Crystalcrypt Ransomware

Crystalcrypt Ransomware is a newly released computer infection that can cause you major problems if your computer is unprotected from malware. This particular program was designed to encrypt your personal files and then offer you to buy a decryption program from its creators to recover your files. In short, the developers engage in the extortion of money and, thus, they are nothing short of cyber criminals. However, you should not comply with their demands as they can trick you and not send you the decryptor once you have paid the ransom. In this short description, we will talk about how this particular ransomware is disseminated, how it works, and how you can remove it.

Crystalcrypt Ransomware is similar to LightningCrypt Ransomware, and we are more than positive that they both come from the same developers. It is also reasonable to think that the same developers will probably release more clone ransomware-type programs to generate as much money as they can before the gig is up. We believe that the developers use email spam to infect the computer’s of unwary, curious users. The emails are sent to random email addresses and they are probably tailored to impersonate legitimate companies. They may use their logos to give people a false sense of legitimacy. The emails can be disguised as tax return forms, invoices, receipts and so on. The emails contain the ransomware in an attached file that will infect your PC with Crystalcrypt Ransomware once you open it.

Apparently, Crystalcrypt Ransomware uses the RSA 2048 and AES 256 algorithms to encrypt your files. We believe that this ransomware creates a public encryption and private decryption keys and sends the decryption key to a remote server to be stored until the ransom is paid. Since this program is relatively new, a free decryption key has not been developed but it might be if malware researchers are successful. In any case, Crystalcrypt Ransomware is a major problem as was configured to encrypt pictures, documents, executables, and other files. Nevertheless, it leaves vital executables alone as not to disrupt the functionality of the operating system.

While encrypting your files, this ransomware will append them with a “.BLOCKED” file extension, but will not change the original names of the files. Once this program completes the encryption, it drops a text file in each folder where files have been encrypted. The name of this text file is CrystalCrypt_Recover_Instructions.txt. The information inside the text file says that you need to pay 0.17 Bitcoins which is an approximate 475 USD. Evidently, your files may not be worth that kind of money, so the obvious solution would be to simply delete this ransomware as well as the encrypted files and try to restore as many encrypted filed from remote storage drives. The ransom note also features links where you can buy Bitcoins and also where to send them.

In closing, Crystalcrypt Ransomware is one of many ransomware- type programs that you can get via email spam, so you should take caution when opening unknown emails from shady addresses as well as emails that the email provider redirected to the Junk Box. If your PC becomes infected with this ransomware, then you will be unable to get your files for free as there is no free decryptor yet. However, paying the ransom might not be an option for you and we discourage you from doing so as complying with cyber criminals will only serve to embolden and encourage to produce more malware. We suggest that you use SpyHunter’s free scanner to locate the malicious files and then go to their respective locations and remove them.

Removal Instructions

1. Open your web browser.
2. Go to http://www.pcthreat.com/download-sph
3. Download SpyHunter-Installer.exe and run it.
4. Launch the program and click Scan Computer Now!
5. Copy the file path of the malware from the scan results.
6. Simultaneously press Windows+E keys.
7. Enter the file path of the malware in File Explorer’s address box.
8. Press Enter.
9. Find and right-click the malicious file and then click Delete.
10. Empty the Recycle Bin.