Solved: How to Uninstall Trojan.Win32.Encoder.eqxhwz (Data Recovery Included)


What Danger Does Trojan.Win32.Encoder.eqxhwz Possess?

Trojan.Win32.Encoder.eqxhwz is an alternative name used to represent 'Keep Calm Ransomware', crafted to apply a custom made AES cryptographic algorithm to the certain types of files and make in accessible. Next, it offers you a deal in the behalf of threat actor for restoring your enciphered files through 'Instruction.rtf'. According to the deal, you need to make ransom payment of 0.1 BTC (currently equivalent to 231.24 USD) to a private Bitcoin base account address. Also, the payment must be made using TOR browser. You should know that this malware is developed using EDA2 open-source project which was first upload on dark web in May 2016. There are dozens of cryptomalware developed based on this project. In fact, Trojan.Win32.Encoder.eqxhwz is identical to FSociety, Shifr, ShinoLocker ransomware. This cryptomalware was first reported on July 18th, 2017.

remove Trojan.Win32.Encoder.eqxhwz

Distribution of this malware involves varieties of Key Generators for shareware and costly software. If you download such key generators then what you will next find is encrypted files featuring '.LOCKED' extension. It is also reported for infiltrating computers through spam emails attachments containing exploit kits or macro-enabled document. When your computer under the trojan attack, you see your desktop wallpaper is changed to a black screen with a pirate's flag on top. We should mention, this flag used to describe a generic pirate flag named – Jolly Roger. The wallpaper features a message stating “Keep Calm and Recover Files.” Further you should remember that its C2 server was located at IP address and it transmit data to www[.]all400pples[.] The trojan downloads the ransom notification from following remote locations:

  • hXXp//185[.]145.128.160/troll-100/instructions.rtf
  • hXXp://185[.]145.128.160/troll-100/wall.jpg

Trojan.Win32.Encoder.eqxhwz Aliases:

  • Ransom_CRYPTEAR.SM0
  • Win32/Trojan.Ransom.a8c
  • Win32:Malware-gen
  • a variant of MSIL/Filecoder.AK
  • malicious_confidence_100% (W)
  • Ransomware-FTD!F994759181FB
  • Gen:Variant.Ransom.HiddenTear.1
  • Trojan ( 004ddf631 )
  • Trojan.Agent!7pAHjkOWEIw

Trojan.Win32.Encoder.eqxhwz: Prevention

  • First, you need to avoid installing malicious key generators for activating software or games.
  • You have to delete spam emails that sent by unknown sources.
  • You must never execute attachments without verifying the source.
  • More importantly, you need to keep your Windows firewall and security software turned on. Also you need to schedule automatic scan for instant protection against newly released malware.

Finally, we recommend you to uninstall Trojan.Win32.Encoder.eqxhwz from your Windows system and recover 'LOCKED' extension files using following guideline: 

Manual Instructions To Remove Trojan.Win32.Encoder.eqxhwz From PC (Working Guide)

Step : 1 Tips To Use Safe Mode With Networking To Remove Trojan.Win32.Encoder.eqxhwz

For Windows XP | Vista | 7

  • Keep on tapping F8 until Advanced Boot Options Window appears.
  • Now select Safe Mode with Networking option from the list.

For Windows 8/ 10

  • Press Power button at the bottom of Windows Login screen. Press and Hold Shift button on the keyboard and tap restart.
  • Tap Troubleshoot Under Advanced Option in Startup settings and press on Restart.
  • Now select Enable Safe Mode with Networking in Start up settings.

Step: 2 Tips To Reveal Hidden Files and Folders. (This page will guide users on Tips To reveal hidden files in Windows XP, 7, 8 and 10. Users are instructed not to skip this step in any case as various files and folders created by Trojan.Win32.Encoder.eqxhwz might be hidden and need to be Cleaned before proceeding further.)

Step 3: Hold Start Key + R and copy + paste appwiz.cpl OK.

  • This will open Control Panel. Now look for all Trojan.Win32.Encoder.eqxhwz related suspicious entries and Remove it at once. Now Type msconfig in the search box and press enter. Uncheck suspicious and Trojan.Win32.Encoder.eqxhwz related entries.

Step: 4 Press Start Key and copy paste the following command and click on OK.

  • Notepad %windir%/system32/Drivers/etc/hosts.
  • Now, a new file will open. If your PC has been hacked by Trojan.Win32.Encoder.eqxhwz, there will be a bunch of unknown IPs connected to the machine at the bottom. Look at the image below:

  • If there are lots of suspicious IPs below Localhost, then Clean it without any delay.

Step 5: Press CTRL + SHIFT + ESC key simultaneously. Go to the Processes Tab and try to determine which one is a Trojan.Win32.Encoder.eqxhwz process.

  • Right click on each of the Trojan.Win32.Encoder.eqxhwz processes separately and select the Open File Location. End process after you open the folder. Then after, Remove the directories you were sent to.

Step 6: Type Regedit in Windows search field and hit Enter.

  • Once inside, press the CTRL and F together and type the Trojan.Win32.Encoder.eqxhwz. Right click and Remove any entries that you find with a similar name. If they do not show in this way, then go Possible Steps For to these directories and Remove them.

Step 7: Tips To Scan Trojan.Win32.Encoder.eqxhwz Using Free Tool

Still if Trojan.Win32.Encoder.eqxhwz exists on your PC, then you need to Free scan your PC with Malwarebytes Anti-Malware Software. This page has clear installation instructions and Tips To use it.