CrazyCrypt Ransomware

If CrazyCrypt Ransomware invades your Windows system and encrypts your personal files (e.g., photos and documents), it instructs you to pay a ransom within 72 hours. Although cyber attackers want you to believe that this is the only option you’ve got, our research team warns that it is very unlikely that you would get a decryptor if you fulfilled the attackers’ demands. Unfortunately, at the time of research, it was not possible to decrypt files in any way. That being said, it is believed that a legitimate and free decryptor will be made public at some point. Therefore, if your files are corrupted and you do not have backup copies as replacement, you might want to look and see if a decryptor has been made public. If we learn anything about this tool, we will update this report as soon as possible. For now, all we can do is remove CrazyCrypt Ransomware, and, needless to say, this task is extremely important. Note that you must delete this infection regardless of whether or not your files are restored in the end.

Just like Jigsaw Ransomware, JCry Ransomware, Scarab-dy8wud Ransomware, and hundreds of other threats alike, CrazyCrypt Ransomware is all about encrypting personal data. To ensure that the attack is possible, the creators of this malware have to find a way to drop it without you realizing it. It is very likely that this malware could use spam emails to trick you into opening the malicious launcher file yourself, but we do not reject the possibility that other methods could be employed too. Once in place, CrazyCrypt Ransomware starts encrypting files immediately. To ensure that you cannot remove the threat – in case you do find it before the attack is complete – it terminates cmd.exe, msconfig.exe, regedit.exe, and taskmgr.exe processes. On top of that, this infection can successfully edit the Windows Registry to create a bunch of new entries that are supposed to aid ransomware. Ultimately, all is done to ensure that your personal files are encrypted and that you are introduced to the attackers’ demands. These demands are represented via the infection’s window and a file named FILES ENCRYPTED.txt that you can remove from the Desktop.

The text file created by CrazyCrypt Ransomware informs that you can restore your personal files if you email a unique ID code to crazycrypt@bk.ru. The same email address is represented via the window that the infection launches. This window is, without a doubt, much more intimidating; partially because you cannot close it normally. Since some of the most important Windows processes are terminated too, you might think that your operating system is paralyzed. Luckily, the infection does not auto-start with Windows, and that means that the next time you restart your computer, you should be free to delete CrazyCrypt Ransomware. Of course, before that, you might be interested in checking out the damage. The files that this malware encrypts are given the “.id.[unique ID].[crazydecrypt@horsefucker.org].crazy” extension, and so it should not be difficult for you to spot them. As you can see, the extension includes a new email address, and you might be able to use it to contact the attackers too. Of course, we do not recommend it because all that cyber criminals want from you is your money, and if you contact them, they will get a chance to make you pay a ransom. Remember that that is unlikely to help you achieve anything.

Hopefully, when you restart your computer, CrazyCrypt Ransomware does not run and terminate processes or launch screen-locking windows. If that is the case, it should be easy for you to download and run a legitimate anti-malware program. We recommend using this tool because it can guarantee that all malicious components are eliminated at once. It also can help you secure your operating system, which is crucial because if one file-encryptor managed to slither in, who knows which other threat could attack next? If you have the desire to delete CrazyCrypt Ransomware manually, you need to think very carefully if you are ready for the task. There are quite a few registry entries that must be eliminated, and doing that manually can be tough if you do not have experience with the process. That being said, if you are cautious, you might be able to remove the infection using the instructions below.

CrazyCrypt Ransomware Removal

1. Delete ALL recently downloaded suspicious files (specifically look for .exe files).
2. Delete the ransom note file named FILES ENCRYPTED.txt from the Desktop.
3. Tap Win+R keys to launch the RUN dialog box.
4. Type regedit.exe and click OK to launch Registry Editor.
5. Navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection.
6. Delete these values:
   • DisableRealtimeMonitoring
   • DisableBehaviorMonitoring
   • DisableOnAccessProtection
   • DisableScanOnRealtimeEnable
7. Navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender.
8. Delete the value named DisableAntiSpyware.
9. Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
10. Delete the value named ConsentPromptBehaviorAdmin.
11. Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Systemm.
12. Delete these values:
    • ConsentPromptBehaviorUser
    • EnableLUA
13. Empty Recycle Bin.
14. Scan your operating system using a legitimate malware scanner to check for malware leftovers.