How to remove Cypher ransomware

Cypher – a ransomware virus that locks important files on the affected machine

Cypher ransomware is a file-encrypting virus that was detected in the middle of February 2018. The malicious program uses a strong encryption algorithm and locks files with .cypher file extension to prevent users from accessing their documents, audio or video files, databases and similar information.

According to the latest research data, Cypher seems to be a new version of Shifr ransomware virus that was discovered in July 2017. However, apart from encrypting files, the malware also operates as a free ransomware-as-a-service (RaaS).^[1]

The Cypher virus can enter the system using multiple methods. However, typically infiltration requires user’s participation to install malicious payload on the system. Once executed, malware connects to its C&C server, downloads necessary files and makes significant changes to the system before launching data encryption process.

Cypher modifies Windows Registry to boot with system startup and perform its harmful activities. It’s unknown whether malware can delete Shadow Volume Copies or not. Therefore, there’s a chance to recover files without paying the ransom.

Cypher ransomware targets the most popular file types to cause bigger damage to the victim and encourage him or her to pay the ransom. The ransom-demanding instructions are dropped on the computer’s desktop soon as all files are given .cypher extension.

In the HOW_TO_DECRYPT_FILES.html, cyber criminal provide a link to the TOR website where victims are asked to pay 0.01 Bitcoin in order to use Cypher decryptor. According to the ransom note, after the payment, people can download the decrypter.exe file and recover their files.

However, security specialists warn that spending the money on this program might lead to severe problems. First of all, the decrypter might not work. Secondly, you might install more malware on the system instead of recovery tool.

Instead of risking to lose the money after the attack, you should remove Cypher from your machine and recover your files from backups. If you are one of the users who does not back up, we suggest trying to recover files with third-party software (our recommendations are given below).

Ransomware is complex and hard to detect cyber threat. Thus, for Cypher removal, you have to use a powerful malware removal software to clean your PC. We highly recommend using FortectIntego because this tool not only cleans but fixes computer after the malware attack.

Authors of ransomware might use a couple of methods to spread ransomware virus

Security specialists from avirus.hu^[2] state that user’s participation is usually required in ransomware’s infiltration. The malicious program is often presented as an important email attachment, software installer or update. Hence, you should be aware of these distribution methods:

• malicious spam email attachments that inform about parcel delivery problems, received statements or provide other important details;
• malware-laden ads that often provide great (but fake!) shopping offers, software updates or downloads;
• bogus software updates;
• illegal software downloads;
• RDP attacks;^[3]
• exploit kits.

To protect yourself from losing files to a file-encrypting virus, it’s not enough to install a robust antivirus. Taking other security measures is also important because even the best security tool cannot fully protect you.

Chances to catch ransomware infection decrease when you keep your software and operating system updated, avoid visiting questionable websites and do not download questionable software from torrents and other shady places.

Removal of the Cypher ransomware virus

You should start Cypher removal by rebooting the affected computer to Safe Mode with Networking. It helps to disable the virus and run security software. Usually, crypto-malware is designed to prevent installation of security software or blocks its operation.

When in Safe Mode, install FortectIntego, MalwarebytesMalwarebytes or your preferred security tool, update it and run a full system scan. We recommend scanning the computer a couple of times to make sure that all malicious components are wiped out entirely. Then you can safely recover your files from backups or try our suggested alternative methods below.