How to remove Microsoft Decryptor ransomware and restore encrypted files

What is Microsoft Decryptor?

Ransomware developers don’t tread water and try to make their products more complicated and adaptive. So, as well as others the creators of CryptXXX ransomware improve their malware. The new version of CryptXXX is now called Microsoft Decryptor and has a bunch of peculiarities that differ it from previous editions, however the core features remained the same. Microsoft decrypt still aims for certain files avoiding the crucial for system operation directories and encrypts them with RSA-4096 code. Afterwards, the ransomware displays the note explaining what has happened and how to cancel the drastic consequences of the ransomware presence.

By the side of other CryptXXX versions Microsoft Decryptor shows up as the only edition that doesn’t attach specific extensions to the encrypted files, which makes it more difficult for a user to notice the corrupted data. Still, they can be distinguished by the presence in their folders of three Readme files in .txt, .bmp and .html formats. The text of these notes is the same – it offers a user to download TOR browser and transfer a ransom in BitCoins. Also, to additionally force a victim to transfer the money the cybercriminals set a time limit, after which they claim to double the price. If you experience the encryption virus attack, do not rush to pay the money and attempt to remove Microsoft Decryptor ransomware and restore encrypted files.

Symptoms of Microsoft Decryptor infection

It’s difficult not to notice ransomware, since it often has one of the processes responsible for displaying a notification message. This window blocks the screen leaving the user minimum alternatives. Besides, some files will be inaccessible, as in many cases ransomware encrypts them to exasperate the scaring effect.

How Microsoft Decryptor got installed on your computer

The distribution methods of ransomware threats don’t differ much from each other. So, once you learn the ways to protect your system from one of them, you will guard your computer from the majority of the malware of this type. Microsoft Decryptor ransomware is mostly found in spam email attachments that look like genuine invoices or government notifications. In the event when you receive a letter from an unfamiliar source, remember to first check it visually – pay attention to the layout and the theme. If you notice any mistakes or character replacements, then most likely it is a fake message. In case if you still want to open it, avoid launching the attachments without scanning them with antivirus or anti-malware programs in advance.

What to do if your PC is infected with Microsoft Decryptor

As soon as you notice the presence of the ransomware on your system, you should turn your computer off. If it is possible try to create a backup or image of your hard drive info. This may let you to reserve the state of your drives in case a decryption method would be created afterwards.

How to remove Microsoft Decryptor?

To make sure that the adware won’t reappear, you need to delete Microsoft Decryptor completely. For this you need to remove the files and registry entries of the ransomware. We should warn you that performing some of the steps may require above-average skills, so if you don’t feel experienced enough, you may apply to automatic removal tool.

Download SpyHunter

Performing an antimalware scan with Norton would automatically search out and delete all elements related to Microsoft Decryptor. It is not only the easiest way to eliminate Microsoft Decryptor, but also the safest and the most assuring one.

Steps of Microsoft Decryptor manual removal

Restart Windows in Safe Mode

For Windows XP:

1. Restart the system
2. While computer is rebooting press F8 several times
3. In the appeared list of options choose Safe Mode

For Windows 7 and Vista:

1. Restart the system
2. While computer is rebooting press F8 several times
3. In the appeared list of options choose Safe Mode

For Windows 8 and 8.1:

1. Restart the system
2. While computer is rebooting press F8 several times
3. In the appeared list of options choose Safe Mode

For Windows 10:

1. In the Start menu click on the power button
2. Hold Shift and choose Restart
3. Choose Troubleshoot
4. In the Advanced Options choose Startup Settings
5. Click Restart
6. Select Enter Safe Mode

Delete files and registry entries added by Microsoft Decryptor

Now you will be able to reach the needed functions and files. For eliminating the ransomware activity, you need to find all of the following items and delete them.

Remove Microsoft Decryptor files and folders:

dir\med.dll

Restore the files encrypted by Microsoft Decryptor

Use the decrypting tool

Unfortunately, currently a tool able to decrypt the files infected by Microsoft Decryptor is not released yet. You may try applying to the methods described below, however, they might not work with the latest versions of Microsoft Decryptor.

Restore the system

1. Initiate the search for system restore
2. Click on the result
3. Choose the date before the infection appearance
4. Follow the on-screen instructions

Roll the files back to the previous version

1. Right-click the file and choose Properties
2. Open the Previous Version tab
3. Select the latest version and click Copy
4. Click Restore