Cryptodark Ransomware

Posted by Lisa Blanc on July 10, 2017

What is Cryptodark Ransomware?

Cryptodark Ransomware is a recently detected malicious application. Unlike ransomware infections previously analyzed by researchers working at anti-spyware-101.com, it does not encrypt files at the time of writing; however, despite this finding, it has still been classified as ransomware because it demands money. Have you encountered this threat too? If so, do not send a cent to the cyber criminals’ Bitcoin address despite the fact that a window with a ransom note has covered your Desktop because it can be easily removed and, additionally, it is very likely that none of your files have been locked. What you should do instead is to remove the ransomware infection from your system fully. Before you take action, you need to close the window opened on your screen by Cryptodark Ransomware so that it would be possible to remove all its components. This can be done by right-clicking on the icon of the ransomware infection located on the Taskbar and selecting “Close window.” Also, since this threat does not automatically start with the Windows OS, it should be enough to restart the computer to be able to access Desktop freely. test test test

What does Cryptodark Ransomware do?

Specialists are sure that Cryptodark Ransomware is not one of those sophisticated ransomware infections because it does not create an entry in Startup or the Run registry key for starting together with the Windows OS. Also, it does not encrypt any files at the time of writing. This suggests that it does not work completely properly, it is still in development, or cyber criminals only seek to scare users into believing that their files are locked by placing a window that does not allow them to immediately check their files over Desktop. In fact, putting a window on Desktop is not the only activity Cryptodark Ransomware performs on computers it affects. Research conducted by our malware analysts has shown that this infection also sets a new image as Desktop background after the successful entrance. Both the window opened and the new wallpaper tell users that their files have been encrypted and they can recover them only by sending “$300 worth of Bitcoin” to the provided Bitcoin address. Then, the received decryption key has to be entered in the box under Decryptor. Even though cyber criminals promise to send the key for decrypting files right away after receiving money, you have no guarantees that you will get it. As has been mentioned above, it is very likely that you do not even need it, so do not rush to send the ransom to cyber crooks. Do not transfer them money even if you encounter a version of Cryptodark Ransomware locking files because it is possible to restore them from a backup.

Where does Cryptodark Ransomware come from?

It is not easy to talk about the Cryptodark Ransomware distribution because it has not infected many computers yet and, consequently, not much is known about its dissemination. According to specialists at anti-spyware-101.com, even though it is still not clear how it is spread, the possibility is high that it travels in spam emails like other ransomware-type infections do. In addition, cyber criminals might place it on third-party pages and promote it as a decent application. We can assure you that you will soon find out about the entrance of this threat. You will not only discover a window with a ransom note on Desktop, but will also find a new wallpaper set. Additionally, if you close the ransomware infection’s window, you could notice four new files created: 1.CRYPTODARK, 2.CRYPTODARK, CryptoDark Decryptor.lnk, and CRYPTODARKBACKGROUND.BMP. Luckily, this ransomware infection is not one of those threats that block system utilities or make drastic changes in the system registry.

How to delete Cryptodark Ransomware

Since Cryptodark Ransomware is not one of those ransomware-type infections making major changes on affected computers, we believe that users could remove it from their computers manually if they follow our manual removal guide (see below this paragraph). If it happens that you do not find our instructions very helpful or do not have time for deleting all its components manually, you should use an automated malware remover in this case. Click on the Download button to get a free diagnostic scanner.

Remove Cryptodark Ransomware

Reboot your computer to close the window of Cryptodark Ransomware OR right-click on the icon of this infection in the Taskbar and select Close Window.
Press Win+R simultaneously on your keyboard.
Enter regedit.exe in the box and click OK.
Move to HKEY_CURRENT_USER\Control Panel\Desktop.
Right-click on WallPaper and select Modify.
Clear the Value data field and click OK.
Close the Registry Editor and open the Windows Explorer by simultaneously tapping Win+E.
Right-click on the CryptoDark Decryptor.lnk file located on Desktop and select Open file location.
Delete the executable file of Cryptodark Ransomware.
Delete the following files one after the other from %USERPROFILE%\Desktop and empty the Recycle bin: