Krypton Ransomware - How to remove

Krypton Ransomware is dangerous computer virus that should be not confused with Kryptonite ransomware due to the similar name. In fact, they are completely separate and different virus, even though both of them are looking to encrypt your files and ask for the ransom in order to unlock them.

The main difference between those two viruses is the extension that is added to the files after they are encrypted. As you might already know, ransomware viruses add specific extensions and they all vary depending on the particular ransomware. However, while Kryptonite does not add any extension, Krypton virus is using extension “.kryptonite”. Yes, that might be confusing and maybe that’s what cyber criminals wanted?

It is not clear how this ransomware is being distributed, although most likely way for Krypton to enter your computer is as an attachment to some email from spam category. So when you receive some fishy email, be very careful about it – never open emails or attachments to emails from spam category.

Specifics of Krypton virus

We have already mentioned that once inside of your computer Krypton will encrypt files stored on your hard drive. After extension “.kryptonite” is added to your files, you won’t be able to use them anymore. This Krypton infection is based on Hidden Tear ransomware project, as well as LimeDecryptor and File-Locker ransomware, therefore files affected by this infection are very difficult to decrypt.

Immediately after the encryption is over, you will notice a new files on all folders with encrypted files called “KRYPTON_RASOMWARE.txt”. Also, the virus will automatically change your desktop wallpaper.

If you open that file, here’s the message you will see:

What has happened?
Sorry for the inconvenience, but your computer has been infected with KryptonRansom (1.0.10.2).
All your personal files are encrypted and cannot be used or accessed, you have 168 hours (1 Week) to pay fine
$300 to 1364J1RCXfW3gNrGQXP481661MhaNi7Nqq, if the time limit (168 Hours) is exceeded then your files will be deleted FOREVER! Restarting the PC wont do anything, safe mode is useless aswell. Dont try anything funny, this is a ransomware. If you remove this window your files will be deleted!

What is Bitcoin (BTC)?
We only accept Bitcoin, Bitcoin is a cryptocurrency. Think of it as money you can’t touch.
How do I get Bitcoin? There are two major ways to get your hands on bitcoin. The fastest and easiest method is by buying bitcoin. Links to buy bitcoin will be down below. The other method is to mine Bitcoin by solving complicated algorithms. We will only give you 1 week (168 Hours) so that option is out of range. You will need to store your bitcoin somewhere. For that you will need a wallet. Here’s a couple of examples: Electrum, Jaxxm mSIGNA, Blockchain, ArcBit etc. We ONLY accept bitcoin to ensure our safety and your safety stays at top. You will send the bitcoins to the address above.

Even though in this ransom note it is mentioned that you will have to pay $300 as a ransom, the message on the desktop screensaver states that you should pay $150, so we do not know which amount is actually correct. Either way, we suggest not to do that – there are no guarantees that you will receive working decryptor even if you do pay the ransom.

How to decrypt files and remove Krypton Ransomware?

Unfortunately, we can’t offer any free decryptor for Krypton ransomware right now. The only possible way to get back your files – restore them from a back up. However, to be able to do that, you will have to have a valid disc copy that was made before the date of infection and stored on an external drive or cloud. If you do have one, please follow this guide to restore your files.

One way or another, you still have to make sure that Krypton virus is no longer operating on your computer. The best way to do that is to scan your computer with anti-malware software, such as SpyHunter Either one of those tools will detect and get rid of Krypton ransomware automatically.

How to recover Krypton Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Krypton Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Krypton Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Krypton Ransomware. You can check other tools here.  

Step 3. Restore Krypton Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Krypton Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Krypton Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.

Manual removal