How to remove Hitler ransomware virus

Hitler ransomware is rather a silly joke than a serious crypto-virus

Hitler ransomware is a crypto-virus^[1] which is alternatively known as Adolf Hitler ransomware. After being detected as an in-dev program, soon it was presented as a “FINAL version of Hitler Ransomware.” The latest its version is known to pose as a folder (it uses New Folder.exe name) and rely on TheYuCheng@yeah.net email address. Previously, malware pretended to be Minecraft Account Dispenser.

Hitler ransomware, unlike other ransomware type viruses, does not encrypt victim’s data. Instead, it activates a batch file^[2], which removes file extensions from filenames. Then it launches the lock screen, which contains the following message:

Your Files was encrypted!
Do you decrypt your Files?
Buy a Vodafone Card (25€) and add the code
In the TextBox!

The newest, Adolf Hitler ransomware, displays a similar ransom note which is written Germain. Naturally, it is believed that it is aimed at German-speaking users.

At the bottom of the lock screen, there is a loading line, which demonstrates that the files are going to be deleted in one hour. As you can see, developers of this malware variant attempt to frighten the user that files are going to be removed for good and convince them to pay a comparably small ransom – 25 Euros.

If the victim fails to pay the ransom within one hour, the virus crashes the computer, reboots it and then deletes^[3] all files in %UserProfile% folder. This is done with the help of firefox32.exe file, which the virus saves in the Common Startup folder.

If your computer has been affected by this virus and you can see the time ticking on your screen, do not waste your precious time and remove Hitler ransomware from the computer using FortectIntego malware removal program. Although this malware variant is not as dangerous as Locky, CryptoWall or Cerber ransomware, an immediate Hitler ransomware removal is required to protect yourself from data loss.

After being updated, Hitler Ransomware becomes Minecraft Account Dispenser

On September 2017, malware researchers spotted new version of Hitler malware spreading as an obfuscated 8623o9d8423vgb.exe file. The virus pretends to be a “Minecraft account dispenser.”

After the infiltration, it delivers a program window called “Destroyer Ransomware” where criminals inform about encrypted files and data recovery instructions in the German language. Following previous scenarios, developers still use the picture of Adolf Hitler.

The ransom note threatens that victim’s personal data will be published on Dropbox if she or he does not pay the ransom. People are asked to pay 10 euros within 24 hours. It seems that with each version developers less and less money. Probably, no one takes this malicious program seriously.

In the end of November, security researcher Karsten Hahn reported about Adolf Hitler ransomware. ^[4] It seems that it gets into systems as “New Folder.exe” file which pretends to be a folder. Then, it provides TheYuCheng@yeah.net email address for contacting its developers. It is still unknown if the virus is likely to encrypt files. Thus, just remove Adolf Hitler ransomware from the computer and forget about this unpleasant situation.

The “FINAL version of Hitler Ransomware”: weaker than ever

“FINAL version of Hitler Ransomware” is the first update of the malware which was introduced on January 2017. Nevertheless, developers claim that malware encrypted files; these talks are not true. We assume that developers were amateurs who didn't manage to develop a working ransomware, so they created an impostor.

Upon infiltration of the system, the “FINAL version of Hitler ransomware” virus displays a program with Hitler's image on it, and a ransom note was written in broken German language. It indicates that the author of ransomware clearly doesn't speak fluent German, so most likely is just a script kiddie^[5] who thinks that using Nazi leader's image in a computer virus is cool.

The virus says that files have been encrypted (although they weren't), and asks to pay a ransom. The victim is asked to write to cyber criminals' email – 3rdwm0sn4r3lt1H@mail.com. However, contacting them and paying Bitcoins^[6] or other payment system is unnecessary because your files are not corrupted. Therefore, you have to remove this version of Hitler malware.

Tips to prevent ransomware attack

Hitler malware can be distributed via malicious email attachments, but it might also land on your computer system after clicking on a corrupted link or ad. For this reason, we invite you to read these tips on how to protect your computer from ransomware attacks:

1. Create backups. This is the number 1 rule for those who want to protect their data. Make sure you store backups on external storage drives and unplug them from your computer.
2. Install an anti-malware software with a real-time protection feature. Make sure it is active and running at all times.
3. Do not open email attachments or click on links in email messages that come from unknown people or organizations. Cyber criminals often try to impersonate representatives of popular organizations to make the victim trust them, so be aware of that!

Instructions for Hitler ransomware elimination

We highly recommend you not to deal with this malware on your own and employ a strong anti-malware tool instead. Hitler virus is a malicious program, and it can quickly delete your files if you fail to remove Hitler ransomware correctly. Please follow the following instructions provided below to remove this virus from your system. To complete Hitler removal, run an anti-malware software, such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.