How to remove Horros ransomware

Horros ransomware is a decryptable virus based on HiddenTear malware

Horros ransomware is a crypto-virus recently discovered by a security researcher Leo.^[1] The ransomware was first noticed in early April 2018 as it started locking up various files using .horros extension using the AES-256 cipher.

The primary goal of this cyber threat is to extort money out of users by making them pay ransom in Bitcoin cryptocurrency in return for the file decryptor. Luckily, as the virus is based on HiddenTear ransomware, it is fully decryptable. Before decrypting files, users are advised to thoroughly remove Horros virus from their machine using such security tool like FortectIntego or MalwarebytesMalwarebytes.

The malicious file that distributes the payload is called FileEncrypter.exe. It was developed using Visual Studio 2017 and does not drop ransom note, as typical to similar file-encrypting viruses do. Therefore, it is highly likely that Horros ransomware is not fully developed yet. However, it does not mean that different variants will not show up in the future.

As soon as the virus enters the machine (typically via malicious file attachment from spam email or through the RDP unprotected configuration) it changes a variety of configuration settings, including registry entries, inside Windows machines. It allows cyber threat to load up with every boot up of the PC. Afterward, the virus starts the encryption procedure.

Horros malware can encrypt a variety of files, including dd, .dd, .db,  .docx, .dot, .dotm, .dotx, .dwg, .dxf, .eps, .fla, .gif, .ico, .indd, .jar, .java, .jpeg, .jpg, .js,..mdb, .mdb, .swf, .tif, .txt, .vcf, .wpd, .wps, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xml, .zip. Meaning that all your video, audio, text files and other personal files become unusable. For example, if your file was called picture.jpg, after encryption it turns into picture.jpg.horros.

As we already mentioned, the virus does not drop ransom note. Therefore it is unclear how much money cybercriminals want. Nevertheless, we advise users never to contact cybercriminals. These shady people only care about extorting money out of innocent victims. Thus, nothing is stopping them from ignoring you after the ransom is paid.

Instead, we suggest you firstly proceed with Horros ransomware removal procedure using powerful security software. Soon after that you can try HiddenTear decryptor, restore files from a backup or use alternative third-party programs that could help you with file recovery.

Malware is distributed via malicious email attachments

Security researchers^[2] note that users are typically quite careless when it comes to cyber safety. Therefore, they casually open emails from unknown sources and visit shady websites, even when acknowledging risks.

Therefore, be extremely careful when opening emails. Your email provider has a built-in security scanner that flags up suspicious emails. Never ignore these warnings and delete the message immediately. Another warning sign is when an attachment requires you to enable Macro^[3] function. Do not allow it as the probability that it is dangerous malware is very high.

Regardless of how tempting free cracked software on the internet might be, keep in mind that it not only poses malware threat but is highly illegal and can result in fines or even lawsuits. Therefore, pick a legitimate source for your downloads and avoid torrent, porn, file-sharing and other suspicious sites.

Elimination steps of Horros ransomware

We do not advise trying to remove Horros ransomware manually. The virus is extremely complicated and embedded deep within system files. Thus, you should trust robust security software, such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Currently, 27 out of 66 AV engines detect the file. Alternatively, you can use the security tool already installed on your PC, just don’t forget that it has to be up to date.

Horros virus removal is a crucial step in a full recovery of your normal system operation. Don’t forget that the virus might block a normal startup of the security program. Thus, restart your PC in Safe Mode with Networking as it is described below.