Member Avatar for questionmy

Could you please help me? There is the Trojan.FileHarakiri virus on my computer My antivirus is unable to do anything. This virus is corrupting my files and I can't open Word and Excel files, as well as my photos and e-mail. How do I delete it from my computer? Can I still save the files?!!!

  • 4 Contributors
  • 4 Replies
  • 250 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

A short, practical summary and safe plan based on the thread: Trojan.FileHarakiri is a rogue/“fake AV” family that displays scare popups and can block or damage access to Office documents, photos and mail — it was designed to trick victims into paying for fake removal. is correct that this is an old scareware/rogue behavior, but variants differ and simple one-line fixes are often incomplete. (spywareremove.com)

Containment and evidence preservation come first. Isolate the infected machine from networks, then create a full disk image (bit-for-bit) or remove the drive and image it on a clean machine — do not overwrite the original. Keep copies of any ransom notes and several encrypted sample files on separate media. Removal should be attempted from a clean environment (bootable rescue media or an offline scanner) rather than inside the running, infected OS. Pre-boot rescue tools and offline scanning are recommended for persistent components. (bleepingcomputer.com)

Identification and recovery: upload a ransom note or an encrypted sample to an identification service to determine the exact family; if a known decryptor exists, reputable repositories will list it. Do not pay the demanded fee as a first option — law enforcement and security vendors advise against it, and paying does not guarantee recovery. If no decryptor exists, archive encrypted files (so a future tool can be applied) and restore from verified backups when possible. (id-ransomware.malwarehunterteam.com)

Practical forum workflow: follow the forum’s “Read Me First” guidance and collect the requested logs before doing any destructive removals (an image plus diagnostic logs gives helpers the best chance). ’s point that removal must come first is correct; ’s quick steps are sometimes a start but are not a complete remediation plan, and ’s warning that recovery may be hard is realistic. If data is critical or confidence is low, engage a reputable data-recovery or incident‑response provider rather than running untrusted tools. (bleepingcomputer.com)

Recommended Answers

All 4 Replies

Member Avatar for imagine_

hi. It's an old virus, and it usually invades your computer to make you pay money. As you pay, your credit card information is being stolen, and it is later used to steal the money from it. However, even after you pay, the virus does not get deleted from the computer. Here I have written a short instruction on how to delete it (although I still think it may not work for all the versions of the virus):

1. HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - replace Shell via explorer.exe
2. kill alert.exe process
3. remove $APPDATA\Primary

it's far more complicated to restore the files. Not all of them can be restored. I tried programs <snip> and <snip>, but the one that works the best is <snip>. It helped me with e-mail files and photos that other programs failed to restore

Edited by crunchie because: Snipped URL's. Keep it spam free!
Member Avatar for jholland1964

The steps given above are the least of your worries. NONE of those steps will remove this infection and that is the very first order of business that must be undertaken. File recovery at this point is useless, removal is #1.
To begin this process follow the instructions in our Read Me First sticky and post back here with all the requested logs.

http://www.daniweb.com/forums/thread134865.html

Edited by jholland1964 because: n/a
Member Avatar for crunchie

I guess he is that infected he cannot get back. Too bad.

Member Avatar for jholland1964

Oh I don't think we need to worry, I believe questionmy's computer is still working well enough to post this identical question at three more forums several days after posting here along with his "imaginary friends" identical response and they also remain at seven other forums too. All but two have removed the "imaginary" or "extended" unapproved links given in the response as we have done here. So we don't need to be concerned.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.