Welcome to our .trun removal instructions. This article intends to help you remove .trun from your system.

In case you are wondering what .trun is – it is a Ransomware computer virus. This is probably the worst case scenario for a malware infection. As you have probably discovered some if not most of your files have a strange extension after the file name – .trun. Not only that – the files have been rendered inaccessible and for all intents and purposes useless. In this article we will try to address all lingering questions regarding this menace, including how did it end up on your PC, and whether you should pay the ransom or not. Also expect extensive removal instructions and even a suggestion on how you can recover your files for free!

.trun – how does it work?

Let’s start by explaining how exactly you have found yourself staring at your files in disbelief, infected with .trun seemingly out of nowhere. This type of virus uses backdoors to infiltrate your system, in most cases in the form of a Trojan Horse. This leads to the following conclusion – you definitely have additional malware on your system. You should definitely look for it and remove it as soon as you have finished getting rid of .trun.

But let’s get back to how this thing operates. Once inside your system, the virus will begin scanning your computer in order to single out your most often accessed files. This is done entirely with a malicious intent to hurt you where it would sting the most. When we say sting what we mean is the encryption of your files. Because this is exactly what did happen to your files. Your real files have been replaced with these encrypted duplicates. You are certainly in a dire situation but hopefully we will be able to brighten your day.

Should I pay to get my files back?

This is probably a question that has been bugging you for a while. In fact starting from probably about the time you discovered your files have been encrypted and apparently the only solution is to pay a hefty sum of money to recover them. At least that’s what the ransom note would claim. In reality this is not entirely true and we will explain why you might be consciously guided towards that path.

While we are not claiming that this is always the right decision and of course it is entirely up to you, yet our advice would be – do not pay the ransom. Or at the very least exhaust all other options completely before doing down that path.

The reasoning behind this advice is quite simple really and we would like to talk a bit about that.

• First of all do not forget even for a minute that you are being extorted. You will be dealing with hardened Cyber criminals. Objectively there are no guarantees that they will keep their end of the bargain and send you a decryption key once you make the payment. They may or they may not, in either case you will be associated with trying to make a transaction with some very shady individuals. Which leads to our second major point.
• You certainly don’t want to be associated with the .trun creators in any way. Even if it is only for trying to pay for a decryption key. Furthermore we would like to try and emphasize to all of our affected readers – you are the only ones who can realistically stop this. The ransomware “industry” has been growing with frightening temps and millions of dollars are being extorted from the victims annually. Unless you start it off by refusing to “sponsor” the perpetrators, these people will continue to create and develop new forms of Ransomware applications.
• There are other things you can try before even contemplating paying for something that legally belong to you. There’s always a chance that someone breaks the encryption. This is not that far fetched and recently there were documented cases for that happening. You can also try to bypass the whole decryption ordeal and follow our advice on how to fix your issue.

.trun File Removal

Step 1

Reveal Hidden Files. If you don’t know how to do this, ask us in the comments.

Step 2

=> Search=> Copy/Paste “notepad %windir%/system32/Drivers/etc/hosts” => Enter.

If you notice other IPs different from the localhost IPs – you might be in danger!

Ask for additional help in the comments.

Step 3

Right click on the Taskbar => Start Task Manager.

Navigate to Processes.

Locate any suspicious processes associated with .trun. Right click on the process = > Open File Location => End Process = > Delete the directories with the suspicious files.

Step 4

=> Search => Type:

• %AppData%
• %LocalAppData%
• %ProgramData%
• %WinDir%
• %Temp%

Hit Enter after each new search. Check each Folder and delete recent entries.

Step 5

Get Your Files Back!

The only way you can do that is by backpedaling to a moment when you were not infected. You can achieve this in one of two ways:

• System Restore. => Search field => Type System Restore=>Enter.
  Choose a Restore Point.
  
  Click Next until the process has been completed.
• Google and Download a Program called ShadowExplorer. Install and open it => Choose the Drive letter (C:, D:, F:, etc.) and date you want to restore information from => Right click on the files you want restored => Export.

If you run into any trouble – ask us for help in the comments section!