Healforyou ransomware (Virus Removal Guide) - Decryption Steps Included

What is Healforyou ransomware?

Healforyou ransomware is a program that encrypts data and demands ransom for files marked with .healforyou

Healforyou ransomware is a virus that delivers HTML window with instructions and contact information.

Healforyou ransomware is a cryptovirus that hails from a ransomware family which has been using similar patterns for a few years now. It is known as Globe Imposter. The virus has been known since 2017 and has been reappearing with new versions continually. Healforyou is a new variant that has been focusing on English-speaking users. The main tactic of this ransomware is similar to previous threats: the virus changes the original code of the file and marks that encoded data with a file extension, .healforyou in this case. Once this is done, files become unreadable. Additionally, the victim receives the ransom note which is called how_to_back_files.html. Unfortunately, there is no official decryption tool that could restore encrypted files to the original state. If you have been thinking about paying a ransom, note that cybercriminals cannot be trusted. The promise to decrypt your data might be false, and you shouldn't contact these people at all.

The main feature of a ransomware-type malware like Healforyou virus is the encryption process.^[1] There are a few different algorithms used in this but since this is a virus that hails from a particular family RSA and AES algorithms are most likely used to lock your photos, documents, archives or databases.

When Healforyou ransomware virus changes the original code of the file, it appends that file with .healforyou extension. For example, Picture.jpg becomes Picture.jpg.healforyou and unreadable. Once this is done, how_to_back_files.html is displayed on the screen and set as the background of your Desktop. This ransom note reads the following:

YOUR PERSONAL ID

ENGLISH
ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.
The only method of recovering files is to purchase an unique private decryptor.
Only we can give you this decryptor and only we can recover your files.
For fast data recovery and vulnerability removal, contact us by e-mail:
healforyou@outlook.com
healforyou@cock.li

We guarantee full recovery after payment. To confirm the ability to return files, we decrypt one file for free. Attach to your email 1 test file. In the letter include your personal ID (look at the beginning of this document).

We will give you the decrypted file and assign the price for decryption all files.

After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions.

Attention!
Only healforyou@outlook.com or healforyou@cock.li can decrypt your files.
Do not attempt to remove the program or run the anti-virus tools.
Attempts to self-decrypting files will result in the loss of your data.
Modify encrypted files will result in the loss of your data.
Decoders other users are not compatible with your data, because each encryption key unique and will result in the loss of your data.

Although Healforyou ransomware developers have been encouraging their victims to contact them via email, you shouldn't do so. The test decryption is just for luring people into contacting these criminals and paying a ransom. However, only a small part of victims get their files back after the payment.^[2]

You should remove Healforyou ransomware immediately after this ransom note delivery. When this process is done, a virus makes additional changes on the device that include added new registry keys or files in system folders. If you choose to delete this virus as soon as possible, you may avoid additional virus damage.

However, you need to choose reputable anti-malware tools for best Healforyou ransomware removal results because serious malware requires professional help. When a system is affected by dangerous malware you need to scan the device entirely using antivirus programs. Then, make sure that virus damage is not affecting the performance of your PC with FortectIntego or similar repair tools.

Researchers^[3] also note that you may need additional steps when terminating Healforyou ransomware virus, so we have a few tips below the article. You can reboot your device in the Safe Mode before the system scan to ensure that AV is working correctly.

Healforyou ransomware is a crypto malware that offers the test decryption for victims to seem more trustworthy.

Ransomware payload gets delivered from spam emails

The main ransomware payload which executes the malicious script often is installed on the device unexpectedly and without users' knowledge because that happens when you open the file attachment from an infected email. Unfortunately, one click of the mouse can enable malicious macros and launch malware on the device.

Emails often pose as notifications from legitimate companies or services and have subject lines like “invoice” or “order confirmation.” However, you should delete emails you got from unknown senders or the ones that have suspicious file attachments and pay more attention to the content you download on the device.

Eliminate Healforyou ransomware and other possible threats during a full system scan

Remove Healforyou ransomware from the system using a trustworthy anti-malware tool that scans the system and indicates all possible threats during a thorough system scan. Tools like FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes ensures that your device is malware-free. Also, this way virus damage can be fixed at the same time.

When performing automatic Healforyou ransomware removal pay more attention and follow every step your program suggests. This way you can see what is happening on your machine and what programs you eliminate. You may also need to scan the system repeatedly or use a few different anti-malware programs if one or the other is not working for you.

We also recommend rebooting the device in Safe Mode with Networking when dealing with crypto malware like Healforyou ransomware virus because of the additional registry changes. Your AV might not work as needed due to the malware persistence.