Help to remove CERBER RASOMWARE

[John henry]

Hello,
My laptop(window 10 version) was infected with virus call Cerber Rasomware and all my files n documents changed to "Decrypt My File". Appreciated if you guys can advise me how to remove it.thanks

 

[Apparatus]

Re

Hello,
My laptop(window 10 version) was infected with virus call Cerber Rasomware and all my files n documents changed to "Decrypt My File". Appreciated if you guys can advise me how to remove it.thanks

Search the net for its ransonware removal tool

 

[Intrinion]

If your files are encrypted, I don't think there's anything that you can do unless you intend to pay for the decryption key - which I do not recommend that you do so.

Is there any important data on the drive?

 

[Intrinion]

Follow the steps listed here - https://malwaretips.com/blogs/remove-cerber-virus/

to remove Cerber and follow the steps listed to hopefully be able to recover your files.

I would also highly recommend that you reinstall your OS to remove further residue / traces of the ransomware - do let me know if you would like to do that and I would gladly guide you through the process.

Other reads:
https://blog.malwarebytes.org/threat-analysis/2016/03/cerber-ransomware-new-but-mature/

 

[John henry]

Actually the thing happen when I downloading some software. I don't mind to lost the files and data. What should I do? thx:

 

[jtjt00]

Actually the thing happen when I downloading some software. I don't mind to lost the files and data. What should I do? thx:

Are you able to wipe clean and install Win 10 afresh?

 

[John henry]

Hi Intrinion, could u pls advise the procedure to do this. I can try..

 

[Intrinion]

Sure!
Before I do so, could I check if it comes with Windows 10 by default or if it was upgraded from 7 / 8.1

Edit: also the brand of laptop and version of windows 10 (Home / Professional)

since different oems have their own ways of recovery (sometimes).

There's a default recovery method for all makes which I will update in a later post.

Hi Intrinion, could u pls advise the procedure to do this. I can try..

HardwareZone Forums app

 

[Intrinion]

Method 1: Resetting via Windows Recovery

Note: Be sure to plug the laptop into the outlet before proceeding.

Step 1: Start, followed by Settings

Step 2: Click on Updates and Security

Step 3: Following which click on "Recovery" followed by "Get Started"


2 Options will then appear:
Keep files or Remove Everything.

Select the option - "Remove Everything" and the process of resetting your laptop will start.

As your PC has been infected and files encrypted by the Ransomware, it is not known if system restore & Safe modes are disabled - thus this method may / may not work depending on how advanced the Cerber Ransomware is.

Will post up the recovery method via Windows 10 Media Creation Tool Momentarily.

 

[Intrinion]

Method 2: Reformatting / Re installation of Windows via Media Creation Tool

Pre Requisites: Empty thumb drive with at least 4GB of storage space. Do note that all data in the drive will be removed - so please do a back up if required / necessary.

I would also suggest creating the media on a non infected PC.

Step 0:
Plug in the thumb drive

Step 1:
Download and install the Windows 10 Media Creation Tool from the link listed here - http://go.microsoft.com/fwlink/?LinkId=691209

Step 2:
Run and install Media Creation Tool

Step 3:

Step 4:
Check on "use recommended options for this PC" if you are doing it on the infected laptop followed by next

Note: if you are creating the tool from another PC, do check the version of Windows 10 currently on the infected laptop - (Home / Pro & bit - 32 / 64 bit) and change the options as required.

Step 5:
Select USB, followed by next. Then verify the drive by the alphabet that you wish to create a bootable media on, followed by next.

Step 6:
It should take sometime to create the bootable media.
Following which, you now have a bootable media to reinstall your OS from.

There are a few methods to do it (Method 6A or 6B - choose 1)

I personally do a different method than most others don't, it personally has worked for me and is more straight forward so I generally do that.

=========================
Method 6A

Mount the drive on the laptop, and access the drive contents shown in the attached screenshot.

Run the installer by double clicking on "Setup"

Follow the on screen steps till you reach the following option
(Screen shot credits: laptopmag.com for the following two screenshots)

It should begin the re installation process
Nearing to the end of the process, you will be asked for your product key - just click skip will do.

You have now successfully reinstalled your OS.
=========================

Method 6B (skip if you have done method 6A)

Follow the first two screenshots posted in the previous post.

Followed by Advanced Start up to install the OS.

Boot via thumb drive and the installation process will start.
Follow the steps on what to keep listed on 6A.

Similarly nearing to the end of the process, you will be asked for your product key - just click skip will do.

You have now successfully reinstalled your OS.