What is the meaning of *HELP_HELP_HELP*.hta file?
*HELP_HELP_HELP*.hta file is a ransom note that the latest Cerber ransomware versions leave on the infected systems. The virus encrypts all files on the system, deletes Volume Shadow Copies, and then saves these files on the desktop to provide the victim with information about the infection. The name of this ransom note varies, because the virus assigns a random set of chars to every victim, and as a result, victims receive ransom notes that have such names: _HELP_HELP_HELP_[random chars].hta. The file extension – HTA – stands for HTML Application, which means that such files are typically opened via Internet Explorer. They are coded via VBScript or JScript mainly. If you open such file, it behaves like an executable file. Once opened, HELP_HELP_HELP.hta file launches a program, which is called CERBER RANSOMWARE: Instructions. The program greets the victim with a typical Cerber virus’ intro:
Cannot you find the necessary files?
Is the content of your files not readable?
It is normal because the files names and the data in your files have been encrypted by “Cerber Ransomware”.
The message then goes on and explains that files have been encrypted by ransomware, and now the only tool that can restore these files is kept on cyber criminals’ servers. Offenders say that the damage is reversible, but in order to recover encrypted data, the victim needs to buy “special decryption software” called Cerber Decryptor. The Decryptor price varies depending on the virus version, but cybercriminals typically demand 1 or more Bitcoins. Bitcoins should be transferred to a provided Bitcoin wallet – it is the only way to send money to criminals as Bitcoin payment system ensure anonymity.
Upon infiltration, Cerber malware also changes desktop background with _HELP_HELP_HELP_[random chars].jpg picture, which is a shorter version of the ransom note. It explains that victim’s files were encrypted and that more information can be found in *HELP_HELP_HELP*.hta file. We must point out that this version of the virus no longer provides the virus’ version number on the desktop. It belongs to Red Cerber category since the text is highlighted in red, and not bright green color. The rest of the message informs that the victim needs to install Tor Browser to open “a personal page,” which can be accessed through a provided .onion link.
How to prevent *HELP_HELP_HELP*.hta from appearing on your PC?
If you do not want to come across *HELP_HELP_HELP*.hta file on your computer system one day, you must take actions in advance to protect your system from ransomware viruses. Unlike simple ransomware viruses, Cerber doesn’t use mail spam as the only distribution method. It is a highly sophisticated virus that spreads via compromised ad networks, websites, and employs dangerous exploit kits for its distribution. However, the latest Cerber mail spam campaigns deliver infectious .zip archives with Word file in them. The document contains malicious script that is set to download and run the ransomware as soon as the victim enables Macros function. The most reliable tool that can protect your from Cerber attack is an up-to-date anti-malware software. Do not forget to update it every now and then to download necessary virus definitions and broaden its database. In case your computer gets infected with ransomware, you will lose all your files. Therefore, backups are extremely important, so create them every once in a while and keep them away from your PC.
How to remove *HELP_HELP_HELP*.hta from compromised PC?
Although you can simply remove *HELP_HELP_HELP*.hta file from the system, it doesn’t mean that it is enough. This file was obviously created by a dangerous virus, so you must remove it. You can uninstall the virus and ensure *HELP_HELP_HELP*.hta removal by running a system scan with anti-malware software like FortectIntego.