FileCoder.Day is a file-encrypting ransomware variant that belongs to the broader FileCoder family of crypto-malware. This threat systematically encrypts user documents, photos, databases, and other valuable files using strong cryptographic algorithms, then demands payment (typically in Bitcoin) for the decryption key. Once activated, FileCoder.Day appends a distinctive extension to locked files and drops ransom notes instructing victims on how to pay the attackers—often within a narrow time window before the price increases or the decryption key is permanently deleted.
Like most modern ransomware, FileCoder.Day represents a severe threat to both home users and small businesses. Recovery without backups or the attackers' cooperation is extremely difficult, and paying the ransom offers no guarantee of file recovery. Understanding how this malware operates and how to remove it (even if files remain encrypted) is crucial for minimizing damage and preventing reinfection.
Threat Profile
| Malware Family | FileCoder ransomware family |
|---|---|
| Known Aliases | FileCoder.Day, Filecoder variant, Day Ransomware (detection names vary by vendor) |
| Targeted Platforms | Windows (7, 8, 8.1, 10, 11); some variants may target network shares accessible from infected systems |
| First Discovery | Early variants of FileCoder family documented circa 2016–2017; .Day variants emerged later as offshoots |
| Distribution Methods | Malicious email attachments, exploit kits, fake software updates, RDP brute-force attacks, compromised downloads |
| Encryption Algorithm | Typically AES-256 for file encryption with RSA-2048 or similar asymmetric encryption for key protection (specifics vary by build) |
| File Extension Added | Varies by variant; common extensions include .day, .locked, or randomized strings appended to original filenames |
| Ransom Note Filename | Often HOW_TO_DECRYPT.txt, README.txt, or similar; dropped in encrypted folders and desktop |
| Payment Demand | Ranges from $300 to $1,500+ USD equivalent in Bitcoin; often increases after 48–72 hours |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, startup folder shortcuts; some variants delete themselves after encryption to avoid detection |
| Capabilities | File encryption, shadow copy deletion (via vssadmin), privilege escalation attempts, anti-recovery measures, network share scanning |
| Network Behavior | Contacts command-and-control servers to register victim ID and retrieve encryption keys; may scan local network for additional targets |
| Removal Difficulty | Moderate to remove the malware binary itself; file decryption without the private key is effectively impossible without backups or rare decrytor availability |
How It Spreads
FileCoder.Day ransomware relies on several proven distribution channels, with phishing emails being the most common initial infection vector. Attackers send messages that appear to come from shipping companies, financial institutions, or government agencies, with attachments disguised as invoices, receipts, or urgent documents. These attachments—often Office documents with malicious macros or JavaScript files in ZIP archives—download and execute the ransomware payload when opened by an unsuspecting user.
Beyond email, this ransomware family spreads through compromised websites hosting exploit kits that target unpatched browser or plugin vulnerabilities. Victims visiting these sites with outdated software can be infected without any explicit action on their part. Remote Desktop Protocol (RDP) brute-force attacks represent another significant vector, particularly for small businesses that expose RDP to the internet without adequate password policies or two-factor authentication. Once attackers gain RDP access, they manually deploy the ransomware after disabling security software and backups.
Additional distribution methods include:
- Fake software updates: Bogus Flash Player or browser update prompts on compromised or malicious websites
- Trojanized pirated software: Cracked applications and keygens bundled with ransomware payloads
- Malvertising campaigns: Poisoned advertisements on legitimate websites redirecting to exploit kit landing pages
- Supply chain compromise: Legitimate software installers replaced with trojanized versions on compromised download servers
- Lateral movement: Spreading from an initial infection to other computers on the same network via shared folders and weak credentials
- USB and removable media: Infected external drives configured with autorun capabilities
What It Does On Your Machine
Once executed, FileCoder.Day immediately begins establishing persistence and preparing the system for encryption. The malware typically copies itself to a hidden location in the user's AppData folder using a randomized filename or GUID-based directory name. It creates registry entries in the Run key to ensure it survives reboots, though many variants delete themselves after encryption completes to hinder forensic analysis. Before beginning encryption, the ransomware often attempts to disable Windows Defender and other security software by modifying registry settings or terminating security processes.
The malware's most destructive action is deleting Volume Shadow Copies—Windows' built-in backup snapshots—using commands like vssadmin.exe Delete Shadows /All /Quiet. This prevents victims from using System Restore or previous versions to recover encrypted files. Some variants also disable Windows Startup Repair and delete backup catalogs. The ransomware then generates a unique encryption key pair for the victim, communicates with its command-and-control server to register the infection and transmit the victim ID, and begins systematically scanning all local and accessible network drives for target file types.
FileCoder.Day encrypts hundreds of file extensions including documents (.doc, .docx, .pdf, .xls), images (.jpg, .png, .psd), databases (.sql, .mdb, .accdb), archives (.zip, .rar), and more. It uses strong encryption (typically AES for speed) with the encryption key itself encrypted by an RSA public key, making decryption without the attackers' private key computationally infeasible. The malware typically skips system files and folders necessary for Windows to boot, as the attackers want the victim's computer functional enough to pay the ransom.
After encryption completes, FileCoder.Day drops ransom notes in every folder containing encrypted files and often changes the desktop wallpaper to display payment instructions. These notes contain a unique victim ID, Bitcoin wallet address, payment amount (usually with a deadline-based price increase), and instructions for accessing a Tor-based payment portal. Some variants include a "free decryption" offer for one or two files as proof the attackers possess the decryption capability.
Manual Removal — Step by Step
Immediately Isolate the Infected System
Disconnect the computer from the internet and any network connections (unplug Ethernet cable, disable Wi-Fi). If you're on a business network, notify your IT administrator immediately. Turn off any network-attached storage devices or cloud sync services to prevent encryption from spreading. Ransomware actively seeks network shares and mapped drives, so isolation is critical to containing the damage.
Boot Into Safe Mode with Networking
Restart the computer and enter Safe Mode to prevent the ransomware from loading with Windows. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and select "Safe Mode with Networking" (option 5). This minimal environment loads only essential drivers and prevents most malware persistence mechanisms from activating.
Identify and Terminate Malicious Processes
Open Task Manager (Ctrl+Shift+Esc) and look for suspicious processes, particularly those running from AppData folders with random names or mimicking system processes (like "svchost.exe" running from user directories rather than System32). Right-click any suspicious processes and select "End Task." Note the executable location before terminating, as you'll need to delete the files manually. Be cautious—legitimate system processes do exist, so if you're uncertain, photograph the process details for later verification.
Remove Persistence Mechanisms
Open Registry Editor (type "regedit" in Start menu) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries pointing to random executables in AppData folders and delete them. Also check the Startup folder at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup for suspicious shortcuts. Open Task Scheduler (taskschd.msc) and review recently created tasks—delete any that reference unknown executables.
Delete the Malware Binary and Associated Files
Navigate to the location where the malicious executable resides (typically somewhere in %LOCALAPPDATA% or %APPDATA%) and delete the entire folder. You may need to show hidden files and folders (View tab > Hidden items in File Explorer). Also delete any ransom note files (HOW_TO_DECRYPT.txt or similar) from your Desktop and other locations, though these are informational only and not dangerous themselves.
Run Comprehensive Anti-Malware Scans
Download and install Malwarebytes or another reputable anti-malware tool (while still in Safe Mode with Networking). Update the definitions, then run a full system scan. These tools have databases specifically for ransomware detection and can identify remnants or additional payloads you may have missed. Also run a scan with your existing antivirus software if you have one installed. Address all detected threats before proceeding.
Check for and Remove Shadow Copy Modifications
Although FileCoder.Day typically deletes shadow copies, verify the damage by opening an elevated Command Prompt (right-click Start > Command Prompt (Admin)) and typing vssadmin list shadows. If any shadows remain, you may be able to recover files. Check if System Restore was disabled by typing bcdedit and looking for "recoveryenabled" settings. Re-enable if necessary with bcdedit /set {default} recoveryenabled Yes.
Restore Files from Backup (If Available)
If you maintain external backups or cloud storage that wasn't affected, now is the time to restore your files. Do NOT reconnect backup drives until you're certain the malware is completely removed—otherwise you risk encrypting your backups as well. Verify file integrity after restoration and scan restored files with antivirus as a precaution against reinfection from backed-up malware.
Check for Free Decryption Tools
Visit the "No More Ransom" project website (nomoreransom.org) to see if a free decryption tool exists for your specific FileCoder variant. While uncommon for recent ransomware, law enforcement and security researchers occasionally crack older ransomware families or obtain keys from seized criminal infrastructure. Upload one encrypted file and the ransom note to ID Ransomware (id-ransomware.malwarehunterteam.com) to identify your specific variant and check for available decryptors.
Reboot, Verify, and Secure Your System
Restart the computer normally (not in Safe Mode) and verify that no suspicious processes return. Change all important passwords—particularly for email, banking, and any accounts where credentials may have been stored in now-encrypted files. Enable Windows Defender (if it was disabled) and ensure Windows Update is current. Monitor system behavior for the next few days for any signs of persistent infection. Consider using Application Whitelisting or other advanced protections to prevent future incidents.
Prevention
- Maintain regular, offline backups: Follow the 3-2-1 rule—three copies of important data, on two different media types, with one stored offline or offsite. Disconnect external backup drives immediately after backup completion to prevent ransomware from encrypting them. Test your backups periodically to ensure they're actually recoverable.
- Keep all software updated: Enable automatic updates for Windows, browsers, and all applications. Many ransomware infections exploit known vulnerabilities in outdated software. Pay particular attention to Java, Adobe products, and Microsoft Office—historically common attack vectors.
- Deploy robust email filtering and user training: Implement spam filters that scan attachments for malicious content. Train all users to recognize phishing attempts, verify sender identities before opening attachments, and never enable macros in documents from unknown sources. When in doubt, call the supposed sender to verify legitimacy.
- Restrict user privileges: Don't use administrator accounts for daily computing tasks. Standard user accounts can't make system-wide changes that ransomware often attempts, limiting potential damage. Use UAC (User Account Control) prompts as speed bumps to prevent accidental malware installation.
- Secure Remote Desktop Protocol: If you must expose RDP to the internet, use strong passwords, enable Network Level Authentication, implement two-factor authentication, and restrict access to specific IP addresses via firewall rules. Better yet, use a VPN for remote access instead of exposing RDP directly.
- Deploy comprehensive endpoint protection: Install reputable antivirus/anti-malware software with real-time protection and behavior-based detection. Enable ransomware-specific protections like controlled folder access in Windows Defender to prevent unauthorized applications from modifying protected directories.
- Disable unnecessary features: Turn off macros in Office applications by default, disable PowerShell for non-administrative users, and remove or restrict Windows Script Host if your environment doesn't require it. Each disabled feature reduces your attack surface.
- Monitor network traffic and segment networks: Use firewalls to create separate network segments for different functions (guest Wi-Fi, workstations, servers, IoT devices). Implement intrusion detection to spot unusual outbound connections that might indicate command-and-control communication. Businesses should deploy Security Information and Event Management (SIEM) solutions to correlate suspicious activities.
Bring It In
Ransomware infections like FileCoder.Day require expertise that goes beyond standard virus removal. At Computer Repair Roswell, we've handled hundreds of ransomware cases and understand the urgency of these situations. Our technicians can safely remove the malware, advise you on file recovery options (including professional data recovery services when appropriate), and implement security measures to prevent reinfection. We'll never recommend paying a ransom without first exploring every alternative—and we'll explain your realistic options honestly.
We're located in Roswell, Georgia, and serve the entire North Atlanta area. Call us at (770) 709-7797 or bring your infected computer to our shop. For ransomware emergencies, we offer expedited service to minimize downtime and data loss. Remember: the longer ransomware runs on your system, the more files it encrypts. Fast professional response can make the difference between minor inconvenience and catastrophic data loss. Let us help you get back to normal—and stay safe going forward.