Everybody can land some nasty virus or malware infection on their computer and the important thing in such situation is to know what to do in order to clean the infected machine and minimize the negative consequences of the attack. In this specific article, we will tell you about a threatening malware program known as .Hofos. You might have already heard about the infamous Ransomware virus category as this is one of the most widespread families of malware at the moment. This is the category of malicious programs( like .Todarius , .Kiratos, .Verasto )  to which .Hofos belongs. There are several different sub-categories of Ransomware and, unfortunately, .Hofos belongs to the one that’s the most harmful, namely, the Ransomware cryptoviruses. Those insidious malware pieces use the well-known file-encryption method to achieve their goal, which goal is to force their victims to pay a certain amount of money to the online criminals who are responsible for the creation of the malware. Here is a short description of the way this malware operates:

First, .Hofos enters the computer after being delivered to it through some of its many methods of distribution. Those could be spam messages, fake and misleading ads and links originating from unsafe sites, pirated and other illegally distributed games and programs, phishing pages and more.

Once the infection is already in the targeted machine, it locates the files in the system that belong to the malware’s list of targeted file formats. Normally, a cryptovirus like this one would seek to encrypt data formats that are commonly used and are likely to be important to the users. Such formats are the various text document file types (doc., docx., txt. and so on) as well as different image file types, audio and video files, spreadsheets, presentations, etc.

After this begins the encryption process, during which some users may be lucky enough to notice the unusually high use of RAM, HDD space and CPU time, which may help them detect and intercept the infection before it has completed its task. However, in nearly all of the cases, this doesn’t happen and the Ransomware manages to complete its task of locking-up the user’s files.

Once the encryption of all data is completed and the cryptovirus has done its job, the only thing that’s left is for the virus to notify its victims through a big banner on their screen about the demands of the hackers. There are usually instructions on how to pay the ransom required by the criminals in order to “purchase” the access key to the sealed data and the users are supposed to follow those instructions.

What to do to counteract .Hofos File Virus

If you have backups of the important files that have gotten locked, then all you need to do is use our .Hofos removal guide to remove the virus and then recover your data from the backups. However, if you don’t have backup copies, you may need to try some of the alternative recovery suggestions you will find in our guide. In either case, paying the ransom is not ideal as it may cost a lot of money and even of a payment is made, this still doesn’t guarantee that the data will be recovered as the hackers may simply decide not to provide you with the needed access key.

.Hofos SUMMARY:

[add_third_banner]

Remove .Hofos File Virus Ransomware 

1: Preparations

Note: Before you go any further, we advise you to bookmark this page or have it open on a separate device such as your smartphone or another PC. Some of the steps might require you to exit your browser on this PC.

2: Task Manager

Press Ctrl + Shift + Esc to enter the Task Manager. Go to the Tab labeled Processes (Details for Win 8/10). Carefully look through the list of processes that are currently active on you PC.

If any of them seems shady, consumes too much RAM/CPU or has some strange description or no description at all, right-click on it, select Open File Location and delete everything there.

Also, even if you do not delete the files, be sure to stop the process by right-clicking on it and selecting End Process.

3: IP related to .Hofos

Go to c:\windows\system32\drivers\etc\hosts. Open the hosts file with notepad.

Find where it says Localhost and take a look below that. 

If you see any IP addresses there (below Localhost) send them to us here, in the comments since they might be coming from the .Hofos.

[add_forth_banner]

4: Disable Startup programs

Re-open the Start Menu and type msconfig.

Click on the first search result. In the next window, go to the Startup tab. If you are on Win 10,  it will send you to the Startup part of the task manager instead, as in the picture:

If you see any sketchy/shady looking entries in the list with an unknown manufacturer or a manufacturer name that looks suspicious as there could be a link between them and .Hofos , disable those programs and select OK.

5: Registry Editor

Press Windows key + R and in the resulting window type regedit.

Now, press Ctrl + F and type the name of the virus.

Delete everything that gets found. If you are not sure about whether to delete something, do not hesitate to ask us in the comments. Keep in mind that if you delete the wrong thing, you might cause all sorts of issues to your PC.

6: Deleting potentially malicious data – .Hofos

Type each of the following locations in the Windows search box and hit enter to open the locations:

%AppData%

%LocalAppData%

%ProgramData%

%WinDir%

%Temp%

Delete everything you see in Temp linked to .Hofos Ransomware. About the other folders, sort their contents by date and delete only the most recent entries. As always, if you are not sure about something, write to us in the comment section.

7: .Hofos Decryption

The previous steps were all aimed at removing the .Hofos Ransomware from your PC. However, in order to regain access to your files, you will also need to decrypt them or restore them. For that, we have a separate article with detailed instructions on what you have to do in order to unlock your data. Here is a link to that guide.

The post Remove .Hofos Virus Ransomware (+File Recovery) appeared first on Malware Complaints.