Remove HolyCrypt Ransomware From the System

HolyCrypt is a cyber threat that aims to encrypt data and then demands a ransom. This type of threat is classified as ransomware. HolyCrypt ransomware seems to have been custom-built and is written in Python. It uses AES algorithm for encryption. This ransomware doesn’t add or replace extensions to the encrypted files but adds the text “(encrypted)” to the beginning of file names. HolyCrypt cyber threat deploys the alert.jpg file and replaces the wallpaper of infected systems with it. The image is a copy of the ransom note. The ransom message indicates to contact the cyber crooks at holycrypt@aol(.)com. There is no given amount of payment but communicating with the attackers and paying the money is the action you should certainly avoid.

Keep reading the article and find out detailed information about HolyCrpt ransomware.

HolyCrypt Ransomware Characteristics

In its first stage of infection, HolyCrypt may drop a payload in one of the main folders of Windows OS.

• %AppData%
• %Roaming%
• %Temp%
• %Local%
• %LocalRow%
• %User’s Profile%
• %Windows%

The type of payload files of this ransomware may be:

And the file name before the extension may be a string of random characters. Its name may also resemble the names of legitimate Windows processes like svchost.exe.

Once HolyCrypt infects the system it may also modify or add some values in the Windows Registries. Commonly the target is “Run” key. Modifications there will allow HolyCrypt ransomware to start encryption process when the victim boots the Windows. In case of infection it’s good to check Windows Registry keys especially the following five:

→HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Control Panel\Desktop

Check our removal instructions at the end of the article.

Investigation of HolyCrypt ransomware by malware analysists shows that this crypto virus targets a particular folder – %UserProfile%. All files in this folder that are with one of the following listed extensions are encrypted after the execution of the dropped payload.

The encryption algorithm built in HolyCrypt crypto virus is AES. After the encryption process the prefix “(encrypted)” is added to the original file names.
This ransomware is a potential threat to all types of operation systems. The victims of HolyCrypt cannot miss the presence of HolyCrypt on their systems considering the replaced desktop wallpaper. The file that changes the current wallpaper is dubbed alert.jpg and it depicts the text of the ransom message. This exchange may occur to modifications in:

→HKEY_CURRENT_USER\Control Panel\Desktop

The original text of HolyCrypt’s ransom message states:

“YOUR COMPUTER HAS BEEN LOCKED!
Your documents, photos, databases and other important files have been locked with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key.
The server will eliminate the key after 24h.
Open http://test_ransonware.onion(.)link and follow the instruction for the payment”

Spread Methods of HolyCrypt Ransomware

The most common spread method of HolyCrypt ransomware is via different spam e-mail campaigns. HolyCrypt ransomware’s payload may be hidden in fake software updates or downloads, corrupted email messages, malicious attachments in emails, vicious links in websites, spammed comments. HolyCrypt may drop on the system through malicious links in social media sites in the form of fake notifications, spammed private message or fake shares of compromised accounts. Clicking on suspicious links and downloading files with obscure origin may expose your system and your data to extreme danger.

Remove HolyCrypt Ransomware From the PC and Fix the Damages

Removal of HolyCrypt from the PC is highly advisable. Leaving the threat on the system will lead to encryption of every new file, and all actions for file restoration will fail as well. Following our removal instructions at the end of the article will help you to remove HolyCrypt ransomware from the PC. It is also necessary to clean your registries.

HolyCrypt Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete HolyCrypt completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely HolyCrypt Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.