EnCiPhErEd Trojan is a ransom malware known with different aliases like Trojan.Ransom.HM or Troj_Ransom.BXA and Trojan:W32/Ransomcrypt. This virus will typically encrypt files on an infected computer so user will be unable to use these encrypted files. Whenever user will try to go through the file, the trojan EnCiPhErEd will ask the user to put the correct password to decrypt the file to use. Now to get the password for decrypting file will cost up to 50 EUR or USD, that is the target of this EnCiPhErEd Trojan to swindle your money away. You should not pay for this malicious virus, remove it from your computer to get your files back instead.
EnCiPhErEd Trojan will affect your non-executable files like songs, videos and images. It will rename the file and change its extention. I.e, Background.jpg would be named by this virus as Background.EnCiPhErEd. The Trojan will also change the default icons. it will also create a notepad read me type file with the name “HOW TO DECRYPT FILES.txt”. This file would contain the following message:
Attention! All your files are encrypted!
You are using unlicensed programs!
To restore your files and access them,
send code Ukash or Paysafecard nominal value of EUR 50 to the e-mail Koeserg@gmail.com.
During the day you receive the answer with the code.
You have 5 attempts to enter the code. If you exceed this date all data is irretrievably spoiled. Be careful when you enter the code!
The hacker requires the user to email him with the proof of payments, after he sends you a mail with the code to decrypt files. And one thing more, do not enter wrong passwords as it may cause loss of files. Also do not buy the code of this malware. Immediately follow the instructions to uninstall the Trojan EnCiPhErEd.
In the snap below, you can see the extensions and file names changed by EnCiPhErEd.Trojan:
Auto Removal
To remove this virus Automatically, We suggest following tools:
