Virus Removal Guides

Cadq Virus


Cadq is ransomware-based infection that hackers use to blackmail web users for money. Cadq is file encrypting software that keeps important user information hostage to request a ransom for its decryption.


Once the Cadq virus has encrypted all of your files it will leave this message in a .txt file.

Users typically need a lot of support in removing Cadq from their computers and restoring their encrypted files to their normal state. That’s why, if you have been infected by this ransomware, we suggest you read carefully the next lines where we will explain everything you need to know about this especially risky infection. The paragraphs below are filled with information on how this virus infected your computer, how it encrypts your files without any visible symptoms and how you can remove the infection from your system without causing more harm. To help even inexperienced web users to deal with Cadq, below we have created a full removal guide with a free file-recovery section. A professional Cadq removal tool is also available to help remove the harmful infection as quickly and as risk-free as possible.

The Cadq virus

The Cadq virus is malicious software that operates as ransomware and is programmed to detect and encrypt a broad range of file formats on a given computer. Office documents, databases, archives, images, audio, and video files, as well as any other frequently used digital data, are of great interest to the Cadq virus.

In general, all files that the ransomware considers of great value to the victim are encrypted using a highly complicated algorithm that cannot be reversed without a key for decryption. The attack of the infection normally happens in stealth and users are not able to detect any visible symptoms that can hint them that they are a subject of an extortion virus. Sadly, having an antivirus program may not be very effective in detecting and stopping a threat like Cadq, Ygkz or Plam since the file encryption that this infection uses to restrict access to user files does no damage to anything and simply renders the targeted digital information as inaccessible. By default, most security programs consider the file encryption as a data protection method and do nothing to stop it or notify the victims.

The criminals behind Cadq, however, use this data protection method as a framework for an online extortion scheme. After encryption is applied to the victims’ most valuable files, a ransom demanding message pops-up on the screen of the infected machine. The message states that if you want to obtain the decryption key that can recover your files, you’ll have to pay a ransom.

The Cadq file encryption

The Cadq file encryption is a malicious process that enables hackers to apply unbreakable encryption code to user files in order to restrict access to them. The Cadq file encryption is typically reversible, but the user must pay for the decryption key.

The Cadq file encryption is very complex.

Of course, it is up to the individual user whether to pay the demanded ransom or not. However, meeting the demands of the hackers will NOT guarantee that your data will be restored. In fact, the victims may never get a decryption key in return for their money. This is why our “How to remove” team advises that anonymous criminals should not be given any money. Instead, we propose that Cadq’s victims take the necessary steps to remove Cadq from their computers through alternative means.


Name Cadq
Type Ransomware
Data Recovery Tool Not Available
Detection Tool

OFFER *Read more details in the first ad on this page, EULA, Privacy Policy, and full terms for Free Remover.

Cadq Ransomware Removal

First, make sure that you Bookmark the page of this guide so you can quickly get back to it and complete all the ransomware-removal steps, as, at some point, you will be required to quit the browser.

Next, for the easier detection of Cadq, we recommend that you enter the infected computer in Safe Mode If you don’t know how, use the instructions from the active link and then, get back to this guide that you have bookmarked.


With the computer in Safe Mode, press CTRL + SHIFT + ESC keys from the keyboard. This will call up the Windows Task Manager app on the screen. Select the Processes Tab carefully search for problematic processes that are related to Cadq.

If you have a suspicious that a certain process is dangerous, right-click it and choose Open File Location from the menu that pops up. When you get to the file location of the process, drag its files in our free online virus scanner and start a scan:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    When you see the results from the scan, you will know if the suspicious process is really dangerous or not. In case the files get flagged as malicious, go to the Processes tab, right-click on the related process and select End Process Tree. Then, go to the file locatin and delete all the files and folders that are found there.

    If you have a suspicion that your computer is hacked, use the following instructions to check your Hosts file for suspicious IP addresses below Localhost:

    First, press the Start and R keys from the keybaord to open a Run window. In that window, copy the following command:

    notepad %windir%/system32/Drivers/etc/hosts

    Press the Enter key from the keyboard. A file named Hosts will open on the screen. In this file, find where it is written Localhost and check for questionable IPs that are listed under it. See the imge below for more clarification on what should a Virus Creator IPs look like:

    The presence of numerous IPs below Localhost may sometimes indicate that the computer is hacked, That’s why if you detect any, it is best to write to us in the comments, so we can take a look at them and advise you on what to do next.

    Next, use again the Start and R key combination to open a new Run window. This time, type msconfig in the text field and hit enter. The System Configruation app will immediately open up.

    From the tabs that you see, select the Startup tab. Then carefully look at all the entries that have checkmarks and try to detect the entries that could be linked to Cadq. Uncheck these entries, as well as any other entries you don’t trust or have an “Unknown” Manufacturer and look suspicious.

    Then, again use Start and R keys, open a new Run window and type Regedit. Press Enter and this will launch the Registry Editor. Ransomware threats like Cadq may add some entries in the Registry which you need to detect and remove if you want to get rid of the threat fully. 

    Once in the Editor, press CTRL and F keys to use the Find function that will help you to easily search the Registry for entries with the name of the threat. Type the name of the ransomware in the text field and then press Find Next. Delete every result that is detected and perfrom the search as many times as needed until no more results with that name are found.

    Attention! Be extremely careful as any deletions in the Registry that are not linked to Cadq may cause system corruption! If you are not sure what needs to be deleted, better use a professional removal tool to prevent an involuntary system damage!

    Next, type each of these lines in the Windows Search Field:

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    Open the  folders that are found and check them for any recently added files and folders. When you go to the Temp folder, delete everything that is found in that folder.

    If, during any of the steps in this guide, you find yourself in trouble or have questoins, please feel free to write to us in the comments below this post and we will do our best to help you.


    How to Decrypt Cadq files

    The decryption of the files that Cadq has encryptd requires a completely different set of instructions. That’s why we have come up with a separate guide for file recovery that you can find here.

    Before you go to it, however, make sure that you have successfully removed the ransomware from your computer as, if this is not the case, any files that you manage to recover (as well as any backup sources that you connect) may get encrypted again.

    The best way to check your system for any hidden Cadq-related traces is to run a scan with a profesional removal tool like the one that is recommended here.

    Exit mobile version