Kriptor Virus (. Kriptor Files Ransomware) — How to Remove?

What is known about the Kriptor ransomware?

Kriptor will append its own .Kriptor extension to every file’s name. For example, an image named “photo.jpg” will be altered to “photo.jpg.Kriptor”. Likewise, the Excel sheet named “table.xlsx” will end up as “table.xlsx.Kriptor”, and so forth.

In every directory containing the encoded files, a read_it.txt text file will appear. It is a ransom money note. Therein you can find information on how to contact the racketeers and other information. The ransom note usually contains instructions on how to buy the decryption tool from the ransomware developers. You can get this decrypting software after contacting , by email. That is it.

The read_it.txt document accompanying the Kriptor ransomware provides the following discouraging information:

Don\'t worry, you can return all your files!

All your files like documents, photos, databases and other important are encrypted

What guarantees do we give to you?

You can send 3 of your encrypted files and we decrypt it for free.

You must follow these steps To decrypt your files :   
1) Write on our e-mail : ( In case of no answer in 24 hours check your spam folder
or write us to this e-mail: )

2) Obtain Bitcoin (You have to pay for decryption in Bitcoins.
After payment we will send you the tool that will decrypt all your files.)

In the picture below, you can see what a folder with files encrypted by the Kriptor looks like. Each filename has the “.Kriptor” extension appended to it.

How did my machine catch Kriptor ransomware?

There are currently three most exploited ways for criminals to have the Kriptor virus acting in your system. These are email spam, Trojan injection and peer file transfer.

If you access your mailbox and see letters that look just like notifications from utility services providers, delivery agencies like FedEx, Internet providers, and whatnot, but whose mailer is unknown to you, beware of opening those emails. They are most likely to have a harmful file attached to them. So it is even riskier to open any attachments that come with emails like these.

Another option for ransom hunters is a Trojan virus scheme². A Trojan is a program that infiltrates into your computer pretending to be something else. Imagine, you download an installer for some program you need or an update for some service. However, what is unpacked reveals itself a harmful agent that encrypts your data. Since the installation package can have any name and any icon, you’d better be sure that you can trust the source of the things you’re downloading. The optimal thing is to trust the software companies’ official websites.

As for the peer networks like BitTorrent or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never know what you download until you get it. Our suggestion is that you use trustworthy websites. Also, it is a good idea to scan the folder containing the downloaded items with the anti-malware utility as soon as the downloading is complete.