How to Remove Thunder Crypt Ransomware

Help me please! It was really urgent! My desktop was attacked by Ransomware. It blocked al my files. It seemed like this virus was called ThunderCrypt. It warned me that there was no way to decrypt my files and what I could do was to pay them before deadline so that I could recover my data. What should I do? Should I rally pay for it? But I was afraid that it will not recover my files but delete them instead after getting my payment. Or maybe they will block files again and extort me again.

 

remove-thunder-crypt-ransomware


Information about Thunder Crypt Ransomware

 

Thunder Crypt Ransomware is dangerous Ransomware which puts the affected computer in to danger. It comes to target computer system and blocks crucial files. Most of time, it chooses to block personal files so that victims should pay for recovering them when the files are so important. Y now it is no longer just a Trojan virus but a kind of Ransomware which extorts money around the world. Those computers which are attacked will be high risks of being attacked. This type of virus does not use hybrid RSA-2048 public key encryption but a private key instead. As a result of it, victims can not decrypt the blocked files without private key. The way victims get private key is to contact with hackers so hackers will send victims a private key stored on server. But it is not so easy to get a key as victims will not get anything before paying an amount. Usually, hackers will not push you so much to pay. They will give you enough time to consider, but not long. The payment is required Bitcoin. As we all know, the price of Bitcoin is rising lately. And it is not cheap.

 

thunder-crypt-ransomware

 

 

We should admit, the rising of Bitcoin price will convince most of us to pay as soon as possible and we do want to recover files while they are really important. We should be worry about the rising tide of payment and it will make us pay for the files urgently. However, when we pay, we wil be into trap. Will it be safe to pay? Is there anyone can ensure the security during paying? Meanwhile, the crux of the issue isn’t even being discussed. The real question we should be asking is that will the files be really recovered?

 

If you is one of victims of Thunder Crypt Ransomware, you’d better remove the ransomware at first. That’s not to say that decryption is not important. But if you don’t kick Thunder Crypt Ransomware out of your computer immediately, the ransomware will do harm to the computer. As long as it still exists, more files may be in danger of encryption and loss. Please read the removal guide to remove Thunder Crypt Ransomware. If you are afraid of making any mistake during the manual removal process, you are strongly recommended to get an automatic tool to help you.

 

remove-thunder-crypt-ransomware

 


How to Remove Thunder Crypt Ransomware

 

Quick Menu:

Step 1: Use Anti-Malware Tool to Detect and Remove Thunder Crypt Ransomware and Other Viruses

Step 2: How to Recover the Encrypted Files

※How to Back up Your Files


Step 1: Use Anti-Malware Tool to Detect and Remove Thunder Crypt Ransomware and Other Viruses

 

→Reboot the PC in Safe Mode

 

Choose one from the following instructions based on the system you use now. And make sure all external drive like floppy disks have been out of your computer.

For Windows XP/7/Vista

logo-xp+logo-7

Restart your computer, tap F8 key constantly when it restarts but the Windows logo appears.

keyboard-f8

 

The Windows Advanced Options Menu will pop up, you need to use the arrow keys to select Safe Mode option you want, and then hit Enter key.

win7-safe-mode

 

 

For Windows 8

logo-windows8

 

Move the mouse to the right side of the screen until the Windows 8 charm menu appears.

win8-settings

 

Click Settings button and select Power.

win8-power

 

Press Shift key all time and then click Restart from Power menu.

shift-restart-1

 

Now you are in the Windows 8 boot menu, click on Troubleshoot.

choose-troushoot

 

Then Advanced options

choose-advanced-options

 

Click Startup Settings

choose-startupsettings

 

Click Restart button in Startup Settings.

win8-startup-settings-restart

 

Press F4, F5 or F6 to enter Safe Mode.

win8-startup-settings2

 

For Windows 10

10_windows

 

 

While holding down the Shift key, click Restart in Start menu (Click Start button, select Power and click Restart).

shift-restart-win10

 

Now you are in the Windows 8 boot menu, please click TroubleShot -> Advanced options ->Windows Startup Settings.

win8-safemode3step

 

Click Restart button in Startup Settings.

win8-startup-settings-restart

 

Enter Safe Mode by pressing F4, F5 or F6 key.

win8-startup-settings2

 

 

→Terminate Processes Related to Thunder Crypt Ransomware

 

Right click on the taskbar and then select Start Task Manager/ Task Manager.

task-manager-windows-8

 

Go to Processes tab, find suspicious programs and stop them by click End Task (Win 8&10) / End Process button.

 

windows-8-processes-in

 

→Run Anti-Malware Tool to Remove Thunder Crypt Ransomware

  • Use SpyHunter to Scan You Computer

SpyHunter is a useful anti-malware program which has ability to detect and remove all detected traces of Thunder Crypt Ransomware and other threats. With updated virus database, it can scan the system for all types of computer threats including Worms, Trojans, Rootkits, Spyware and PUP, which may degrade computer performance. Now try to run SpyHunter to remove Thunder Crypt Ransomware!

Download SpyHunter by clicking on the button below.

Thunder Crypt Ransomware-4-0-removebutton

 

Open the downloaded file (SpyHunter-Installer.exe) to start the Installation.

spyhunter-installer-exe_

 

Select your language and click OK button.

ok-spyhunter1

 

Click Continue button when Enigma Software Installer pops up.

continue1

 

Choose I accept the EULA and Privacy Policy option and click Install button.

install3

 

When the setup is completed, click Exit button.

step-6-exit

 

After installation is completed, run the SpyHunter, go to “Start a New System Scan” tab, and click “Scan Computer Now!

scan

 

After the scan is finished, screen shows all detected items in the list (click + to read more details about the infection).

Now, press “Fix Threats” button to remove Thunder Crypt Ransomware and other detected threat.

cerber4ransomware-spyhunterresult

 

Restart the computer to take effect.

 

Step 2: How to Recover the Encrypted Files

 

Option 1: Use Windows Previous Versions feature

 

Go to File Explorer (My Computer icon), click one folder filled with your encrypted files.

 

Right click on a folder or a file and select Properties.

restoreproperties

 

Press Previous Versions tab, and then select one of Restore points when files don’t be locked and click Restore button in the pop-up window.

restore-version

 

Click Apply and OK button to apply the changes.

 

Option 2: Use System Restore

 

  • Open Start menu -> Type system restore into the search box -> press Enter key.

typerestore

  • In the Restore system files and settings page, you can choose Recommended restore or Choose a different restore point, and then click Next button.

restore-point

 

  • Choose a restore point when Thunder Crypt Ransomware doesn’t enter your computer and then click Next button.

win7-systemrestore-2

 

  • Click Finish button to start System Restore.

win7-systemrestore-3

  • Click Yes button in the pop-up window and wait for completion of System Restore.

 

Option 3: Shadow Volume Copies

More information at http://www.shadowexplorer.com/downloads.html


※How to Back up Your Files

It is recommended to back up your files regularly in case of data loss. That’s the most used methods to restore files and system settings.

  • Store files in some storage drives including USB Flash Drives, memory card, CD, DVD and so on.
  • Upload files to SkyDrive or OneDrive.
  • Use System Restore Feature, as shown.

(The guide below use Windows 8 as an example)

Move to the bottom left corner and wait for appearance of image-win8-startbutton

Right click on image-win8-startbutton and select Search.

search

 

Select Settings and type “restore” in the search box.

search-win8-restore

 

Click “Create a restore point” in the search results.

select-restorepoint

 

In System Protection tab, click Create… button, which means creating a restore point right now for the drives that have system protection turned on.

system-create

 

In order to identify the restore point, you need to type a description of the restore point, and then click Create button.

system-create

 

The system is creating a restore point, please wait for several seconds.

creating a restore point

 

And then the window tells you “the restore point was created successfully”.

systemsucess

 

The result can be seen in System Restore tab ( click System Protection > System Restore). Date and Time, Description and Type will display in the list.

win7-systemrestore-2

 

 

Warm Reminder: Unfortunately, there are no effective way to completely decrypt your files nowadays. The most used and useful method is to recover your files from back-ups. Hence, it is important to back up your files regularly. To prevent your computer from Thunder Crypt Ransomware, computer users are not recommended to click spam emails, malwaretisements and untrusted links, especially without antivirus program. If your computer gets infected Thunder Crypt Ransomware unluckily, you’d better remove the Ransomware as soon as possible.

 

remove-thunder-crypt-ransomware

 

 

Share on FacebookShare on Google+Digg thisPin on PinterestShare on LinkedInShare on TumblrShare on RedditShare on StumbleUpon