Do you know what Hitler Ransomware is?
Hitler Ransomware sounds very serious and dangerous but, in fact, in this case you do have a chance to save your files if this malware threat happens to attack your computer. Unfortunately, you do not have too much time to act; you are given 1 hour. If you fail to remove Hitler Ransomware until the deadline, you will lose all your files in certain system folders, which are usually used by everyday users to store pictures, music files, documents, and downloads. This ransomware claims to have encrypted your files, which is a lie, of course. Our researchers found that this infection does not do any encryption at all. Instead, it deletes your files without the possibility to restore them. Therefore, it does not make any sense to pay the demanded ransom fee either. But even if this threat does not take all your files hostage as most of ransomware infections do, it can still be a major hit for you if you keep files in the targeted directories and you do not act in time. Let us share the details of our research with you so that you can save your files and protect your computer.
Hitler Ransomware screenshot
Scroll down for full removal instructions
According to our researchers, this ransomware uses the most frequently applied technique of spamming campaigns to distribute on the web. This infection shows up as a malicious attached file in spam e-mails, but, obviously, you will not realize right away that it is not what it pretends to be. Such attachments can appear to be pictures or text documents claiming to be overdue or problematic invoices, errors with credit cards, undelivered e-mail notices, and so on. Since the subject of these mails can also be quite convincing and eye-catching, it is quite likely that most users would save and open these attachments right away. And, this is exactly what the authors of Hitler Ransomware want, too. You should know that these spams may evade your filter and end up in your inbox folder. This is why it is very important that you do not take the reliability of the mails in your inbox for granted. Sometimes it is enough to simply open a mail to drop an infection onto your system. This threat, though, is activated when you run the downloaded attachment. As you can see, there is no magic behind these infections; you initiate the download and the supposed encryption as well. Therefore, it is very important that you are more cautious about your clicks, i.e., which mails you open and which attachments you download. If you activated this threat, you should know that you have only 1 hour to act because otherwise you may lose a lot of files for good. We advise you not to waste more time and delete Hitler Ransomware right now.
Once you run the downloaded attachment, apart from opening a fake invoice or any other document – if at all – this infection drops two files into "%TEMP%\[random characters].tmp" folder. The main malicious file, which was called “chrst.exe” in our sample, starts up right away and deletes the extensions of all your files in these folders and their subfolders:
%USERPROFILE%\Pictures
%USERPROFILE%\Documents
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop
%USERPROFILE%\Music
This way you will not be able to open any programs or files without renaming them by adding the appropriate extensions. This executable also displays a ransom note window on your desktop and blocks “taskmgr.exe” so that you cannot easily close this window and end the main malicious process. This ransom note is very simple indeed. There is an image of Hitler on it and a few bits of information, including the false claim that your files have been encrypted. You have to buy a Vodafone card for 25 EUR (around 28 US dollars) and enter its code in the provided field. These criminals only give you 1 hour to meet their demand; otherwise, all your files in the above directories will be deleted.
The second malicious file, which was called “firefox32.exe” in our case, is copied to "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup," which means that it will start up every time your reboot your system. You may not want to restart your computer after this hit; however, Hitler Ransomware will make sure that your system restarts and causes a BSOD system crash once the 1 hour deadline is over. The second file makes sure that the files without extensions will be deleted permanently. This all sounds very bad of course. However, you can actually save yourself the headache and pain of losing your files if you act in time. We do not advise you to pay the ransom fee because our researchers have found that this infection has no way to restore your files anyway. Instead, let us tell you how you can remove Hitler Ransomware from your computer ASAP.
In order to be able to recover your files, i.e., to delete Hitler Ransomware without any loss, it is vital that you do not restart your computer after you realize that you have been hit by this threat. First, you need to use the Alt+F4 combination to kill the main process and the ransom note. Then, you need to remove all malicious files. Please follow our instructions below for best results. If you want to protect your computer from similar attacks, we advise you to use a decent anti-malware application. It is also very important that you keep all your programs and drivers always updated to make sure that you do not become a victim of Exploit Kits, for example, which are also used by criminals to spread ransomware infections.
How to remove Hitler Ransomware from Windows
- Press Alt+F4 to end the malicious process.
- Press Win+E.
- Locate and bin the downloaded malicious file.
- Delete “chrst.exe” and “firefox32.exe” from "%TEMP%\[random char.].tmp" folder (these files could have different names depending on the sample).
- Remove “firefox32.exe” from the Startup folder:
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\firefox32.exe (Win XP)
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\firefox32.exe - Rename your files with the proper extensions in the affected folders.
- Empty your Recycle Bin.
- Restart your computer.
In non-techie terms:
Hitler Ransomware can be a dangerous threat if you do not react fast enough. This ransomware pretends to encrypt your files; however, all it really does is delete your files from targeted folders if you do not pay the demanded 25 EUR ransom fee within the hour. We do not recommend that you actually pay these criminals because there is no guarantee that this ransomware can restore your files at all. In fact, if you remove Hitler Ransomware before the deadline expires, you can save your files from destruction. If you want perfect protection for your PC, we suggest that you install a reliable anti-malware application.