Security researchers discovered a new dangerous lockscreen threat knwon as the CainXPii virus that belongs to the same family as the infamous Hitler ransomware. Our complete removal guide shows victims how to eliminated the infection and recover their files.
Manual Removal Guide
Recover Encrypted Files
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
How Does CainXPii Ransomware Virus Infiltrate the System?
The CainXPii Virus can be distributed using different strategies. We suspect that the captured samples so far present a testing version. This means that the current attack wave is relatively minor in comparison to a real campaign. Follow-up versions of the malware can utilize different spread tactics including some of the popular ones.
Email spam messages use social engineering tricks to confuse the targets into infecting themselves with the CainXPii virus. The messages are crafted to look like notices and other important documents. The payload may be either attached directly or linked in the contents.
In recent times malware such as the CainXPii ransomware virus are included in infected software installer bundles or office documents. The hackers include the virus code in them and once they are opened by the victims the danger is installed on the host systems. Virus delivery through scripts in some cases cannot be detected by ordinary anti-virus software. This is why we recommend that every computer user install and use a quality anti-spyware solution.
The CainXPii ransomware can also be contacted from P2P networks like BitTorrent trackers where pirate content is usually distributed. The hackers also maintain their download sites that appear as legitimate sources.
Direct hacker intrusion attempts are also possible. The criminal users target outdated software and break into computers if vulnerabilities are found. This is why we recommend that all users update their operating system and installed programs.
Related: Hitler Ransomware Virus, Exotic Squad Ransomware Virus
Infection Flow of CainXPii Ransomware Virus
Security researchers identified a new malware that appears to contain the same signatures as that of the infamous Hitler ransomware. At the moment the hacker or hacker collective behind it has developed only a testing version.
Upon infection with CainXPii ransomware it automatically starts a lockscreen that displays a ransomware message in German. Instead of encrypting user and system data the creators of the virus have embedded a file delete function. If the victims close the application window the malicious engine starts to randomly delete files.
The shown message reads the following:
Warnung: Dein PC fiel der TODCE RASNOMWARE zup Opfer! All deine Daten wurden verschlusselt.
Du hast bis zum Ablauf der Zeit
Die Moglichkeitdeinen PC mithilfe einer Zahlunf in
Hohe von 20€ Widerherzustellen
falls du bis zum Ablauf der Zeit keine
Wiederherstellung durchgefuhrt hast wird sich deine
PC herunterfahren, und alle Daten(Dokumenti, Spielstande, Photos, Passworter, Programme)
LOSCHEN.Falls du die 20€ gezahlt hast kann es bis zu
24h dauern, bis die Zahlung akzeptiert und
dein PC entsperrt wurde.Bitte 20€ PaysafeCard Codes hier eingeben
The CainXPii ransomware note is standard and attempts to blackmail the victims into paying the sum of 20 Euro in the form of a PaySafeCard code. According to the note the CainXPii virus is able to encrypt sensitive information such as documents, multimedia files and etc.
Instead of asking the victims to pay them the requested sum via a BiCoin transaction, the option here is the use of a PaySafeCard.
Remove CainXPii Virus and Restore Data
WARNING! Manual removal of CainXPii virus requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
CainXPii File Virus – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Show Hidden Files
Some ransomware threats are designed to hide their malicious files in the Windows so all files stored on the system should be visible.
1. Open My Computer/This PC
2. Windows 7
- – Click on Organize button
– Select Folder and search options
– Select the View tab
– Go under Hidden files and folders and mark Show hidden files and folders option
3. Windows 8/ 10
- – Open View tab
– Mark Hidden items option
4. Click Apply and then OK button
Enter Windows Task Manager and Stop Malicious Processes
1. Hit the following key combination: CTRL+SHIFT+ESC
2. Get over to Processes
3. When you find suspicious process right click on it and select Open File Location
4. Go back to Task Manager and end the malicious process. Right click on it again and choose End Process
5. Next, you should go folder where the malicious file is located and delete it
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
DOWNLOAD CainXPii Removal ToolSpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Recover Encrypted Files
WARNING! All files and objects associated with CainXPii file virus should be removed from the infected PC before any data recovery attempts. Otherwise the virus may encrypt restored files. Furthermore, a backup of all encrypted files stored on external media is highly recommendable.
WARNING! Manual removal of CainXPii virus requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
1. Use present backups
2. Use professional data recovery software
Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.
3. Using System Restore Point
- – Hit WIN Key
– Select “Open System Restore” and follow the steps
4. Restore your personal files using File History
- – Hit WIN Key
– Type restore your files in the search box
– Select Restore your files with File History
– Choose a folder or type the name of the file in the search bar
– Hit the “Restore” button
Preventive Security Measures
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
