How To Remove The PshCrypt Ransomware From Your PC

Malware researchers discovered a new malware of unknown origin dubbed PshCrypt ransomware which can be deleted removed by following our in-depth removal guide.

PshCrypt Ransomware Description

Security researchers detected a new malware infection that has spread across the Internet. The honeypots that detect new virus infections alerted the discovery of the new threat known as the PshCrypt ransomware. The initial security analysis does not show any correlation with previously known malware families. This means that the virus is the work of an independent hacker not affiliated with known hacker collectives. At this moment his identity is unknown. The virus also bears two strings which might be asssociated with test versions of the ransomware – XEplorer and Une Bite.

We suspect that this is an initial version of the threat as its malicious components are only two modules:

1. Encryption Engine – PshCrypt ransomware processes target user data which is encrypted using a strong cipher. Like most similar threats it uses a built-in predefined list of target file type extensions. At the moment we don’t have access to it but we assume that it includes the most commonly used user data – photos, videos, documents, music, archives, configuration files, backups and etc. All affected files receive the .psh extension.
2. Screenlocker – The virus engine employs a screenlocker which displays the ransomware note and prohibits any ordinary computer interaction.

Once this process is complete the following message is displayed to the users:

Tour files are encrypted !
Enter the serial code to decrypte your file
How to get a serial key :
First buy 0.05 bitcoin
Than send this 0.05 bitcoin to this bitcoin wallet :
Then take the 4 first character of the transaction ID
Then press the “Decrypte” button
Serial code : (Only Upper)
button [Decrypte] Warning :
If your transaction number don’t work, please wait up to 48 hours (2 day) and retry Decrypted flles :
Decrypted files

The ransomware does not specify an exact address which can mean that the developers of the threat are still actively working on it. The shown note requests the sum of 0.05 Bitcoins which is about 65 US Dollars.

To unlock the test version you can use the following unlock code: HBGP.

Updated versions can include updates to the virus engine, add new components and cause other damage to the infected hosts.

PshCrypt Ransomware Distribution

There are only a limited number of malware samples available and this does not give out a clear indication of the exact way in which the virus is being distributed. We suspect that the hackers behind it are using the most popular methods:

• Email Spam Campaigns – The criminals can opt to use social enigneering tactics to spread the PshCrypt ransomware. The available options include the sending of the virus as an attachment, linked in the body or delivered via macros in attached infected documents.
• Infected Software – A popular way of spreading malware such as this ransomware is by bundling them into installers for popular free or trial versions of applications, games, utilities, patches and etc. They are then distributed on hacker-controlled download sites and BitTorrent trackers.
• Dangerous Redirects – Hacker-controlled malicious scripts, ad networks and other redirects can lead to a hacker-controlled download site where the virus can be found.
• Intrusion Attempts – The criminals can opt to use automated vulnerability testing frameworks to attempt an intrusion into the target hosts.
• Dropped By Another Malware – This ransomware can infect computers when delivered via another malware.

Summary of the PshCrypt Ransomware

PshCrypt Ransomware Ransomware Removal

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely PshCrypt Ransomware Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover PshCrypt Files

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

How To Restore PshCrypt Files

1) Use present backups

2) Use professional data recovery software
– Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.

3) Using System Restore Point
– Hit WIN Key
– Select “Open System Restore” and follow the steps

4) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter