EnCiPhErEd Ransomware – Remove It and Decrypt Encrypted Files for Free - How to, Technology and PC Security Forum | SensorsTechForum.com

EnCiPhErEd Ransomware – Remove It and Decrypt Encrypted Files for Free

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

shutterstock-malwareA new variant of old ransomware, EnCiPhErEd is a part of the Xorist crypto family. The virus encrypts files on compromised systems leaving its name as a file extension to the encoded files. The ransomware has also been reported by malware researchers to be sold online on deep web black markets. Since ransomware from the Xorist family has been hacked a while ago, we advise users to follow the tutorial in this article to remove it and decrypt their files instead of paying the ransom money to the cyber-criminals.

Threat Summary

Short DescriptionThe ransomware encrypts files with the RSA algorithm and AES-128 ciphers and asks a ransom for decryption.
SymptomsFiles are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a .txt file.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by EnCiPhErEd(Xorist)


Malware Removal Tool

User ExperienceJoin our forum to Discuss EnCiPhErEd Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

EnCiPhErEd Ransomware – Infection Process

To infect users, this ransomware may spread via several different ways:

  • Via infected USB drives or other external drives.
  • Through malicious URLs that cause drive-by-downloads or the execution of .js(JavaScript) files.
  • Via malicious executables, like Windows activators, game key generators, and others, pretending to be virus-free applications.

Since the ransomware is sold in Russian forums, users on those forums have reported that the ransomware may be spread via activators for Microsoft products, such as fake KMS Activator.

EnCiPhErEd Ransomware In Detail

Once activated on your computer, EnCiPhErEd Ransomware may place different files of the following file types:

→ .js, .exe, .dll, .tmp, .vbs, .bat, .cmd .reg

The files may be located in one of the following folders:

  • %AppData%
  • %Local%
  • %Roaming%
  • %System%
  • %{User’s Profile}%
  • %Temp%

Those files may be obfuscated so that they avoid detection by antivirus software. As soon as they are executed, EnCiPhErEd may immediately begin to encrypt your files. It may look for files of the following file extensions:


After it encrypts the files, the ransomware adds the EnCiPhErEd extensions to the files, for example:

→New Text Document.txt.EnCiPhErEd

The ransomware may add a ransom message similar to the following:

→ “Attention! All your files are encrypted!
To restore your files and access them,
please send Bitcoin to address
and email to {cyber-criminals’ email} proof
(screen or smth) of your payment.
After receiving funds, I will send you
your password and decrypt instruction via email.
You have several attempts to enter the code.
When that number has been exceeded,
all the data irreversibly is destroyed.
Be careful when you enter the code!”Source:BleepingComputer

Another ransom message seen in Xorist variants is the following:


This is just an example message; however, users also report being asked to send SMS messages that charge them the ransom amount. This is very convenient and untraceable method of quick money making, and this is why some cyber-criminals may prefer it.

Remove EnCiPhErEd Ransomware and Decrypt the Encoded Files

To remove this ransomware, we advise users to immediately download and use an advanced anti-malware software to scan automatically for the threat. However, there is also the manual removal possibility of finding the registry entries and the files created by the ransomware, for which we have prepared instructions for you below.

To decrypt your files, please check step “3. Decrypt Files Encrypted by EnCiPhErEd Ransomware”.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share