Cerber Crypto-Virus – Remove It and Get .Cerber Files Back

Notorious crypto-virus, known as Cerber is reported to be infecting users on a really large scale. The virus asks the huge sum of 1.24 bitcoins to give users their files, encrypted with a powerful AES cipher back. At this stage, there is no viable method to decipher files of victims free of charge.

In Depth Analysis Of Cerber Crypto-Virus

After this virus has been activated on the targeted computer, it starts scanning for information. It has a database of countries which according to Bleeping Computer researchers can make the virus to self-delete. For example, if it has Spain in its whitelist and detects that the infected computer is from there, it will not infect it. Here are some of the countries believed to be associated with the Cerber virus:

• Armenia
• Azerbaijan
• Belarus
• Georgia
• Kazakhstan
• Moldova
• Russia
• Turkmenistan
• Tajikistan
• Ukraine
• Uzbekistan

This is a strong indicator that the makers of the ransomware may be from those countries.

After infection, the virus will duplicate randomly named files in the %AppData% folder. The files may have different names, such as svchost.exe, for example. The Cerber virus might also make Windows run in Safe Mode by executing administratively privileged command:

The Cerber virus is also going to add keys in the Windows Registry Editor to make itself run when you start Windows and when you leave your computer for some time without touching it, for example, 5 minutes. It may also run every minute to encrypt newly added files.

After the encrypter of Cerber is ran it shows a pop-up which displays a fake error message and restarts the victim’s computer:

Malware researchers have also reported that Cerber Ransomware has a wide variety of file extensions it encrypts with a powerful AES-256 encryption algorithm. They are around 80 types of files, and they include:

• Databases.
• Virtual drives.
• Files associated with programs which are often used.
• Pictures and other image files.
• Audio files.
• Other support files for programs.

The malware carefully avoids encrypting crucial files to Windows because this way it will break the OS. Some of the files it skips are:

• Bootsect.bak
• Iconcache.db
• Thumbs.db
• Wallet.dat

The Cerber virus is so sophisticated that it can even encrypt shared files over the network between different Windows computers. The encrypted files are believed to have the .cerber file extension, for example:

• File.xls.cerber

They can no longer be opened because their source code is changed. If you keep reading this article you can find more information on encrypted files.

After encrypting your files, the Cerber Crypto-Virus should drop ransom notes in the form of .html, txt and .vbs files. What is interesting is that the .vbs file, unlike the other two contains the same ransom message in an audio format. The audio file features a woman saying:

When the .html file has been opened, it displays Cerber’s web link which has further instructions on how to convert money in Bitcoin and pay to the cyber-crooks for your files.

How Does Cerber Distribute

To be spread, Cerber is widely believed to use an Exploit Kit, which downloads it onto the infected computer. Using these type of malicious scripts increases the likelihood of infecting users. They may be spread via malicious macros of Microsoft Office, Adobe Reader and other files which have such macros. Since inexperienced users become fooled and open such e-mails which resemble a service they are probably registered in or a trustworthy sender, they become victims of Cerber ransomware.

Can .wflx Files Be Decrypted

At this sage files, which have been encoded by Cerber Ransomware cannot be directly decoded. However, do not lose hope, because malware researchers are working vigorously to find holes in this malware’s security and hence make a decrytpor. Until then, you may try other tools, like data recovery software(google it) that can help you with the partial recovery of some of your files.

Cerber Crypto-Virus – Conclusion and Removal

We strongly urge you to use an advanced anti-malware program to scan for and remove Ceber Crypto-Virus from your system. This will make sure you do it safely without harming the already encrypted files, making any decryption impossible. Such program will also protect your computer in the future from other threats as well.

Cerber Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Cerber completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Cerber Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter