How to remove H@RM@ ransomware

H@RM@ ransomware – new cryptomalware hiding in the shadows

H@RM@ virus is a type of malware called ransomware and belongs to the Wanna Scream family. Upon finding its way onto users' devices, it encrypts all non-system data and adds three components to each file: unique victims' ID, cybercriminals email address, and an extension H@RM@. Affected files will not be able to be opened. After the virus has done what it's meant to do, a ransom note “ReadMe.txt” will appear in all affected folders, and a slightly different pop-up message will arise.

In the demand note, perpetrators state that victims' data was encrypted using AES-256 + RSA-2048 army grade coding algorithms.^[1] Creators of H@RM@ ransomware are urging users not to try and rename the infected files, also not to try decrypting them, as this may cause permanent data loss. As a sign of good faith, the criminals are telling the victims that they can send up to 5 infected files (file size shouldn't exceed 4Mb) back to them for free decryption, thus allegedly proving that a decryption tool exists.

Two email addresses are provided (recoverydata98@protonmail.com, recoverydata99@protonmail.com) for victims to get a hold of the malware developers. A unique ID is created for each victim. The Ransom amount isn't specified, the only thing that's clear that the ransom will have to be paid using cryptocurrency bitcoin^[2] as the criminals provide instructions for buying it.

Contacting and trying to reason with the cyber thieves is the worst thing victims can do. Although it may seem like the only viable option to retrieve locked files, criminals are criminals for a reason. In some cases, instead of receiving a promises decoding tool/key, victims receive additional malware that does even more damage, and thus developers of such malware can ask for even more money. So it's a lose-lose for some victims. It is up to you whether you want to risk it, however.

Right after such malware is detected, the user should eliminate it instantly. To remove H@RM@ ransomware swiftly, use trustworthy apps like SpyHunterCombo Cleaner and MalwarebytesMalwarebytes before the virus has done any more damage. If users' antivirus software didn't detect the infection and it spread, it might have done some damage to system files also. To restore the device to its normal state and prevent it from crashing or display any other abnormal work, use the FortectIntego tool.

Criminal ransom demand in file ReadMe.txt reads:

ALL YOUR VALUABLE DATA WAS ENCRYPTED!

All yоur filеs wеrе еnсrуptеd with strоng crуptо аlgоrithm АЕS-256 + RSА-2048.
Plеаsе bе surе thаt yоur filеs аrе nоt brоkеn аnd уоu cаn rеstоrе thеm tоdаy.

If yоu rеаllу wаnt tо rеstоrе yоur filеs plеаsе writе us tо thе е-mаils:
recoverydata99@protonmail.com
recoverydata98@protonmail.com

In subjеct linе writе уоur ID: –

Impоrtаnt! Plеаsе sеnd yоur mеssаgе tо аll оf оur 3 е-mаil аddrеssеs. This is rеаllу impоrtаnt bеcаusе оf dеlivеrу prоblеms оf sоmе mаil sеrviсеs!
Important! If you haven't received a response from us within 24 hours, please try to use a different email service (Gmail, Yahoo, AOL, etc).
Important! Please check your SPAM folder each time you wait for our response! If you find our email in the SPAM folder please move it to your Inbox.
Important! We are always in touch and ready to help you as soon as possible!

Аttаch up tо 3 smаll еncrуptеd filеs fоr frее tеst dесryption. Plеаsе nоte thаt thе filеs yоu sеnd us shоuld nоt cоntаin аnу vаluаblе infоrmаtiоn. Wе will sеnd yоu tеst dеcrуptеd files in оur rеspоnsе fоr yоur cоnfidеnсе.
Of course you will receive all the necessary instructions hоw tо dеcrуpt yоur filеs!

Important!
Plеаsе nоte that we are professionals and just doing our job!
Please dо nоt wаstе thе timе аnd dо nоt trу to dесеive us – it will rеsult оnly priсе incrеаsе!
Wе аrе alwауs оpеnеd fоr diаlоg аnd rеаdy tо hеlp уоu.

Text from the irritating ransom demanding pop-up window:

All your files have been encrypted by Wanna Scream!
due to a security problem with your PC. If you want to restore them, write us to the e-mail recoverydata98@protonmail.com
Write this ID in the title of your message:-
In case of no answer in 24 hours write us to this e-mail:recoverydata99@protonmail.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Probable sources of malware distribution

The internet is full of various sites suited for each user's needs. However, people should be aware that cybercriminals are trying to trick them all the time. They disguise their creations in many different ways. Malware could be hidden as a genuine installation tool for the desired app or as a movie that the soon to be victim didn't see in torrent and other file-sharing platforms. Ransomware can get into a computer system as a .pdf, .exe, .jpeg, or any other file type.

Threats lurk in harmlessly looking email attachments. But right after opening such mischievous files – infection starts. Experts^[3] warn that users should be aware criminals are targeting unsuspecting computer users all over the world. A reliable anti-malware software should always safeguard users' clumsy steps while browsing and avoiding viruses like H@RM@ ransomware.

Malware removal instructions

Unfortunately, removing malware like the H@RM@ ransomware won't make your data accessible, but users should do that immediately after detection. Users can retrieve the data from backups. If such a security step wasn't taken, then export all encrypted files to an empty offline device, like a USB drive, and hope for a third-party decryption tool to be created. Never community or even worse pay the cybercriminals, as this fuels future development of such ransomware.

To remove H@RM@ ransomware, we recommend using tested and trustworthy anti-malware software like SpyHunterCombo Cleaner and MalwarebytesMalwarebytes. These apps will automatically get rid of the virus and protect computer systems in the future.

If the virus infection wasn't prevented, it is very feasible that it has done some damage that anti-malware software can't fix. Corruption of system files can lead to system failure, crashes, lag, etc. After H@RM@ ransomware removal, we recommend using FortectIntego to undo the harm the malware caused to the system files.