I wrote this article to help you remove Cryptorium Ransomware. This Cryptorium Ransomware removal guide works for all Windows versions.
Cryptorium is a member of the dreaded ransomware family. These file-locking programs are considered the most dangerous cyber infection we can possibly get stuck with. They sneak into your system, encrypt all of your files and then blackmail you for money. Your bank account is each ransomware`s main goal. Cryptorium is no different. As soon as it slithers is it proceeds to step number two.
First, it performs a thorough scan of your machine in search for your private files. And it does find them all. Pictures, videos, music, documents, presentations, Word files, work-related files, etc. They all get locked with the strong AES-256 encryption algorithm which makes them inaccessible to you. You are not able to open/see/watch/listen to any of them. The ransomware has turned all your data into useless gibberish.
Unlike most ransomware infections, however, this one doesn’t append an extension at the end of each locked file. But your data is still being kept hostage. And, according to the cybercriminals, the only way of freeing it is by obtaining a special decryption key. The tool, of course, doesn’t come for free. It is exactly what you are supposed to pay for.
Do you see how Cryptorium, instead of stealing your credit card number, for example, makes you give it your money voluntarily? This is a quite clever method as when you see all your private files locked it is not hard for you to panic. And then you will be more likely to do whatever it takes to get them back. This is when the ransomware displays its ransom note.
Usually, this is a text file in which the crooks explain your current situation and provide you with detailed payment instructions. Cryptorium drops its ransom note in each file which contains encrypted data. Your desktop wallpaper gets modified as well. The idea it the more often you see the message the bigger the change of complying gets. The Cryptorium`s note reads the following:
As you can see, the crooks give you a 32 hour deadline within which you have to pay, otherwise they threaten to delete your data. Don’t panic. This is exactly what these people want. They are using scare tactics to play mind games with you. Don’t let them fool you. You have to understand that paying is not an option. If not anything else, it will worsen your already pretty bad situation.
No matter how much money the crooks require, don’t give it to them. It is all a scam. You can never be sure that once you pay you will receive the said “GBO KEY”. Most of the times crooks don’t deliver. They just take your money and your files remain locked. Moreover, the note itself says that all server are down at the moment.
This means that it is simply impossible for you to receive the decryption even if you pay. Not to mention that if you do pay you automatically become a sponsor of the ransomware industry. Do you want your money to be used for more malware creation? Do you want to help hackers expand? If not, forget about paying. Use our detailed removal guide below. It is easy to follow and completely free. All you have to do is do the steps in the exact order shown. You can recover your encrypted data without having to pay a single cent.
However, aside from removing this ransomware now, you have to make sure you won`t get infected again. Cryptorium travels the Web in an illegitimate FIFA 2017 version. It tricks you. And where do you get such illegitimate programs? From unverified sources of course. Stay away from such pages/ads/torrents/links etc. More often than not, they deliver infections. You should always be on the alert when online as threats are lurking from everywhere and the thing they need the most if your carelessness.
Think twice before opening a shady email or before clicking on an ad. If you are a little bit more attentive you can spot an intruder on time. Also, get a good anti-malware program, keep it up to date and perform regular scans of your machine to be sure it is parasite-free. And last but not least, a piece of advice for the future. Always create backups of your most important files. This way you will be sure that whatever happens, your files remain intact.
Cryptorium Ransomware Removal
Method 1: Restore your encrypted files using ShadowExplorer
Usually, Cryptorium Ransomware deletes all shadow copies, stored in your computer. Luckily, the ransomware is not always able to delete the shadow copies. So your first try should be restoring the original files from shadow copies.
- Download ShadowExplorer from this link: http://www.shadowexplorer.com/downloads.html.
- Install ShadowExplorer
- Open ShadowExplorer and select C: drive on the left panel
- Choose at least a month ago date from the date field
- Navigate to the folder with encrypted files
- Right-click on the encrypted file
- Select “Export” and choose a destination for the original file
Method 2: Restore your encrypted files by using System Restore
- Go to Start –> All programs –> Accessories –> System tools –> System restore
- Click “Next“
- Choose a restore point, at least a month ago
- Click “Next“
- Choose Disk C: (should be selected by default)
- Click “Next“. Wait for a few minutes and the restore should be done.
Method 3: Restore your files using File Recovery Software
If none of the above method works, you should try to recover encrypted files by using File Recovery Software. Since Cryptorium Ransomware first makes a copy of the original file, then encrypts it and deletes the original one, you can successfully restore the original, using a File Recovery Software. Here are a few free File Recovery Software programs:
