Remove VoidCrypt Ransomware Virus (Removal Guide)

VoidCrypt ransomware blocks access to your own files by encrypting them

VoidCrypt ransomware (also known as Void) is a computer virus that encrypts files on target systems and demands the user to pay a ransom. This malware was initially spotted in 2020 and remained active to this day. VoidCrypt malware typically uses different strings to mark the names of encrypted data. These strings usually consist of the victim’s ID, cybercriminal’s email address and additional extension. Example of extension syntax: .[cybercriminal’s email address].[victim’s ID].[extension]. The lattest spotted versions append .MrWhite, .GOGO, .Zendaya, or .RYKCRYPT extensions to locked files.

The malware also creates ransom notes in each folder. Depending on the ransomware variant, these notes will be named as INFO.txt, unlock-info.txt, Decrypt-info.txt, Decryption-Guide.txt and Decryption-Guide.HTA, or Decrypt-me.txt.

After being run on a compromised computer, this ransomware initiates the following activities:

• Encrypts all personal files stored on it by using RSA and AES algorithms using hardcoded public key;
• Creates and saves copies of the ransom notes;
• Disables firewall;
• Deletes local backups;
• Disables recovery mode;
• Ends active operating system processes.

Ransom note overview

This ransomware strain typically leaves either text notes only, or a combination of text notes and .hta files that appear in a pop-up window. These notes usually start with a line “Your Files Has Been Encrypted” followed by explanation that RSA+AES algorithms were used to encrypt files. The note suggests that user needs to pay decryption price (a ransom) to cybercriminals in order to get files back. Threat actors instruct to contact them via email address provided in altered filenames also suggest sending some files to them (less than 1 MB in size) for test decryption. The note restricts sending files that contain valuable data, such as Excel sheets or backups.

Next, the criminals warn that decryption price will be doubled after 48 hours, and inform that the victim should rush to contact them ASAP. The threatening message also says that attempts to use recovery tools or third-party applications can damage encrypted files and also increase the demanded ransom amount.

The note then provides three steps that the user should take in order to get data back:

• Contact the criminals using provided email addresses, send the ID provided in modified file names, and settle the ransom amount with the attackers.
• Send some files for test decryption.
• Pay the ransom and receive the decryption tool.

Why you should not pay the ransom

Paying a ransom is simply not worth it, and there are numerous reasons to support this statement. Here are the reasons why you shouldn’t pay money to the cybercriminals:

1. Paying the ransom encourages the cybercriminals to continue their illegal activities.
2. It also doesn’t guarantee data recovery.
3. Complying with the attackers’ demands can make you a target in future attacks, as they may perceive you as an easy target.
4. Some countries prohibit ransom payments.

In case your computer has been compromised by the described malware, you should secure your computer without a delay. To remove VoidCrypt ransomware virus, follow the instructions provided below this article. If you’re in need for a robust antivirus software to delete malicious files for you, our team strongly recommends INTEGO Antivirus.

Ransomware Summary

Intego Antivirus for Windows

Award-winning antivirus solution for your PC.

Robust security software that provides robust 24/7 real-time protection, Web Shield that stops online threats/malicious downloads, and Prevention engine that wards off Zero-Day threats. Keep your PC safe and protected against ransomware, Trojans, viruses, spyware and other forms of dangerous programs.

GET IT NOW

75% OFF!

Examples of different VoidCrypt ransomware variants

Example of VoidCrypt ransomware using .void extension to mark encrypted files:

The ransom note displayed by this ransomware (Decryption-Info.HTA) is shown below.

Another example of files encrypted by a different ransomware sample using .wixawm extension is shown below. This virus uses a slightly different extension syntax than other variants.

Below, you can see both of ransom notes dropped by this ransomware variant (Decryption-Guide.txt and Decryption-Guide.HTA).

Another sample of VoidCrypt ransomware, dubbed MrWhite virus, drops a ransom note called Dectryption-guide.txt and also appends a lengthy extension to each file.

How is this ransom-demanding malware distributed?

Ransomware-type viruses like VoidCrypt can be distributed in multiple ways. First of all, it is important to stay away from untrustworthy online resources, especially those that urge you to install something in order to access content. For example, if you want to download some mods for computer games and the website asks you to download something before providing the file you requested, you should stay away from it. The same applies for aggressive online ads asking to install updates or freeware as installers for these can turn out to contain unwanted software bundles.

Moreover, computer users should stay as far as possible from websites offering cracked software downloads. Most of these are filled with various malware. Some of these websites successfully appear in Google search results, so you may want to read this guide on how to identify them and avoid them. Ideally, you should only download desired computer programs and games from official websites only.

Another common way to spread file-encrypting malware is via malicious email attachments. Beware of links and files attached to unsolicited emails, especially if the message urges you to open them – as this can lead to a severe computer infection. A general rule of a thumb is not to open emails that you weren’t expecting to receive and if the sender isn’t someone you communicate with regularly. In addition, look out for tell-tale details such as overly generic greeting line (such as Dear client/customer instead of your full name), urgent message tone and grammar mistakes.

Finally, cybercriminals often try to breach systems by using brute-force RDP attacks. These types of attacks focus on automatically guessing username and password combinations until the attacker gains access to the target system. Afterward, the criminals can install malware on it, steal private information and perform other damaging activities. It is important to use strong passwords and also change them regularly. Robust authentication methods should also be implemented, and the number of open ports should be limited in order to increase security of remote logins.

Remove VoidCrypt ransomware virus and recover your files

If your computer has been compromised, we suggest that you remove Voidcrypt ransomware virus right now. Below, you can find detailed instructions how to delete such kind of malware from your computer effectively. If you’re in need for an antivirus recommendation, then you might want to try INTEGO Antivirus, which is highly praised by our team.

The best way to restore files locked by VoidCrypt is using data backups. However, do not plug them to your computer before the malware is entirely removed – otherwise, your backup can get encrypted as well.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.