Do you know what Hells Ransomware is?
Hells Ransomware is a new infection that some users might recognize by the name “UEFI Ransomware.” Our research team has analyzed the threat, and its code revealed the original name; however, the ransom note linked to this infection mentions the name “UEFI Ransomware.” In any case, this infection is malicious, and you must delete it from your operating system soon. Hopefully, it has not encrypted your personal files, but that is something you need to check. At the time of research, the infection was not capable of encrypting data, but that could change any time, and we cannot make a promise that this ransomware will never become a fully fledged file-encryptor. The same can be said about Diamond Computer Encryption Ransomware and a bunch of other recently discovered threats. Although the infection is not fully developed yet, we can reveal information about it. Most important, we can show you how to remove Hells Ransomware.
Usual distribution methods are likely to be employed to spread Hells Ransomware. That includes RDP exploits, spam email scams, malicious installers, etc. Threats that are already active on the PC could be employed to download the infection as well. Because of that, it is impossible to say where the launcher of the malicious ransomware could be, and, without a doubt, that is the most important component to remove. In fact, if you get rid of it right away, you might stop the encryption process altogether. Of course, the infection is quiet, and it is unlikely to reveal itself before the encryption is complete. At this point, it is unclear which encryption algorithm the infection might employ, but it is likely to be complex. What we know is that Hells Ransomware creates a few files. It should drop a file called “RADIATION.bin” onto the Desktop, and a file named “memes.jpeg” should be placed in the %TEMP% directory. This file should change the background image once the encryption is complete. The third file created by the threat should be called “decrypt.txt”, and it is likely to present a similar message as the “memes.jpeg” file.
Was your background image replaced with a scary notification informing that your personal files were encrypted by the Uefi Ransomware? In the sample we tested, the message demanded a ransom of $350 to be transferred to 1Hp8VBKehCPBvArm6VRUWzPCte3EgdjYiY, which means that the victim is expected to pay the ransom in Bitcoins, a virtual currency. The message goes as far as to claim that the corrupted files would be deleted if the ransom was not paid within 24 hours. Hopefully, you do not need to resort to paying the ransom because your files are unlikely to be freed even if you did. First, let’s talk about legitimate file decryptors. You might find something, but be cautious about what you install because you do not want other infections invading your PC and causing you a bigger headache. At the time of research, legitimate file decryptors working with Hells Ransomware were not found. That leaves backups. If your files have backups, you can take a big breath and delete the ransomware. What if paying the ransom is the only option left? Even if that is the case, you should not pay it.
Hells Ransomware screenshot
Scroll down for full removal instructions
As mentioned previously, the launcher of Hells Ransomware might be anywhere. On top of that, its name is unpredictable too, which is why it is hard to give you precise instructions. If you can identify the launcher, use the guide below to erase Uefi Ransomware. If you cannot get rid of it manually, utilize an anti-malware app to have Hells Ransomware deleted automatically. Also, do not forget that other infections might be hidden as well. A legitimate anti-malware tool will not miss any threats.
Remove Hells Ransomware
- Delete recently downloaded suspicious files.
- Delete the file named decrypt.txt (might have multiple copies).
- Delete the file named RADIATION.bin from the Desktop.
- Launch Windows Explorer by tapping Win+E keys.
- Enter %TEMP% into the bar at the top of Explorer.
- Delete the file named memes.jpeg.
- Empty Recycle Bin and then run a full scan to check for leftovers.
In non-techie terms:
You need to delete Hells Ransomware from your operating system, and we are sure you need no explanation as to why that must be done. This threat is very malicious and very dangerous. If your files were corrupted by this malware, you might want to decrypt your files before you erase Hells Ransomware. If you choose that, make sure you move fast. When it comes to decrypting files, backups is your best option. If files have backup copies, they can be recovered. Otherwise, there is not much you can do. Paying a ransom is not an option because that is unlikely to lead to the decryption of personal files. Once you come to the removal of the ransomware, we advise using anti-malware software, but if you desire to eliminate this threat manually, you might find the guide above helpful.