How to remove TMS5 ransomware

TMS5 ransomware can cause serious damage to personal files and make them useless

TMS5 ransomware is a file-locking virus that belongs to the Matrix ransomware family which appeared in 2016. The malware encrypts users' personal files, like photos, videos, and documents. The affected files are appended with the .TMS5 extension, cybercriminals' email address, and a string of random characters.

Encrypted files become impossible to open or use. The icons are also changed to white pages so thumbnails become unavailable. If users do not have backups, a ransomware infection can result in permanent data loss. It is a dangerous virus that should be eliminated immediately to prevent further system damage. You can read our guide to learn more.

The ransom note

TMS5 ransomware drops a !TMS5_INFO!.rtf ransom note on the machine. The full message reads as follows:

HOW TO RECOVER YOUR FILES?
WE HAVE TO INFORM YOU THAT ALL YOUR FILES WERE ENCRYPTED!

PLEASE BE SURE THAT YOUR FILES ARE NOT BROKEN!
Your files were encrypted with AES-128+RSA-2048 crypto algorithms.
* Please note that there is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server.
* Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!
* Please note that you can recover files only with your unique decryption key, which stored on our server.

HOW TO RECOVER FILES?
Please write us to the e-mail, we will send you instruction how to recover your data.
Our main e-mail: TomSoyer5@protonmail.com

Our secondary e-mail:    TomSoyer5@yahoo.com
Our secondary e-mail:    TomSoyer5@aol.com

Please write to our main e-mail. If you will not receive answer in 24 hours, please write to our secondary e-mails! Please always check SPAM folder!
* Write on English or use professional translator

In subject line write your personal ID: –

For your assurance you can attach up to 3 small encrypted files to your message. We will decrypt and send you decrypted files for free.
*   Please note that files must not contain any valuable information and their total size must be less than 5Mb.

Please don't worry, we can help you to RESTORE your server to original
state and decrypt all your files quickly and safely!

OUR HELP!
You have to pay for our help in Bitcoin Cryptocurrency.
Immidiately after payment we will send you (by e-mail) automatic decryption tool and your unique decryption key. You just have to start decryption tool on your server and all files will be automatically decrypted. All original file names will be restored too.

The ransom note informs users about what has happened to their data. It was encrypted using the AES-128+RSA-2048 cryptographic algorithms. Ransomware developers want to get paid. The ransom amount is not specified but it should be made with Bitcoin.^[1] To appear legitimate and trustworthy, they offer free decryption for up to three small files.

However, we strongly advise against paying the threat actors. Many ransomware attack victims never receive the promised decryption tools after paying. Although it is almost impossible to recover files without cybercriminals' help, it is too risky. First, you should try using third-party recovery software. We have detailed instructions on how to use it below.

Distribution methods

To avoid ransomware infections in the future, it is good to learn about ways that they are spread. Most of the time, people get infected by installing “cracked” software^[2] from Torrent websites or peer-to-peer file-sharing platforms.^[3] This activity is illegal so it is unregulated. It is impossible to know if the packages you download do not contain any malicious files.

It is also important to note that hackers can exploit operating system and software vulnerabilities. Software developers regularly release security patches to prevent this from happening. Install them as soon as they are released to keep your system secure. 

Ransomware elimination process

The first thing you should do is disconnect the machine from the local network. If this happened at your home, simply unplugging the ethernet cable will suffice. However, if it occurred at your workplace, that might be more complicated to do; we have instructions for corporate environments below.

Do not try to recover your data first as it could result in permanent loss. The malicious program will also encrypt your files the second time, and will not stop until the files causing this are removed. Unless you have experience, do not attempt removing the malware yourself.

Use anti-malware tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to scan your system. This security software should find all the related files and entries and remove them automatically for you. In some cases, malware is not letting you use antivirus in normal mode, so you need to access Safe Mode and perform a full system scan from there:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Fix a damaged operating system

After a malware infection, it is common to experience performance, stability, and usability issues so badly that the only solution is a full Windows reinstall. These types of infections can damage or delete vital system files, corrupt the Windows registry database, and interfere with bootup procedures. Once a crucial system file is damaged by malware, even antivirus software cannot repair it.

FortectIntego was developed to fix a lot of the unavoidable Windows damage caused by an infection. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer unusable and complete pain. Luckily, by utilizing this maintenance tool regularly you could avoid having to do a full Windows reinstallation.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

Recover data with third-party software

Only hackers have the key that can decrypt your locked files, so unless you backed them up before, you may have lost them forever. You might be able to use data recovery software, but these programs aren't always successful in decrypting files. If you want to try this method anyway, copy the corrupted files onto a USB drive or other storage first. And remember – only do this if you've already deleted the TMS5 ransomware from your system.

Before you begin, several pointers are important while dealing with this situation:

• Since the encrypted data on your computer might permanently be damaged by security or data recovery software, you should first make backups of it – use a USB flash drive or another storage.
• Only attempt to recover your files using this method after you perform a scan with anti-malware software.

Install data recovery software

1. Download Data Recovery Pro.
2. Double-click the installer to launch it.
3. Follow on-screen instructions to install the software.
4. As soon as you press Finish, you can use the app.
5. Select Everything or pick individual folders where you want the files to be recovered from.
6. Press Next.
7. At the bottom, enable Deep scan and pick which Disks you want to be scanned.
8. Press Scan and wait till it is complete.
9. You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
10. Press Recover to retrieve your files.