomware infection is not one of those sophisticated crypto-threats which not only encrypt users’ personal files, but also add new registry keys in the system registry, block system utilities, and create a bunch of new files. Because of this, the removal of Crying Ransomware should not be a task you will find impossible to complete.

After the successful entrance, Crying Ransomware finds users’ valuable files and then encrypts them all. These locked files receive the .crying extension, which explains why this infection has received the Crying Ransomware name. After encrypting users’ files, it should open a window on Desktop. Users are first told to click on the What Happend? button to “see what happend to your computer.” If users click on this button, a list of frequently asked questions with answers is displayed to them. They find out that they can no longer access their files because Crying Ransomware has encrypted them all. Also, they are told how this infection managed to enter their systems: “you downloaded something leaked/Cracked/Downloaded this itself.” Last but not least, users find out that they can get their files back by transferring 0.05 Bitcoin (~150 USD) to cyber criminals. It is not the only way to get files back and, unfortunately, you have no guarantees that you could get a key to unlock files or will receive your data in its original condition from cyber criminals. Therefore, in the opinion of researchers at pcthreat.com, you should not rush to send the money this ransomware infection demands.

It does not mean that users whose files have been locked by a ransomware infection necessarily need to pay money to cyber criminals in order to get their files back. Specialists say that alternative data recovery methods might work for them too. For example, users who have copies of, at least, some files stored on a USB flash drive or an external hard drive can easily recover those encrypted files after removing Crying Ransomware from their PCs. A free decryption tool might be able to decrypt some users’ files too, so it is worth trying them all. If none of them work, you have two options: 1) pay a ransom (it is not recommended!) or 2) wait till specialists develop a tool for decrypting files for free. We cannot promise that you could get your files back, but you should not give up so easily.

Crying Ransomware is far from these prevalent ransomware infections, so it is not very easy to talk about its distribution. Although not much is known about its dissemination, specialists believe that well-known distribution methods are used to spread it too. That is, it might be spread via spam email campaigns. Users allow it to enter their PCs when they open an attachment found in any of these emails or click on a link they find in the email received. What is more, according to malware researchers, cyber criminals might also place this infection on P2P websites. Its executable file might even have a name of a legitimate application. Although it might seem that it is not easy to prevent ransomware infections from entering PCs, we know a way how to do that easily – enable a powerful security application on your computer.

Unfortunately, you could not unlock your files easily, but we are sure that it will not be extremely hard for you to delete Crying Ransomware from your computer because you will only need to remove all suspicious files from several directories (find them listed in the removal guide below this article). If you cannot find any malicious files, use an automatic tool – it will remove all ransomware components from your PC in the blink of an eye.

How to remove Crying Ransomware

1. Open the Windows Explorer (tap Win+E).
2. Open %TEMP%, %APPDATA%, %USERPROFILE%\Downloads, and %USERPROFILE%\Desktop directories one after the other.
3. Delete all suspicious files you find there.
4. Empty the Recycle bin.