How to remove .Enc encryption (Crypt0l0cker virus) and restore encrypted files

Ransomware is the most dangerous type of viruses that might be picked up on the Internet. The danger is in the fact that the removal of virus won't return your files, they will still be encrypted, and you will still need to find the way to recover them. The files, encrypted by low-quality ransomware might be recovered via basic system services, like Shadow Volume Copies service, or with help of ordinary data recovery tools. The most dangerous examples erase the shadow copies, and make the files completely inaccessible, so user is forced to pay the ransom, or to wait until the proper decrypting tool will be released.

Crypt0l0cker ransomware has drawn our attention because of its name. Crypto Locker was one of the most effective viruses, and it took months for skilled experts to break its code and create the decryptor. Crypt0l0cker is significantly weaker than its predecessor, but still dangerous. It uses strong encryption algorithms, asks to make payment via BitCoins, and keeps its data in the DarkWeb, so it's not easy to find the command center. If you have Crypt0l0cker on your PC - you should wait until we'll have more information on it, to help you. At this time we can say that you should not pay the ransom, because you have no guarranty that hackers will decrypt your files after payment. Be patient, remove the virus and store the encrypted files in the separate folder, to easily find them, when the decryptor will be released

How to remove .enc virus

Data restore is the main issue that you think about, if you have .Enc in your system. Nonetheless, the virus must be removed in order to protect new files. The removal of .Enc is a required phase of all restoring techniques. The instant deletion is required if you decided to decrypt your files in manually, or you are going to load the backups, and if you prefer to pay the price - the malware should be uninstalled when the files will be fully restored. The removal can be performed with use of special antivirus software, or by-hand. Safety and swiftness of both methods are identical, but the requirements for user practice and skill are significantly different. You must be a seasoned user to perform the disposal in manual mode without errors. Practice is needed in order to avoid failures and to correct the aftermath of error, if it does occur. Disposal with help of antivirus doesn't need any skills of the customer. You simply have to do some clicks and wait for 5 minutes. Below this paragraph, you'll see the complete instructions to remove .Enc. We accurately describe every single step of the process, to avoid any failures. But, if you don't want to delete this malware in manual mode, and want to get the high level of defense against any virus - the best choice for you is to download the worthy anti-virus. Download Spyhunter to remove .Enc virus automatically


Special Offer

Download Spyhunter - Anti-malware scanner

We advise downloading SpyHunter to see, if it can detect malware for you.

Spyhunter has a biggest malware database

It protects the system against all kinds of threats: Trojans, adware and hijackers

24/7 Free Support Team

SpyHunter scanner detects threats and malware for free, but to remove infected elements you need to purchase a full version of program for 39.99$. More information about Spyhunter, EULA and Privacy policy.

Manual removal

Step 1. Boot the system into safe mode

  • Press Start
  • Type Msconfig and press Enter

Safe mode. Step 1


  • Select Boot tab

Safe mode. Step 2



  • Select Safe boot and press Ok

Alternative way how to boot computer into safe mode:


Step 2. Show all hidden files and folders

  • Press Start
  • Click on Control Panel

Show hidden files. Step 1


  • Select Appearance and Personalization

Show hidden files. Step 2


  • Click on Folder Options
  • Select View tab
  • Select Show hidden files, folders and drives

Show hidden files. Step 3


  • Press Ok

Step 3. Remove .Enc files

Check next folders to find suspicious files:

  • %TEMP%
  • %ProgramData%

Step 4. Clean registry (for experienced users)

  • Click Start
  • Type Regedit.exe and press Enter
  • Clean startup registry keys
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunServices
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit




How to restore files encrypted by .Enc

The issue of encrypting virus has only one effective solution, and it is the load of backups. You should use other manners if you have no choice, but be ready that they might not be successful. The significant strength of backups is that they are stored on an external drive, and aren't available for .Enc's impact.

  • Click Start
  • Click Control Panel

Decrypt files. Step 1


  • Click System and Security

Decrypt files. Step 2


  • Select Backup and Restore

Decrypt files. Step 3


  • Select Restore files from backup
  • Select checkpoint to restore


Other techniques are based on the OS in-built services, and their success may be decreased by the complexity of the ransomware and the absenсe of skill. We can suggest you two more decryption methods. You might use the shadow copy service, or a special program to restore the data. Decryption via special decryptor is pretty efficient, but unfortunately, this tool is not developed for now. Info about the progress in the developing of the tool might be seen on EmsiSoft, Kaspersky lab and MalwareHunterTeam official web-pages. Manual recovery using Shadow Volume Copies may be done right now. You can use the basic functionality of Windows OS, but, there are more user-friendly tools, which will make this work simpler. These tools are called Recuva and ShadowExplorer. Both of them are unpaid, you may download them on the official web-pages, with step-by-step instructions for their using.




Share your feedback to help other people
1 1 1 1 1 1 1 1 1 1 Rating 5.00 [1 Vote]

Add comment

Security code



Acronis suggestion to CrashPlans users

Around a month ago, there was an accident with CrashPlans backup software.

What is MicTrayDebugger and is it dangerous

This is a brief entry about MicTrayDebugger: what is it, how it appeared in the system, is it dangerous and how to get rid of it.

What is HoeflerText and is it dangerous?


This article is dedicated to the fraud scheme that is called HoeflerText font wasn't found. We will explain you what is this scheme and how to avoid it.

What is Wpad.dat virus and how it is used

The topic of our today's article is a script that had been unjustly called a virus. It’s Wpad.dat, and it is not a virus. We will explain what is Wpad.dat and how to prevent fraudsters to deceive yourself with its help.


Cancer virus trollware

This is an article about crazy Cancer virus and the madness that it brings to victim's computer.

This website uses cookies to improve your experience