How to remove LordOfShadow ransomware virus

LordOfShadow – a ransomware virus inspired by Hidden Tear

LordOfShadow ransomware is a HiddenTear-based^[1] virus that targets Brazilian and Portuguese^[2] computer users. The virus appends .lordofshadow file extension and downloads the LEIA_ME.txt file with data recovery instructions where victims are asked to contact criminals via a provided email address.

Just like other viruses based on the HiddenTear code, the article's culprit also employs an AES encryption algorithm to corrupt files on the targeted computer. The virus appends its extension to various images, audios, videos, pictures, databases, and other data that is stored on the affected device.

Cybercriminals refer to victims in the Portuguese language and tell that they need to contact them via the provided email address in order to learn about data decryption possibilities. Therefore, the size of the ransom is unknown. It might be based on the amount and importance of the encrypted files, as well as the speed of how fast you contact hackers after the LordOfShadow attack.

Seus arquivos foram Sequestrados!
Em contato para entre recuperar SEUS arquivos
lordashadow@gmail.com

However, contacting the authors of the cryptovirus and paying the ransom is not recommended. The virus might be encrypted using HiddenTear decryptor. But first, you have to terminate this cyber threat from the computer. The major antivirus and malware removal tools can easily detect this malware.

Therefore, it won’t be hard to remove LordOfShadow using MalwarebytesMalwarebytes, SpyHunterCombo Cleaner, or another malware removal software. However, before installing and running these tools, you should reboot the computer to Safe Mode with Networking to disable the virus. Even though this virus does not seem powerful, it still might be bock security software.

Manual ransomware removal is not recommended. It’s a malicious program that might make severe modifications in the system and affect legit system processes. Thus, it might be hard or even impossible to terminate this cyber threat without damaging the system. To repair all changes the infection has done to your device's system, run system diagnostics with the FortectIntego PC repair software.

Spam emails might contain dangerous malware

The main ransomware distribution method remains malicious spam emails. Typically they include a link or attachment^[3] that includes malicious content. If a victim opens it, malware payload hidden-tear.exe is dropped and executed on the system.

The same might happen when a user downloads a corrupted program, updates, or clicks an ad that was infected. Security experts recommend staying away from illegal or unknown download sources and do not visit high-risk websites.

Additionally, you should not forget to update all your programs and operating system. Malware might also launch the attack by exploiting outdated software or its vulnerabilities. Finally, you should invest in a reputable antivirus program to maximize your computer’s protection.

Simple instructions to remove LordOfShadow ransomware

LordOfShadow removal requires scanning the system with a reputable and powerful malware removal program. If you are lost in a variety of these tools, you should take our advice and choose one of these: FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes. We can assure that these programs can terminate all malicious components from the device entirely.

However, in order to remove LordOfShadow without any trouble, you should reboot the PC to Safe Mode with Networking or use System Restore to disable the virus. You can find a detailed explanation at the end of the article. Additionally, you will find instructions on how to recover encrypted files.