Hermes Ransomware

Posted by Lisa Blanc on February 22, 2017

What is Hermes Ransomware?

As you can probably tell from the name, Hermes Ransomware is a ransomware application. Worse, this program is an encrypting ransomware infection. It means that it holds your system hostage once it encrypts a number of your files, thus making them inaccessible. To get your files back, you are expected to pay a designated sum of money. However, before you do anything of the sort, you should remove Hermes Ransomware from your system. It is never a good idea to give your money away to these criminals. Do what is best to you and your computer by terminating all the malicious threats right now. test test

Where does Hermes Ransomware come from?

Although we cannot pinpoint one particular server that would be responsible for the main wave of the ransomware distribution, we know the signs and the main distribution methods employed by this program. Hermes Ransomware travels around just like most of the ransomware infections. According to the researchers at anti-spyware-101.com, the program uses spam email to access target computers.

That is not to say that the program can enter your computer willingly. Unless you allow this program to slip inside, it cannot be installed on your computer automatically (especially when we are talking about spam email attachments here). So what can you do to avoid Hermes Ransomware?

First, you should never open an attachment received from an unfamiliar sender. If an email looks like an official notification from some service or some company you have not heard before, it could as well be a scam. For instance, quite often the spammers might be pretending to be bank officials, so if you receive a supposed security email from a bank where you have no savings account that message might as well be part of the ransomware distribution network.

So, staying away from unfamiliar attachments could as well be one of the best ways to avoid getting infected with Hermes Ransomware. If you think that you must open a particular attachment, you can always scan it with a security tool before you launch the file. Just to be on the safe side.

What does Hermes Ransomware do?

Nevertheless, if the ransomware application still manages to enter your system, you can expect from it everything a program of such profile can do. Luckily, the application cannot affect every single file on your computer, but it will be sure to encrypt most of your frequently used data, including picture and document files. The notification we see on our screens when the infection takes place says that the files were encrypted using the RSA2048 algorithm, and the only way to restore your files is to purchase the decryption tool from the creators of this infection. They say that the unique key that can unlock your files is within their possession and they will allow you to decrypt three files for free as a test, once you contact them.

To contact the criminals, you are given two email addresses: BM-2cXfK4B5W9nvci7dYxUhuHYZSmJZ9zibwH@bitmessage.ch and x2486@india.com. Now, why would there be two email addresses? Usually it happens because the connection between the infection and its command and control center is very unstable. Sometimes one hosting server goes down, and it becomes impossible to contact these people. Hence, they have at least two email addresses for contact.

However, since the connection is so unstable, there is also a chance that you may not be able to contact them at all. So what is the use of spending your money on something you may not even get? What’s more, paying for the decrypting key would enable these cyber criminals to continue their scams.

How do I remove Hermes Ransomware?

To protect yourself and other users from these exploitations, you should ignore the message on your screen and remove the files associated with Hermes Ransomware from your PC. It should be the most recently downloaded files that you launched right before the infection. So they should be located in your Downloads folder, or anywhere else where you save downloaded data.

Next, you should remove the encrypted files and transfer healthy copies of your data from an external hard drive. Or perhaps you have most of your files save in some cloud storage. Whichever it might be, please remember to paste those files when the ransomware has been fully removed from your PC.