June 14, 2016
Trojan.Encoder.4393, also known under the name of CryptXXX, is a typical ransomware Trojan. It has several modifications that are being spread all over the world. To make more money on their illegal activity, virus makers created a special service responsible for paid file decryption. A certain interest rate goes to those who distribute the Trojan. All the CryptXXX modifications connect to one C&C server. Websites that offer the paid file decryption use the TOR network. Wide geography of the infection cases proves the popularity of this affiliate program and of the Trojan itself among attackers. All encrypted files are appended with the *.crypt extension, and files containing cybercriminals' demands are named as de_crypt_readme.txt, de_crypt_readme.html, and de_crypt_readme.png.
If you have fallen victim to this malicious program, and files on your computer were encrypted before June 2016, it is possible to restore the compromised data. However, it depends on several conditions and especially on the user’s actions.
To decrypt files compromised with CryptXXX, go to the Doctor Web decryption service page. Free decryption services are only available to users who have valid commercial Dr.Web licenses and whose systems—at the moment of infection—were protected by Dr.Web Security Space (Windows) or by Dr.Web Anti-virus for OS X or Linux (version 10 or later) or by Dr.Web Enterprise Security Suite (6+). Other users can purchase Dr.Web Rescue Pack by sending the standard request form: the service is charged if the analysis shows that your files can be recovered. Besides, clients who used this service can get free two-year license for Dr.Web Security Space for 1 computer. To find more information about ransomware Trojans, follow this link.
Tell us what you think
To ask Doctor Web’s site administration about a news item, enter @admin at the beginning of your comment. If your question is for the author of one of the comments, put @ before their names.