How to Delete CryptoManiac Ransomware (Crypto-Malware/Ransomware)

What is CryptoManiac ransomware? And how does it perform its attack?

CryptoManiac ransomware is a file-encoding malware designed to encrypt files to leave them inaccessible to its victims. It demands victims to pay ransom in exchange for data recovery. It makes use of the AES cipher in corrupting its targeted files and insists on paying $500 in Bitcoins as soon as possible. Cybercriminals behind CryptoManiac ransomware encourage its victims to use the REQUEST RESTORE tool to recover their encrypted files.
CryptoManiac ransomware infects system through a file named CryptoManiac.py according to the analysis done by security experts. Various techniques could be used in distributing this malicious file. Once it reaches the targeted system, the malicious file will install CryptoManiac ransomware in the system and initiate a sequence of malicious operations to ensure persistence. After that, it scans the entire drive of the computer looking for files to encrypt. It most likely targets files with the following extensions:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .c, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa.wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .mkv, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .rar, .zip, .7zip, .jpg, .jpeg, .txt, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt, .csv, .sql, .mdb, .sln, .php, .asp, .aspx, .html, .xml, .psd
Once it is able to finish the encryption on the targeted files, it drops two different kinds of ransom notes but both have the same content such as:
“CRYPTOMANIAC
All your files have been encrypted by CRYPTOMANIAC!
All your files have been encrypted due to a security problem with your PC.
If you want to restore them, run the REQUEST RECOVERY application that will be automatically downloaded by CRYPTOMANIAC, if it is not automatically downloaded visit this link
***
You have to pay for decryption in Bitcoins.
The price is usually $500 worth of Bitcoin.
After payment, you will be mailed the decryption tool that will decrypt all your files.
Free decryption as guarantee before paying you can get it from the REQUEST RECOVERY tool.
The free decryption tool only decrypts 10 files of the following extensions
***
How to obtain Bitcoins.
The easiest way to buy bitcoins is LocalBitcoins site.
You have to register, click ‘Buy bitcoins”, and select the seller by payment method and price, https/localbitcoins.com/buy_bitcoins
Also, you can find other places to buy Bitcoins and beginners guide here: http/www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not attempt to use a file recovery software like Recuva or windows recovery, as this attempt is useless and futile as CRYPTOMANIAC destroys windows shadow volume making it unrecoverable.
Do not rename encrypted files.
Do not try to decrypt your data using thud party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.
Please note that 250 of your personal files will be permanently deleted when the program resets either by terminating it or by a system reboot and 25 files will be permanently deleted every 60 minutes, so pay fast to reduce amount of files that will be permanently lost
Extra links to download REQUEST RECOVERY tool in case the one above is not available.
***”
How does CryptoManiac ransomware spread its malicious file?
CryptoManiac ransomware reaches the system by opening a spam email containing the CryptoManiac.py file. So you have to beware of opening emails no matter how interesting it may seem. Cybercriminals have gotten wiser in disguising their malware-laden emails so you must stir clear from any suspicious-looking emails as much as possible.
Refer to the instructions below for the successful removal of CryptoManiac ransomware.
Step 1: Close the ransom note of CryptoManiac ransomware and tap the Win + E keys to open File Explorer.
Step 2: Navigate to the following locations and look for the malicious files created by CryptoManiac ransomware such as named CryptoManiac.py and Readme_to_recover_files, and delete them al.

%TEMP%
%APPDATA%
%DESKTOP%
%USERPROFILE%\Downloads
%HOMEDRIVE%\user | ransom.jpg
%USERPROFILE%\Desktop | READ_IT.txt

Step 3: Close the File Explorer and tap Ctrl + Shift + Esc keys to open the Task Manager.

Step 4: After opening the Task Manager, look for CryptoManiac ransomware’s malicious process, right click on it and select End Process or End Task.

Step 5: Close the Task Manager.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 6: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 7: Navigate to the following path:
HKU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Step 8: Look for any suspicious values created by CryptoManiac ransomware and delete them.
Step 9: Close the Registry Editor and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 10: Look for CryptoManiac ransomware or any suspicious program and then Uninstall it/them.

Step 11: Empty your Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if CryptoManiac ransomware hasn’t deleted the shadow volume copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Ensure the removal of CryptoManiac ransomware from your computer as well as the malicious files it created with the help of the advanced removal instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.