Trojan:MSIL/FileCoder.BD is a ransomware variant written in Microsoft Intermediate Language (MSIL/.NET) that encrypts files on infected Windows systems and demands payment for their release. First detected in 2018, this threat belongs to the FileCoder family of file-encrypting trojans that specifically target individual users and small businesses with limited security infrastructure. While not as sophisticated as enterprise-grade ransomware like Ryuk or LockBit, FileCoder.BD can still cause significant data loss for victims without proper backups.
This malware typically arrives through deceptive email attachments, software cracks, or bundled with pirated applications. Once executed, it systematically encrypts documents, photos, databases, and other valuable files using strong cryptographic algorithms, appending custom extensions to locked files and leaving ransom notes demanding cryptocurrency payments. The .NET framework dependency means it runs natively on most Windows systems without requiring additional components, making it particularly effective against unpatched or poorly protected machines.
Threat Profile
| Attribute | Details |
|---|---|
| Malware Family | FileCoder (MSIL/NET-based ransomware family) |
| Classification | Trojan:MSIL/FileCoder.BD (Microsoft classification) |
| Aliases | MSIL/Filecoder.BD, FileCoder.BD, .NET Ransomware variant |
| Platform | Windows (requires .NET Framework 3.5 or higher) |
| First Discovered | 2018 (specific variant); FileCoder family active since 2017 |
| Distribution Methods | Malicious email attachments, software cracks, exploit kits, bundled installers |
| Encryption Method | AES or RSA hybrid encryption (typical for family) |
| File Extensions Targeted | Documents (.doc, .pdf, .xls), images (.jpg, .png), databases (.sql, .mdb), archives (.zip, .rar), 200+ file types |
| Persistence Mechanism | Registry Run keys, Startup folder entries, scheduled tasks (varies by variant) |
| Network Behavior | Command-and-control communication for key exchange, payment verification servers |
| Indicators of Compromise | Random-named .exe files in %APPDATA% or %TEMP%, modified file extensions, ransom note text files, registry modifications |
| Removal Difficulty | Moderate (malware removal straightforward; file recovery extremely difficult without backups or decryption tools) |
How It Spreads
Trojan:MSIL/FileCoder.BD reaches victims primarily through social engineering tactics that exploit human trust and curiosity. The most common vector involves convincing email messages with malicious attachments disguised as invoices, shipping notifications, legal documents, or employment offers. These emails often impersonate legitimate companies or government agencies, using spoofed sender addresses and professional formatting to appear credible. The attached file might be a .exe disguised with a double extension (like "invoice.pdf.exe") or hidden inside a ZIP archive, sometimes even password-protected with the password provided in the email body to bypass automated security scans.
Software piracy represents another significant distribution channel for this malware family. Users searching for cracked versions of expensive software, game cheats, or illegal activation tools frequently encounter trojanized installers containing FileCoder.BD. These infected files are often hosted on file-sharing sites, torrent trackers, or advertised through suspicious pop-up ads. The malware executable may be bundled alongside legitimate-seeming software or presented as a "crack" or "keygen" that users willingly execute with administrative privileges, giving the ransomware everything it needs to encrypt the system.
Additional distribution methods include:
- Malicious advertisements (malvertising): Compromised or fraudulent ads on legitimate websites that redirect to exploit kit landing pages or direct-download malware
- Remote Desktop Protocol (RDP) attacks: Brute-force attacks against exposed RDP services with weak passwords, allowing direct installation
- Compromised software updates: Fake update notifications for legitimate programs (Adobe Flash, Java, web browsers) that actually install malware
- Infected USB drives: Malware that auto-executes when removable media is inserted, particularly effective in business environments
- Drive-by downloads: Exploitation of browser or plugin vulnerabilities on compromised websites to install malware without user interaction
- Bundled with potentially unwanted programs: Hidden installations within freeware or adware packages that use deceptive installer screens
What It Does On Your Machine
Upon execution, Trojan:MSIL/FileCoder.BD immediately establishes persistence on the infected system to ensure it can complete its encryption operation even if interrupted. The malware typically copies itself to system directories with randomized filenames, creates registry entries to launch automatically at startup, and may establish scheduled tasks that trigger the encryption process at specified intervals. These persistence mechanisms ensure that even if users notice suspicious activity and restart their computer, the ransomware resumes its operation.
The core functionality revolves around file encryption. FileCoder.BD scans all accessible drives—including local hard drives, external USB storage, mapped network shares, and cloud storage folders that are mounted locally—searching for files matching its target list. This list typically includes hundreds of file extensions representing documents, spreadsheets, presentations, databases, images, videos, archives, source code, and other valuable data types. The malware deliberately avoids system files necessary for Windows to boot, as the attackers need victims to access their machines to pay the ransom. During encryption, files are transformed using strong cryptographic algorithms, making them completely inaccessible without the correct decryption key held by the attackers.
After encrypting files, the malware deploys ransom notes across the system—typically as text files placed on the desktop, in every folder containing encrypted files, and sometimes displayed through popup windows or changed desktop wallpapers. These notes contain instructions for payment, usually demanding cryptocurrency (Bitcoin, Monero, or other cryptocurrencies) to be sent to specific wallet addresses. The notes often include time-limited threats claiming that the decryption price will increase or that files will be permanently deleted if payment isn't received within a specified timeframe, creating psychological pressure on victims to pay quickly without investigating alternatives.
FileCoder.BD variants may also attempt to communicate with command-and-control servers to transmit information about the infected system (computer name, username, file counts, encryption status) and receive encryption keys or payment verification. Some variants disable Windows built-in security features like Windows Defender, delete Volume Shadow Copies (Windows' backup snapshots) to eliminate local recovery options, and terminate processes associated with database servers or backup software to ensure maximum file access during encryption. The sophistication varies between samples, with some being relatively crude and detectable while others employ obfuscation and anti-analysis techniques to evade security software.
Manual Removal — Step by Step
Disconnect From All Networks Immediately
Before doing anything else, physically disconnect the infected computer from the internet and any local networks. Unplug the ethernet cable or disable Wi-Fi through the hardware switch if available. This prevents the ransomware from encrypting files on network shares, communicating with its command server, or spreading to other devices on your network. If this is a laptop connected to external drives, disconnect those as well.
Boot Into Safe Mode With Networking
Restart the computer and repeatedly press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking" to load Windows with minimal drivers and prevent most malware from auto-starting. On Windows 10/11, you may need to use Settings → Update & Security → Recovery → Advanced startup → Restart now, then choose Troubleshoot → Advanced options → Startup Settings → Restart → press 5 for Safe Mode with Networking.
Identify and Terminate the Malicious Process
Open Task Manager (Ctrl+Shift+Esc) and carefully examine running processes. Look for suspicious entries with random names in unfamiliar locations, processes consuming high CPU/disk activity, or anything launched from %APPDATA% or %TEMP% directories. Right-click suspicious processes, select "Open file location" to confirm the path matches ransomware patterns, then end the process. Document the exact filename and path for the next steps.
Remove Persistence Mechanisms
Open Registry Editor (Win+R, type "regedit") and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries with suspicious names or paths matching the malware executable you identified. Delete these entries. Next, open Task Scheduler (taskschd.msc) and examine scheduled tasks for anything recently created with suspicious triggers or actions pointing to random executables. Delete malicious tasks.
Delete the Malware Executable and Associated Files
Navigate to the folder containing the malware executable (commonly %APPDATA%\Microsoft\Windows\ or %TEMP%) and delete the entire folder if it contains only malware-related files. Also check your Downloads folder, Desktop, and any locations mentioned in ransom notes. Delete any obvious ransom note files (READ_ME.txt, HOW_TO_DECRYPT.html, etc.) from all locations. Empty the Recycle Bin afterward to permanently remove these files.
Scan With Reputable Anti-Malware Software
Download and install Malwarebytes Free or another trusted anti-malware tool (download the installer on a clean computer if necessary and transfer via USB). Run a full system scan to detect and remove any remaining components, rootkits, or additional malware that may have been installed alongside the ransomware. Allow the tool to quarantine all detected threats. Follow up with a scan using your regular antivirus software after updating its definitions.
Restore Volume Shadow Copies If Available
Some ransomware variants delete Windows' Volume Shadow Copies, but if yours didn't, you may recover files. Open Command Prompt as Administrator and type "vssadmin list shadows" to check for available restore points. If any exist, you can use System Restore or third-party tools like ShadowExplorer to recover previous versions of encrypted files. This won't decrypt files but may restore unencrypted versions from before the infection.
Check for Available Decryption Tools
Visit the No More Ransom Project website (nomoreransom.org) to see if a free decryption tool exists for your specific ransomware variant. Have the ransom note and a few encrypted files ready to help identify the exact variant. While decryptors aren't available for all ransomware families, some older or flawed variants have been cracked by security researchers. Never pay the ransom—there's no guarantee you'll receive working decryption keys, and payment funds criminal operations.
Change All Passwords From a Clean Device
Once you're confident the malware is removed, change passwords for all important accounts (email, banking, cloud storage, social media) from a different, known-clean computer or smartphone. FileCoder.BD primarily encrypts files rather than stealing passwords, but it's safer to assume credential compromise. Enable two-factor authentication wherever possible for additional security.
Reboot Normally and Verify Complete Removal
Restart the computer normally (not in Safe Mode) and monitor for any signs of remaining infection—suspicious processes, new ransom notes, files continuing to be encrypted, or unusual system behavior. Run another quick scan with your anti-malware tool. If the system appears clean and stable for several hours of normal use, the malware has likely been successfully removed. Consider performing a full system backup to an external drive in case issues resurface.
Prevention
- Maintain comprehensive offline backups: Use the 3-2-1 backup rule—three copies of your data, on two different types of media, with one copy stored offsite or offline (disconnected external drives or cloud storage with versioning). Test your backups regularly to ensure files can actually be restored. This is your best defense against ransomware since encrypted files can be replaced from unaffected backups.
- Keep Windows and all software updated: Enable automatic updates for Windows, browsers, Adobe products, Java, and all other software. Many ransomware infections exploit known vulnerabilities that have been patched for months or years. Apply security updates promptly to close these entry points.
- Use reputable security software with real-time protection: Install and maintain current antivirus/anti-malware software with behavior-based detection, not just signature matching. Enable all protective features including web filtering, email scanning, and exploit protection. Windows Defender is adequate if kept updated, but third-party solutions often catch threats earlier.
- Exercise extreme caution with email attachments: Never open attachments from unknown senders, even if they appear legitimate. Verify unexpected attachments by contacting the sender through a separate communication channel (not by replying to the suspicious email). Be wary of any attachment requiring you to "enable macros" or "enable editing"—these are common malware distribution tactics.
- Avoid downloading software from unofficial sources: Never download cracked software, key generators, game cheats, or pirated content. These are frequently bundled with malware. Only download software from official vendor websites or trusted repositories. When installing free software, use custom installation options to decline bundled programs.
- Restrict user account privileges: Don't use administrator accounts for daily computing tasks. Create standard user accounts for everyday use; malware running under limited privileges has reduced ability to modify system files, install persistence mechanisms, or encrypt protected directories.
- Disable macros in Office documents by default: Configure Microsoft Office to disable macros in documents from the internet and only enable them when absolutely necessary from trusted sources. Many ransomware campaigns rely on malicious macros in Word or Excel files to execute their payload.
- Enable and configure Windows Defender Controlled Folder Access: This feature (available in Windows 10/11) protects designated folders from unauthorized changes by unknown applications, preventing ransomware from encrypting files in protected locations like Documents, Pictures, and Desktop. Add your important folders to the protected list and whitelist trusted applications that need access.
Bring It In
Dealing with ransomware is stressful, especially when important files are encrypted and you're facing decisions about whether to pay criminals or accept data loss. Computer Repair Roswell has successfully removed hundreds of ransomware infections from local computers, and we understand both the technical challenges and the emotional impact of these attacks. Our technicians stay current with the latest ransomware developments, maintain relationships with security researchers who create decryption tools, and can often recover files through methods that aren't obvious to typical users—volume shadow copies, file carving from unallocated disk space, or leveraging newly released decryptors.
Don't let ransomware hold your data hostage or leave malware remnants lurking on your system. Bring your infected computer to our Roswell shop for professional malware removal, file recovery assistance, and security hardening to prevent reinfection. We'll provide an honest assessment of recovery options, never recommend paying ransoms without exhausting legitimate alternatives, and ensure your system is thoroughly cleaned and protected. Call (770) 695-6833 to speak with a technician immediately, or stop by our location during business hours—we're here to help Roswell residents and businesses recover from malware attacks and build better defenses against future threats.