How to Completely Get Rid of CryptoDefense? - Efficient Manual Removal

CryptoDefense is a malicious malware categorized as ransomware that targets the operating system of Windows PC: Win XP, Win Vista, Win 7 or Win8. Similar to CryptoLocker, CryptorBit and HOWDECRYPT viruses, CryptoDefense Software virus or How Decrypt virus will encrypt certain files on the computer and demand payment before you can gain access to the said files. However, it seems that CryptoDefense demands higher than other ransomware. It demands user to pay 1000 USD/EUR through online payment scheme. Once infected, CryptoDefense states that "All files including videos, photos and documents on your computer are encrypted by CryptoDefense Software. Encryption was produced using a unique public key RSA-2048 generated for this computer. To decrypt files you need to obtain the private key. The single copy of the private key, which will allow you to decrypt the files, located on a secret server on the Internet; the server will destroy the key after a month. After that, nobody and never will be able to restore files. In order to decrypt the files, open your personal page on the site https://rj2bocejarqnpuhm.browsetor.com/1jt3 and follow the instructions. If https://rj2bocejarqnpuhm.browsetor.com/1jt3 is not opening, please follow the steps below: 1. You must download and install this browser http://www.torproject.org/projects/torbrowser.html.en 2. After installation, run the browser and enter the address: rj2bocejarqnpuhm.onion/1jt3 3. Follow the instructions on the web-site. We remind you that the sooner you do, the more chances are left to recover the files. IMPORTANT INFORMATION: Your Personal PAGE: https://rj2bocejarqnpuhm.browsetor.com/1jt3 Your Personal PAGE(using TorBrowser): rj2bocejarqnpuhm.onion/1jt3 Your Personal CODE(if you open site directly): 1jt3" However, whatever it changes, it is just a scam that wants to collect money and information from the victims. Never follow its instruction and finish payment, or you will lose your money and information on the infected machine, you must take action to get rid of this CryptoDefense as soon as possible to avoid further damage.

Properties of CryptoDefense

1. CryptoDefense is installed into your computer without any of your permission;
2. CryptoDefense launches automatically because it changes the startup items;
3. CryptoDefense drops its malicious files and registry entries to the target computer;
4. CryptoDefense presents fake messages stating that the target computer file is encrypted;
5. CryptoDefense lures people to pay to decrypt lock files .

Guide to Remove CryptoDefense Effectively

Solution A: 

Step 1. Boot your computer into Safe Mode with Networking. To perform this procedure, please restart your computer and keep pressing F8 key until Windows Advanced Options menu shows up, then using arrow key to select “Safe Mode with Networking” from the list and press ENTER to get into that mode.

Step 2. Press Ctrl+Alt+Del keys together to pull up Window Task Manager and end suspicious processes:

Step 3. Check the following directories and remove all these associated files:

%AppData%\NPSWF32.dll
%AppData%\Protector-<random 3 chars>.exe
%AppData%\1A4mAt5h21ef.dat
%CommonStartMenu%\Programs\Windows Cleaning Tools.lnk

Step 4. Open Registry Editor by navigating to Start Menu, type in Regedit, and then click OK. When you have been in Registry Editor, please remove the following related registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-4-9_2"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "ipgttvrglt"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashChest.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdsetup.exe

Step 5. After you finish the above steps, please reboot your computer and get in normal mode to check the effectiveness.

Solution B: 

Step 1. Install SpyHunter

1) Download SpyHunter here.

2) Double click on it to install SpyHunter.

Step 2. Scan and fix threats with SpyHunter

1) Open SpyHunter and click Scan Computer Now! to start scan your computer.

2) When the SpyHunter scan is completed, you can see that it detects all the threats including CryptoDefense. Then click Fix Threats button to make your computer clean.

Video on How To Remove Malware

Notice: Using reliable anti-malicious software is the most efficient way for the victims who have a little knowledge about computer or are afraid of using manual removals to remove CryptoDefense. SpyHunter can help you remove this CryptoDefense automatically. Therefore, just run a scan of SpyHunter and it will help you to solve all the problems efficiently and permanently.