CryMore Ransomware

Posted by Max Lehmann on June 15, 2017

What is CryMore Ransomware?

CryMore Ransomware presents itself as a ransomware infection, but it differs from such typical ransomware infections as CryptoGod Ransomware, TheDarkEncryptor Ransomware, or Executioner Ransomware in a sense that it does not encrypt any files stored on affected computers. We do not know 100% whether it is still in development or the sample tested by specialists at anti-spyware-101.com was not working fully, but we are sure that, at the time of writing, this ransomware infection does not encrypt any files even though the window it opens for users on their Desktops claims that their all files have already been encrypted and they need to purchase a decryption tool to get them back. Strangely, no information about the payment is provided on this window, and users do not even know the price of the decryption tool. In other words, it is impossible to send cyber criminals money in exchange for the decryption tool. Because of this, our specialists believe that it is still in development or not working properly. Either way, remove CryMore Ransomware from your system without consideration and do not send cyber criminals a single cent. test

What does CryMore Ransomware do?

Although we cannot prove that CryMore Ransomware really encrypts files, it has still been placed under the ransomware category because it demands money from users. Unfortunately, we cannot promise that your files will not be touched too after the infiltration of this infection because a new version of this threat might be released soon. In any event, you will definitely find a window opened on your Desktop. It will tell you that it is impossible to access files because they have all been locked using a strong encryption algorithm AES. Also, users are told not to try to decrypt files without the special tool because this might result in the permanent loss of personal data. Without a doubt, the developer of CryMore Ransomware wants to convince users that they need to purchase the decryption key. Since this threat does not work properly, we cannot say what the size of the ransom it demands is. We only know that it has to be transferred to cyber criminals in Bitcoins. Most probably, you do not even need this key because your files have not been locked; however, if you discover documents, pictures, and other important files encrypted, you should not purchase the decryptor from cyber criminals either. It is a bad idea because you might get nothing in return. That is, your files might stay locked if you have encountered a version of CryMore Ransomware encrypting threats, and this malicious application will surely not be automatically erased from your system.

Where does CryMore Ransomware come from?

Ransomware creators distribute ransomware-type infections in a variety of ways, but, as researchers at anti-spyware-101.com have managed to find out, they are often spread in spam emails as attachments. Of course, they do not enter PCs just because a user receives such an email with a malicious attachment. What we try to say here is that users contribute to the entrance of this infection by opening attachments from spam emails. Of course, we do not blame them because they are not told that malware is attached to an email. Instead, the attachment is usually made to look like an important document/file. It is very likely that CryMore Ransomware is mainly distributed using this method too; however, you should still be cautious because other methods might be adopted too. For example, it might be promoted as highly beneficial software on P2P websites and other third-party pages. We have to admit that it is usually not a piece of cake to protect the system from ransomware. Because of this, we highly recommend enabling security software on all machines connected to the Internet.

How to remove CryMore Ransomware

It does not matter you have discovered your files encrypted or not because you need to remove CryMore Ransomware fully either way. First, close a window opened on your Desktop. There are two ways to do that: a) tap Alt+F4 or b) kill the process of the ransomware infection. Then, remove all suspicious files you find in %APPDATA%, %TEMP%, %USERPROFILE%\Downloads, and %USERPROFILE%\Desktop. These are directories where untrustworthy files are found the most frequently, but, of course, the malicious file of CryMore Ransomware might be anywhere on your PC. If it happens that you cannot find it anywhere, scan your computer with an automatic malware remover.