I received a notification today saying that my files have been encrypted and I have to pay a lot money to gain them back. I supposed this was a virus so I ran ESET to scan my PC, after half and hour it detected a variant of the threat “Win32/Filecoder”, for example, filecoder.cr. Is this virus dangerous? Will it steal my personal information like credit card info or something like that? What’s the best way to get rid of it completely?
Win32/Filecoder.CR is defined as Trojan Horse designed to execute dangerous activities on your computer like encrypting your documents and photos, slowing down your PC performance and even stealing your information without your awareness. This Trojan virus is associated with CryptoLocker Virus that usually gets into your PC after you mistakenly clicked on malicious pop ups or links, installed or downloaded unknown freeware from porn sites or unknown sites. It also can be downloaded once you opened the attachment from spam emails. Once the Trojan is executed on the compromised computer, it creates a number of registry entries to store the path of the encrypted files and run every time the computer restarts. It encrypts files with particular extensions on the computer and creates additional files with instructions on how to obtain the decryption key. Those files take up large system resources and make PC run slowly. The virus attempts to convince the user to pay money in order to get the key to unlock their files. It uses a variety of different techniques in order to encourage the user to pay the ransom. It is another scam trying to fool unwary users so victims should get rid of Win32/Filecoder.CR once upon detection.
Win32/Filecoder.CR virus can create other serious problems on the affected PC. As similar as other Trojans, it helps download other dangerous malware into your machine, which can accelerate the corruption of your machine. It threatens security and privacy as it can collect user’s online account, password information or even system information and finally send them to a predefined remote IP address. It also changes your homepage, takes over control your screen, shuts down internet connection and so on. You are recommended to remove Win32/Filecoder.CR manually.
1. It can compromise your system and may introduce additional infections like rogue software.
2. It forces you to visit websites and advertisements which are not trusted and may lead you to pay money wrongly for worthless products.
3. It takes up high resources and strikingly slows down your computer speed and even causes your computer stuck frequently.
4. It may allow cyber criminals to track your computer and steal your personal information.
From malicious drive-by-download scripts from corrupted porn and shareware / freeware websites.
Through spam email attachments, media downloads and social networks.
When clicking suspicious pop-ups or malicious links.
Open unknown email or download media files that contain the activation code of the virus.
Currently many computer users had the same experience that this virus couldn’t be removed by any anti-virus applications. So the manual approach is always required to combat this virus. And here is the step-by-step removal guide for all computer users.
1. End the malicious process from Task Manager.
Once Win32/Filecoder.CR virus is installed, computer user may notice that CPU usage randomly jumps to 100 percent. At any time Windows always has many running processes. A process is an individual task that the computer runs. In general, the more processes, the more work the computer has to do and the slower it will run. If your system’s CPU spike is constant and remain at a constant 90-95%, users should check from Task Manager and see if there is a suspicious process occupying system resources and then end it immediately.
(The name of the virus process can be random.)
Press Ctrl+Shift+Esc to quickly bring up Task Manager Window：
2. Show hidden files and folders.
Open Folder Options by clicking the Start button, clicking Control Panel, clicking Appearance and Personalization, and then clicking Folder Options.
Click the View tab.
Under Advanced settings, click Show hidden files and folders, uncheck Hide protected operating system files (Recommended) and then click OK.
3. Open Registry entries. Find out the malicious files and entries and then delete all.
Attention: Always be sure to back up your PC before making any changes.
a. Press Windows key + R to open Run box. In the “Open” field, type “regedit” and click the “OK” button.
Then a Registry Editor window will pop up as the following picture shows:
b. Search malicious files and registry entries and then remove all of them:
%AllUsersProfile%\[random]
%AppData%\Roaming\Microsoft\Windows\Templates\[random]
%AllUsersProfile%\Application Data\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\[random]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Temp
Win32/Filecoder.CR is a malicious virus that turns out to be a great threat to worldwide computers. This infection is usually detected by Eset antivirus and it triggers destructive damages to computers from Windows XP to Windows 10. The virus can be installed by visiting pornographic websites, opening junk email attachments or downloading freeware from a corrupted website without caution and it is designed to prevent the user from accessing their files and force them to pay some money in order to regain access. Once it is installed, this Trojan modifies startup items so that it can get started simultaneously with the system startup. You will see tons of encrypted files in your hard drive taking up system resources because the virus is capable of encrypting a wide variety of files on the compromised computer using public/private key encryption. Also there is a document telling you how to decrypt the files. To more specific, it informs the user that their files have been encrypted and gives instructions on how to obtain the decryption key needed to unlock the files. It may also warn users that the decryption key will be deleted after a certain time period to pressure the user into paying sooner. Even if the user pays the ransom, there’s no guarantee that the attacker will provide the decryption key needed to unlock their files so we recommend users get rid of Win32/Filecoder.CR virus step by step instead.
Note: If you are not knowledgeable enough to be able to distinguish the location of this virus, or you are afraid of making mistake during the manual removal, please contact experts from Yoocare Online Tech Support for further help.
Published by on November 8, 2015 1:48 am, last updated on November 8, 2015 1:48 am
Leave a Reply
You must be logged in to post a comment.