How to remove Cerber Ransomware
What is Cerber:
Threat Classification: Ransomware
Cerber is a ransomware type infection, that infiltrates systems and uses strong encryption chippers to encrypt various files including .jpg, .doc, .xml, .avi etc. Cerber Ransomware uses AES and RSA encryption (AES for files and RSA for the private key) to make the decryption of files impossible without paying the ransom. Cerber changes the file extension to .cerber on every encrypted file. After successful infiltration the Cerber demands a ransom to be payed within specific timeframe – usually 7 days, failing to pay in the given timeframe will make the amount to double.
During the encryption process, the Cerber ransomware creates 3 type of files – #DECRYPT MY FILES#.txt, #DECRYPT MY FILES#.html, and #DECRYPT MY FILES#.vbs. These files are containing step-by-step instructions on how the payment should be proceeded. Every folder, which contains encrypted files will have these 3 files. Basically, these files are explaining that the encrypted files could be decrypted only with a software, developed by these cyber criminals and they call it – Cerber Decryptor. The Cerber Decryptor will costs you about 1.24 Bitcoins, which on the current exchange rate is about – 1.24 x $650 ~ $810 – this is the price, when the payment is made within 7 days, if you are late – this will become about $1600.
The malware researchers found something interesting – it appears that the Cerber Ransomware seems to be a danger to everyone except those living in Armenia, Azerbaijan, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, Ukraine, and Uzbekistan. This list is stored in a configuration file that also contains information regarding the files that must be encrypted or ignored.
The ransom should be paid using the Bitcoin system, which makes the transaction virtually untraceable. Similar to Cryptorbit, HowDecrypt and CryptoLocker, the Cerber will target computers running Windows operating systems. It was released by the developers of CryptoDefense in the end of May 2016. Unfortunately, as of now, there is no chance of decrypting the files encrypted by Cerber and the only reasonable solution is to restore your system from BACKUP.
Cerber will fully encrypt your data and the infection might come from various sources – infected files from various P2P networks, torrents or other file sharing applications, bogus flash player, Silverlight updates or fake video software for viewing online content, email attachments etc. When activated, Cerber encrypts certain types of files stored on your local and mounted network drives using RSA-2048 bit public-key cryptography, with the private key stored only on the malware’s command & control servers. Cerber does encrypt .doc, .xls, and .bmp, .txt, images and videos.
Once the infection is executed on your computer, it will inject itself deep into the system by modifying the registry in order to start with Windows on every boot. Then it will start encrypting files. This is a newborn virus and is very hard to detect. However, the infection will manifest itself after the encryption process has been completed.
Cerber will not only encrypt your files and lock your computer. It will also collect information that might be used to compromise you. The ransomware may steal other relevant information as your personal details, and send it over to the creators. That is the reason why this malware infection should not be left unattended, and it needs to be terminated immediately, as it is a serious threat to your online security.
*Please note that, unfortunately, as of now there is no method of decrypting the files encrypted by Cerber. The infection will also delete all your Shadow Volume Copies. The only way to restore your files is by using a backup copy.
There are two ways to remove this infection. It is totally up to you to decide which way you want to go:
1. Automatic Removal Method (recommended for ALL users) using a Professional Malware Removal Software – SpyHunter4.
2. Manual Removal (recommended for PC Experts or Enthusiasts).
Automatic Cerber Removal:
We recommend using SpyHunter Malware Security Suite.
You can download and install SpyHunter to detect Cerber and remove it, by clicking the button below. Once installed, SpyHunter will automatically scan and detect all threats present on your system, but in order to use it as a removal tool, you need to purchase a subscription.
SpyHunter will automatically scan and detect all threats present on your system.
Learn more about SpyHunter (EULA). You can find Install Instructions here: (LINK) SpyHunter’s free diagnosis offers free scans and detection. You can remove the detected files, processes and registry entries manually, by yourself, or to purchase the full version to perform an automatic removal and also to receive free professional help with any malware related queries by their technical support department.
*Bear in mind that the removal of the threat will NOT decrypt your files. As of now there is no method of decrypting the files encrypted by Cerber.
Manual Cerber Removal:
!!! Please note: You can remove Cerber manually. However, you should proceed at your own risk. Any of these interventions might render your system inoperable. Therefore this manual removal method is highly recommended for PC Experts or Enthusiasts. For regular users, MalwareKillers.com recommends using SpyHunter or any other reputable security application.
1. Remove Cerber by restoring your system to a previous state.
1. Reboot your computer into Safe Mode with Command Prompt. To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard.
***For Windows 8/10:
If you are using Windows 8, you need to hold the Shift button and tap the F8 key repeatedly, this should boot you into the new advanced “recovery mode”, where you can choose the advanced repair options to show up. On the next screen, you will need to click on the Troubleshoot option, then select Advanced Options and select Windows Startup Settings. Click on the Restart button, and you should now be able to see the Advanced Boot Options screen.
2. Using the arrow keys on your keyboard, select the option “Safe Mode with Command Prompt” and press Enter on your keyboard.
3. When the command prompt loads up, type:
Windows XP: C:\windows\system32\restore\rstrui.exe and press Enter
Windows Vista/7/8: C:\windows\system32\rstrui.exe and press Enter
4. System Restore should initialize, and you will be displayed a list of restore points. Try using a restore point created just before the date and time before the Your-computer-has-been-locked virus has infected your computer.
When System Restore has completed its task, start your computer in Windows normal mode, you would need to perform a scan with anti-spyware software as the infection might still be on the system.
*Please note that your files may remain encrypted, depending on whether your system restore has been set to recover system settings only or system settings and previous version of files.