TrueCrypt Ransomware - How to remove

TrueCrypt Ransomware is another species of ransomwares trojans. It bears the name of the application locking data from unauthorized access. TrueCrypt is similar to Cerber, TeslaCrypt, Locky, Cryptowall and other cryptomalwares in the sense that it uses asymmetric encryption to compromise victims’ data. The other features of TrueCrypt virus will be discussed in a minute.

About TrueCrypt Ransomware

TrueCrypt ransomware uses a pair of keys – a public (encryption) and a private (decryption) keys. The public key denotes RSA-2048 algorithm and the private key indicates AES-256 algorithm. The private key is stored on C&C (Command and Control) servers controlled by hackers. Any type of data can be affected: .txt, .doc, .pdf, .zip, .rar, etc. The following filename extensions are appended with .enc extension. Then, the files are compressed to %APPDATA%\Microsoft\TrueCrypter\Encrypted.dat file and locked. The encryption process is over.

Your desktop wallpaper is replaced with the image of the ransom note. The message states the fact of encryption, the ransom required and the payment details. The compensation is equivalent to 0.2 Bitcoins which is equal to 89.81 USD at the moment. What is quite peculiar to TrueCrypt ransomware, is that the developers accept AGCs, that is Amazon Gift Cards worth 115USD (this would cost you more than the usual BTC transfer). All instructions are provided but if it is like Chinese arithmetic to you, you are encouraged to contact these cyber criminals through [email protected] e-mail.

How does TrueCrypt Ransomware Spread

TrueCrypt is a typical ransomware trojan. It is distributed through spam e-mails and their infected attachments. Usually these spam e-mails pretend to be important documentation from legitimate companies, even using their logos. But you should always try to contact the sender not by opening the spam e-mail and responding to it but by other means available. In general, it is a very low probability that such letter would fall into the spam folder. Secondly, exploit kits, such as Angler exploit kit, are responsible for many of ransomware infections.

How to Decrypt Files Encrypted by TrueCrypt Ransomware

Fortunately, there has not been the need for security researches to develop decryption tools for TrueCrypt ransomware. It has a fundamental flaw in its coding because of which you can easily and automatically restore your data. Click the Pay button, then confirm the payment and files will be decrypted as well as the ransomware uninstalled. However, there is no guarantee that the developers will not fix this flaw. For this reason and for the possibility of other virus infection it is highly advisable to use professional anti-malware tools such as Spyhunter.

How to recover TrueCrypt Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before TrueCrypt Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of TrueCrypt Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to TrueCrypt Ransomware . You can check other tools here.  

Step 3. Restore TrueCrypt Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually TrueCrypt Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover TrueCrypt Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.

Manual removal