Cring Ransomware - How to remove

Cring is ransomware. It infects your computer, encrypts files, changes their names, and then leaves a note demanding that you send 2 Bitcoins (some 50 thousand dollars at the moment – an absurd price) to the criminals behind Cring so that they will fix your files.

Cring is still new, so there’s still not much known about this ransomware. Luckily, there are ways in which you might be able to undo some of the damage that it caused.

About Cring ransomware:

Threat type	Ransomware.
Symptoms of Cring ransomware infection	Some files have their names changed, those files can’t be opened or their contents are corrupted, ransom notes are present on your computer.
How to get your files back	Restore your files from a backup, use data recovery tools, wait for a free decryption solution.
How to remove Cring and other malware	Use antivirus scanners (Spyhunter, others) to remove malicious and suspicious programs, check your security settings.

How Cring ransomware works

Infection symptoms

Cring is file-encrypting ransomware – it uses cryptography to scramble data and basically corrupt files. It goes through the files on the computer, such as Office and other documents, archives, etc. It encrypts their contents, making the files impossible to open or corrupting a portion of their data.

Cring also changes the names of the encrypted files, adding “.cring” as though it was a file type extension.

For instance, a file previously called “scan.pdf” might become “scan.pdf.cring”.

Besides breaking your files, Cring leaves behind a text file called “deReadMe!!!.txt”. This ransom note says that the people responsible for Cring want up to 2 Bitcoins in exchange for fixing your files. It’s an absurd price.

The extortionists say that they “have a good reputation”, but they surely do not – it’s not known who these people are and if they’re responsible for any other malware attacks.

Sorry, your network is encrypted, and most files are encrypted using special technology. The file cannot be recovered by any security company. If you do not believe that you can even consult a security company, your answer will be that you need to pay the corresponding fees, but we have a good reputation. After receiving the corresponding fee, we will immediately send the decryption program and KEY. You can contact us to get two file decryption services, and then you will get all decryption services after paying our fee, usually the cost is about 2 bitcoins.

Contact: [email protected]     [email protected]

How Cring infects computers

Cring ransomware attacks Windows computers. Here’s how ransomware viruses typically spread:

• They are hidden in free (pirated) installers and other files, then uploaded on the internet and made available for download (Djvu ransomware spreads this way).
• They are included as attachments to a generic email and then sent out to random addresses (DeroHE is a recent example).
• Malicious ads try to trick people into downloading ransomware and other malware.
• Remote Desktop Protocol attacks, where cybercriminals guess login credentials and infect vulnerable PCs (Phobos ransomware).

Antivirus software should be able to detect Cring. Currently, one sample of Cring ransomware (Virustotal.com) gets flagged as Ransom, Filecoder, Unsafe, Trojan, and Malware.

If your antivirus software didn’t detect Cring, then the ransomware variant might have been very new still and not yet known to antivirus vendors. Or maybe malware disabled your antivirus tools as some malicious apps do.

Can you get your files back?

You might be tempted to negotiate with the criminals for a lower price. But it’s not advised.

Even if Cring’s creators weren’t asking for an absurd amount of money to fix your files, they probably can’t even fix the files that they broke. If Cring ransomware is new, then there’s no doubt that there are technical problems and bugs that haven’t been ironed out yet.

It might be better to try and fix the situation yourself:

• Cring might have left some of your files untouched.
• If you had a backup of your files, then all you need to do is remove Cring and restore your files from a backup.
• You can try and do a System Restore and recover previous file versions.
• If your backups were deleted, try using a data recovery program to bring back deleted data.

It’s also possible, in theory, that a free decryptor for Cring ransomware might be released at some point. Don’t bet on it, but do check Nomoreransom.org from time to time.

Most importantly, don’t trust people who say they can fix your files for a fee. Don’t pay them unless you’re absolutely sure they’re not lying. There are scammers out there, preying on the victims of ransomware. Be careful of them.

How to remove Cring ransomware

To get your computer back and to be able to use it normally again, it’s necessary to remove Cring and all other malicious programs. You can use an antivirus program, like Spyhunter, to scan your PC and remove all infections.

You might need to use safe mode to effectively catch and remove all malware. You might also need to get back Task Manager and Registry Editor manually.

Remember that backups are a good defense against ransomware attacks. Always have a backup of your files.

Automatic Malware removal tools

How to recover Cring Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Cring Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Cring Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Cring Ransomware. You can check other tools here.  

Step 3. Restore Cring Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Cring Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Cring Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.