How to remove H34rtBl33d ransomware

H34rtBl33d ransomware is a crypto-virus targeting English speaking users

H34rtBl33d ransomware is a data locker that was first spotted on 30th March 2018. The virus encrypts every single file on the infected system by appending .d3g1d5 affix to each of the files, rendering them unusable. To unlock data, victims have to pay 0.1337 in Bitcoin cryptocurrency.

“D3g1d5.Cyber.Crew.” claimed responsibility for this cyber attack. The crew was noted to have a Facebook account too, but it was deleted immediately after the AV scans spotted the infection. It is speculated same hackers developed Halloware ransomware as the spelling mistakes made by authors strike similarities with the H34rtBl33d virus.

Cybercrooks did not drop ransom note this time. Instead, they use the never-seen-before feature when it comes to ransomware – balloon tips. These are pop-up bubbles shown in Windows notification panel left by hackers to inform victims about what happened to their system and files, and also explains how to get them back.

The notifications produced show the following text:

Error! Your file could not be opened Please Decrypt Your File Using H34rt8133d Decrypter' Want Your Files Back? [Click here|BUTTON]'
'Find out here about H34rt8133d Decrypter and how to return it [Click here|BUTTON]'
'Cheaper than wannacry!
H34rt8133d very good ransomware in the world
Ransomware With Cheapest Ransom!
FACT! Ransomware that has infected your computer turned out RANSOMWARE WITH THE LOWEST CHOICE. Want your file back? [Click here|BUTTON]

If clicked on provided the link, users are then directed to suspicious page scorpionlocker.xyz. As we already mentioned, all the notes left by H34rtBl33d ransomware creators contain numerous spelling mistakes, including the text on the specified webpage.

Cybercriminals explain that users should download and install Tor browser,^[1] create an account on torbox3uiot6wchz.onion and send the email to blackpanda007@torbox3uiot6wchz.onion. Allegedly, D3g1d5.Cyber.Crew. will then give the decryption key that is kept on a remote server.

However, we highly advise users not to contact cybercrooks by all means. The crypto-virus is poorly scripted and will most likely be decrypted very soon. Even if you decide to pay the ransom of 0.1337 BTC ($990 at the time of the writing), you are not guaranteed to get your files back.

Also, you will be supporting malicious activity and urge hackers to create more ransomware. Instead, remove the H34rtBl33d virus from your computer and then proceed with file recovery procedure.

The safest way to recover your files is by restoring them from a remote server (like Cloud, OneDrive, Dropbox, etc.). Alternatively, you can also use an external hard drive that is not connected to your computer. If you have no backup, however, you can try some of the alternative methods we suggest below.

Finally, we do not recommend manual H34rtBl33d removal. Even if it is poorly scripted, the damage caused to the computer by tampering with essential system files might be devastating. Therefore, we suggest you employ a reputable anti-virus program (we recommend FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes) and scan your computer thoroughly.

Be careful when opening emails from unknown sources – ransomware can be hidden inside

The most prominent ransomware distribution method is spam emails. Hackers typically use clever social engineering skills to manipulate victims into opening the attached file containing the devastating payload of the virus.

The email author usually pretends to be an important entity from a high-profile organization, like a bank or governmental institution. Additionally, users are urged to open the attached file quite aggressively. To avoid infections, make sure you scan each attachment before you open it. Also, you should learn to recognize signs and symptoms of a phishing email.^[2]

Security experts^[3] warn that torrent and other peer-2-peer websites can contain devastating viruses inside the installers. Therefore, we highly suggest you never visit such sites and download the software and its updates from legitimate sources only.

Eliminate H34rtBl33d ransomware virus for good

As we already mentioned, the virus is poorly written. Nevertheless, you should remove the H34rtBl33d virus from your machine immediately as it can make your computer vulnerable to other infections.

You should not attempt manual H34rtBl33d removal. Instead, download and install FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Before scanning your system, make sure security software is up to date. Remember that malware can prevent a normal startup up anti-virus program. Therefore, reboot your PC in Safe Mode with Networking before starting the elimination procedure.