How to remove .lnk.EnCiPhErEd virus

For several days now, my computer is under attack by .lnk.enciphered virus. All my files have this extension and the icons are all the same. When I clicked on those files it shows this warning ““Attention! All your files are encrypted! You are using unlicensed programs!”

This .lnk.EnCiPhErEd also wants me to pay 50EUR to get my computer back. It says that by paying the amount, I will be able to decrypt all my files. Are there any free ways to remove the encryption? It is verified that the files are encrypted because when I hover the mouse on icons, it displays that file type is CRYPTED.

The virus also insists that I have illegal programs on my PC even though all my software are genuine. I never have pirated materials. Please help me remove the “.lnk.EnCiPhErEd” file extension. I want my original icons back and most of all, I want this virus out of my computer.


  1. Jelay

    Our office computers were infected with this virus. We successfully removed the EnCiPhErEd virus by downloading a file provided by DrWeb. Here is the link.

    First, make a copy of the .EnCiPhErEd file on USB drive. This will serve as test file for decryption. It must work on this test file before trying it on your general files. Incorrect decryption may damage your file. So please do not use this tool without running a test.

    On the command line, type –k 85 and that will decrypt all affected files. After that, you must run a virus scan to make sure that the virus is gone. I used Trendmicro to remove the virus and it found hundreds of infected items.

  2. Dandan

    Hii :) i have the same problem but i cant open the Te94dercyptor :) everytime i click continue it says wrong key . Please someone help

  3. Dennis

    Try running Te94dercptor from the CMD prompt and be sure to leave a space between the -k and the 85. It ran that way for me but it didn’t decrypt anything. Good luck. I think all my files are unrecoverable at this point except the ones I backed up to DVD. Even my network drive with my backups was encrypted.

Comments are closed.