Terminating 3nCRY Ransomware (Crypto-Malware)

What is 3nCRY ransomware? And how does it carry out its attack?

3nCRY ransomware is a new computer virus designed to encrypt files leaving them unreadable to users. 3nCRY ransomware carries out a typical ransomware attack – it encrypts files and then demands ransom in exchange for a decryption key. However, this isn’t a like other typical ransomware as it uses a strong encryption algorithm in its attack leaving files nearly impossible to recover without a decryption key.
Before the encryption, 3nCRY scans the computer for files to target. It mainly targets files like images, videos, documents, databases, audio, archives and other important files. After encrypting them, the ransmware adds the .3nCRY extension on each files and places a file named READ_ME.txt on the encrypted files’ folder. The text file contains the ransom note that has the following message:
“Hello,
Your files are encrypted.
Pay 0.5 BTC (bitcoin)
Your files will be decrypted 48 hours after receipt of payment.
cordially
adresse: 1J853DwYBASNegyhLsZF1YkD7JzGnJ1U2J
————————————————————–
Hola,
Sus archivos están encriptados.
Pague 0.5 BTC (bitcoin)
Sus archivos serán descifrados 48 horas después del recibo del pago.
cordialment
eAdresse: 1J853DwYBASNegyhLsZF1YkD7JzGnJ1U2J
————————————————————–
Olá,
Seus arquivos estão criptografados.
Pagando 0.5 BTC (bitcoin)
Seus arquivos serão descriptografados 48 horas após o recebimento do pagamento.
Cordialmente
Adresse: 1J853DwYBASNegyhLsZF1YkD7JzGnJ1U2J
————————————————————–
你好，
您的文件已加密。
支付0.5 BTC（比特币）
您的文件将在收到付款后48小时解密。
亲切
地址：1J853DwYBASNegyhLsZF1YkD7JzGnJ1U2J
————————————————————–
Здравствуйте,
Ваши файлы зашифрованы.
Оплатить 0.5 BTC (биткойн)
Ваши файлы будут расшифрованы через 48 часов после получения оплаты.
сердечно
адресуют: 1J853DwYBASNegyhLsZF1YkD7JzGnJ1U2J”
As you can see, the ransom note is written in different languages such as English, Spanish, Portuguese, Chinese and Russian to make sure that victims in multiple geographical locations understand what’s going on. 3nCRY perpetrators demand a large ransom of 0.5 Bitcoins to a specified Bitcoin wallet. Malware security experts do not recommend paying the crooks this huge amount as there are no guarantee that they’ll do their end of the bargain which is to give you the decryption key. The best thing that you could do is to seek backup copies of your important files, if you even have one. If not, you can try recovering them using their Shadow Volume copies. – take note that this kind of recovery method would only work if 3nCRY haven’t deleted the Shadow Volume copies of your files.

How does 3nCRY ransomware proliferate?

File-encrypting Trojans like 3nCRY often reach their victim’s computer through spam email attachments or embedded links. Usually, these kinds of email messages prompts users to click on a link or download an attached file which arrives via social engineering techniques. And once you download the attachment or click the link, that’s when the ransomware is downloaded and installed in your computer.
Moreover, 3nCRY can also get installed directly on your computer through gaining access and taking advantage of unsecured Remote Desktop Protocol or RDP connections, weak passwords and other precarious security to obtain access to your computer. To protect your computer from these kinds of attacks, it is recommended to always keep your system and antivirus program updated.
Terminate the malicious ransomware with the help of the removal guide below.
Step 1: Tap Ctrl + Shift + Esc to open the Task Manger.

Step 2: Once you’ve opened the Task Manager, go to the Processes tab and look for 3nCRY ransomware’s process and end it.

Step 3: Open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.

Step 4: Look for 3nCRY ransomware or any suspicious program and then Uninstall it/them.

Step 5: Tap Win + E keys to launch File Explorer.
Step 6: Navigate to the following locations below and look for 3nCRY ransomware’s malicious components such as READ_ME.txt and other suspicious files and then delete all of them.

%TEMP%
%APPDATA%
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 7: Close the File Explorer. Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then by all means go on to the next steps.
Step 8: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 9: Navigate to the following path:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Step 10: Delete the registry keys and sub-keys created by 3nCRY ransomware.
Step 11: Close the Registry Editor and empty your Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if 3nCRY ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

To make sure that nothing is left behind and that the 3nCRY is completely removed, use the following antivirus program. To use it, refer to the instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the Safe Mode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. Installation will start automatically once download is done.