How to Remove Thunder Crypt Ransomware

Help me please! It was really urgent! My desktop was attacked by Ransomware. It blocked al my files. It seemed like this virus was called ThunderCrypt. It warned me that there was no way to decrypt my files and what I could do was to pay them before deadline so that I could recover my data. What should I do? Should I rally pay for it? But I was afraid that it will not recover my files but delete them instead after getting my payment. Or maybe they will block files again and extort me again.



Information about Thunder Crypt Ransomware


Thunder Crypt Ransomware is dangerous Ransomware which puts the affected computer in to danger. It comes to target computer system and blocks crucial files. Most of time, it chooses to block personal files so that victims should pay for recovering them when the files are so important. Y now it is no longer just a Trojan virus but a kind of Ransomware which extorts money around the world. Those computers which are attacked will be high risks of being attacked. This type of virus does not use hybrid RSA-2048 public key encryption but a private key instead. As a result of it, victims can not decrypt the blocked files without private key. The way victims get private key is to contact with hackers so hackers will send victims a private key stored on server. But it is not so easy to get a key as victims will not get anything before paying an amount. Usually, hackers will not push you so much to pay. They will give you enough time to consider, but not long. The payment is required Bitcoin. As we all know, the price of Bitcoin is rising lately. And it is not cheap.





We should admit, the rising of Bitcoin price will convince most of us to pay as soon as possible and we do want to recover files while they are really important. We should be worry about the rising tide of payment and it will make us pay for the files urgently. However, when we pay, we wil be into trap. Will it be safe to pay? Is there anyone can ensure the security during paying? Meanwhile, the crux of the issue isn’t even being discussed. The real question we should be asking is that will the files be really recovered?


If you is one of victims of Thunder Crypt Ransomware, you’d better remove the ransomware at first. That’s not to say that decryption is not important. But if you don’t kick Thunder Crypt Ransomware out of your computer immediately, the ransomware will do harm to the computer. As long as it still exists, more files may be in danger of encryption and loss. Please read the removal guide to remove Thunder Crypt Ransomware. If you are afraid of making any mistake during the manual removal process, you are strongly recommended to get an automatic tool to help you.




How to Remove Thunder Crypt Ransomware


Quick Menu:

Step 1: Use Anti-Malware Tool to Detect and Remove Thunder Crypt Ransomware and Other Viruses

Step 2: How to Recover the Encrypted Files

※How to Back up Your Files

Step 1: Use Anti-Malware Tool to Detect and Remove Thunder Crypt Ransomware and Other Viruses


→Reboot the PC in Safe Mode


Choose one from the following instructions based on the system you use now. And make sure all external drive like floppy disks have been out of your computer.

For Windows XP/7/Vista


Restart your computer, tap F8 key constantly when it restarts but the Windows logo appears.



The Windows Advanced Options Menu will pop up, you need to use the arrow keys to select Safe Mode option you want, and then hit Enter key.




For Windows 8



Move the mouse to the right side of the screen until the Windows 8 charm menu appears.



Click Settings button and select Power.



Press Shift key all time and then click Restart from Power menu.



Now you are in the Windows 8 boot menu, click on Troubleshoot.



Then Advanced options



Click Startup Settings



Click Restart button in Startup Settings.



Press F4, F5 or F6 to enter Safe Mode.



For Windows 10




While holding down the Shift key, click Restart in Start menu (Click Start button, select Power and click Restart).



Now you are in the Windows 8 boot menu, please click TroubleShot -> Advanced options ->Windows Startup Settings.



Click Restart button in Startup Settings.



Enter Safe Mode by pressing F4, F5 or F6 key.




→Terminate Processes Related to Thunder Crypt Ransomware


Right click on the taskbar and then select Start Task Manager/ Task Manager.



Go to Processes tab, find suspicious programs and stop them by click End Task (Win 8&10) / End Process button.




→Run Anti-Malware Tool to Remove Thunder Crypt Ransomware

  • Use SpyHunter to Scan You Computer

SpyHunter is a useful anti-malware program which has ability to detect and remove all detected traces of Thunder Crypt Ransomware and other threats. With updated virus database, it can scan the system for all types of computer threats including Worms, Trojans, Rootkits, Spyware and PUP, which may degrade computer performance. Now try to run SpyHunter to remove Thunder Crypt Ransomware!

Download SpyHunter by clicking on the button below.

Thunder Crypt Ransomware-4-0-removebutton


Open the downloaded file (SpyHunter-Installer.exe) to start the Installation.



Select your language and click OK button.



Click Continue button when Enigma Software Installer pops up.



Choose I accept the EULA and Privacy Policy option and click Install button.



When the setup is completed, click Exit button.



After installation is completed, run the SpyHunter, go to “Start a New System Scan” tab, and click “Scan Computer Now!



After the scan is finished, screen shows all detected items in the list (click + to read more details about the infection).

Now, press “Fix Threats” button to remove Thunder Crypt Ransomware and other detected threat.



Restart the computer to take effect.


Step 2: How to Recover the Encrypted Files


Option 1: Use Windows Previous Versions feature


Go to File Explorer (My Computer icon), click one folder filled with your encrypted files.


Right click on a folder or a file and select Properties.



Press Previous Versions tab, and then select one of Restore points when files don’t be locked and click Restore button in the pop-up window.



Click Apply and OK button to apply the changes.


Option 2: Use System Restore


  • Open Start menu -> Type system restore into the search box -> press Enter key.


  • In the Restore system files and settings page, you can choose Recommended restore or Choose a different restore point, and then click Next button.



  • Choose a restore point when Thunder Crypt Ransomware doesn’t enter your computer and then click Next button.



  • Click Finish button to start System Restore.


  • Click Yes button in the pop-up window and wait for completion of System Restore.


Option 3: Shadow Volume Copies

More information at

※How to Back up Your Files

It is recommended to back up your files regularly in case of data loss. That’s the most used methods to restore files and system settings.

  • Store files in some storage drives including USB Flash Drives, memory card, CD, DVD and so on.
  • Upload files to SkyDrive or OneDrive.
  • Use System Restore Feature, as shown.

(The guide below use Windows 8 as an example)

Move to the bottom left corner and wait for appearance of image-win8-startbutton

Right click on image-win8-startbutton and select Search.



Select Settings and type “restore” in the search box.



Click “Create a restore point” in the search results.



In System Protection tab, click Create… button, which means creating a restore point right now for the drives that have system protection turned on.



In order to identify the restore point, you need to type a description of the restore point, and then click Create button.



The system is creating a restore point, please wait for several seconds.

creating a restore point


And then the window tells you “the restore point was created successfully”.



The result can be seen in System Restore tab ( click System Protection > System Restore). Date and Time, Description and Type will display in the list.




Warm Reminder: Unfortunately, there are no effective way to completely decrypt your files nowadays. The most used and useful method is to recover your files from back-ups. Hence, it is important to back up your files regularly. To prevent your computer from Thunder Crypt Ransomware, computer users are not recommended to click spam emails, malwaretisements and untrusted links, especially without antivirus program. If your computer gets infected Thunder Crypt Ransomware unluckily, you’d better remove the Ransomware as soon as possible.





Share on FacebookShare on Google+Digg thisPin on PinterestShare on LinkedInShare on TumblrShare on RedditShare on StumbleUpon