Trojan:Win32/Crilock.A

Posted by Lisa Blanc on September 23, 2013

What is Trojan:Win32/Crilock.A?

Trojan:Win32/Crilock.A is a malicious computer infection that can be also categorized as ransomware, because it denies you desktop access and demands a ransom fee. Although Trojan:Win32/Crilock.A seems to be different from Ukash Virus group infections as it displays a slightly different message, it still employs the same tactics in order to steal your money. It goes without saying that it is necessary to remove Trojan:Win32/Crilock.A from your computer. Although it may seem impossible as the Trojan keeps your screen locked, there is a way to bypass this obstacle. Refer to the instructions below this description to unlock your screen, and then invest in a reliable antimalware tool to remove Trojan:Win32/Crilock.A for good.

Where does Trojan:Win32/Crilock.A come from?

It is very likely that Trojan:Win32/Crilock.A is downloaded onto your computer by other malware, so it is necessary to perform regular system scans to avoid serious malware infections. What is more, this infection is known to encrypt your personal files and it may be hard to fix the damaged files once the damage has been done. Since Trojan:Win32/Crilock.A affects an extensive number of files (with such extensions as .docx, .xls, .pptx, .jpe, .ptx, .srw and so on), once you remove the Trojan from your computer, you may need to restore your damage files from the backup.

What does Trojan:Win32/Crilock.A do?

Once Trojan:Win32/Crilock.A drops a copy of itself in %APPDATA% director, it makes changes in the registry subkey HKCU\Software\Microsoft\Windows\CurrentVersion\Run by setting a value “CryptoLocker” which allows the malicious program to run each time you turn on your PC.

When that is set, Trojan:Win32/Crilock.A displays a screen-sized webpage window that does not allow you to access your desktop. The window contains a notification that reads:

Your personal files are encrypted!
Your important files encryption produced on this computer: photos, videos, documents, etc.
To decrypt files you need to obtain the private key.
To obtain the private key for this computer, <…>, you need to pay 100 USD/100EUR/similar amount in another currency.

Unlike Ukash Virus infections, Trojan:Win32/Crilock.A does not accuse you of doing anything illegal, but demands for a ransom fee up straight. It also gives you 72 hours to pay the fee via MoneyPak, PaySafeCard, Ukash or cashU alternative payment systems.

It is very unlikely that Trojan:Win32/Crilock.A will unlock your system even if you pay the money, so do not spend it on nothing.

How to remove Trojan:Win32/Crilock.A?

Since Trojan:Win32/Crilock.A can connect to a remove server in order to download the key used for the encryption process, you need to react immediately and terminate the infection at once. Below you will find instructions that will tell you how to unlock your desktop. Once you get your screen back, get yourself a powerful computer security application at once and remove Trojan:Win32/Crilock.A immediately.

How to restore desktop access

Windows 8

Press Windows key and metro Start menu will open.
Click Internet Explorer tile.
Enter http://www.anti-spyware-101.com/download-sph into the address bar and press Enter.
Click Run on download dialog box and install SpyHunter.
Run a full system scan.

Windows Vista & Windows 7

Reboot the PC and press F8 several times until Advanced Boot Options menu appears.
Use arrow keys to navigate and select Safe Mode with Networking. Press Enter.
Access http://www.anti-spyware-101.com/spyhunter and download SpyHunter.
Install the program and run a full system scan.

Windows XP