Herad File-Locking Virus - How to remove

Herad — the name of a new virus that targets Windows computers and attaches a file type extension “.herad” to image, audio, video files, documents, text files, and other data. Renaming the files to remove the extension doesn’t work, and the only clue about what happened is a _readme.txt file placed in the affected folders. These are the symptoms of ransomware, a type of virus that locks your files and demands money for fixing them.

Not just any sum of money — the random is a few hundred dollars, which is a significant amount of money. Not to mention that Herad spreads together with a trojan, so if you try to use online banking on the infected computer, your passwords might just be leaked to criminals.

Instead of dealing with the extortionists, who, based on their history, would probably not restore your files even after you paid them, we should review your alternative options to get back your data, as well as how you can avoid file-locking ransomware like Herad in the future.

How does Herad work?

After infecting your computer, Herad gets to work. First, it lobotomizes your antivirus program and makes itself undetectable. Additionally, it edits your hosts file to make websites like this one unreachable so that the victim can’t get help. Herad then gets to encrypting files and it might display a fake Windows Update pop-up to justify the hardware resources being used.

Herad uses cryptography to lock the files. This means that even though the file content is unrecognizable, the data is still there, and it’s theoretically possible to recover the original file. However, the cryptographic algorithm ultimately used to secure the encryption uses a public and a private key. This ensures that the files are not decryptable without the help of the criminals who are responsible for Herad.

After Herad is done encrypting files — unless it malfunctioned, it should have gone through nearly all of your files, excluding the ones needed for Windows to work correctly — it drops a ransom note, a message from the extortionists. It’s called _readme.txt. It should say something like this:

ATTENTION!

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.

Herad’s developers are right that each victim needs a unique encryption key to decrypt the files (provided that the developers of the virus properly implemented the decryption; sometimes they have difficulty with large files).

They also provide the price of the decrypter:

Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.

Trying to take away people’s ability to research their options, the extortionists even provide a “discount”. Though, as high as these prices are, other ransomware viruses demand even more money, so Herad is comparatively cheap.

How to recover the files

You don’t have to, and really shouldn’t, pay the criminals responsible for Herad for your own files. There are a few reasons:

• They might demand more money after they got the first part. This happens to some people and there is no way to get your money back.
• They can just run away. Around 40% of ransomware victims who pay the ransom end up losing their files anyway.
• Paying is financing criminals.

Earlier, I said that the only way to decrypt the files would be to get the decryption key from Herad’s developers. Luckily, that’s not completely true. Sometimes, Herad can’t receive the encryption key from a server and uses a hardcoded one instead.

Herad is a part of an active ransomware family called STOP ransomware. These guys have been releasing new versions of their file locker and infecting people for months now. A researcher called Demonslay335 has been helping the victims by developing and updating a decryption tool called STOPDecrypter. This tool has been updated to support some earlier versions of STOP ransomware, so there is a possibility that it will support Herad, too.

For now, keep your encrypted .herad files and don’t lose them or accidentally delete them. To make sure that decryption is possible, do not edit them, just keep them as they are.

Below this article, there is a guide on a few ways to recover your files. The methods don’t rely on decryption, but rather, they can help you restore files as they previously existed. There is a good chance that they won’t work, however, there’s no harm in trying.

How to remove Herad

Before restoring the files, however, it’s important to remove the viruses. Otherwise, Herad could spread and continually encrypt your files. Until you make sure that the infections are gone, you won’t be able to use your computer normally. A strong antivirus program should work, like Spyhunter, but you might need to scan your device from another computer or by using safe mode.

How to avoid ransomware

Since Herad sometimes hides in cracks and key generators, one piece of advice would be to use software legally. Instead of trying to crack expensive commercial software, look for open-source or other free alternatives, or just pay for your programs.

Malvertising has recently been responsible for some serious infections, so be careful of websites with intrusive and shady ads. Most importantly, avoid drive-by infections by updating your browser, operating system, and other software with the latest security patches. That way, known security flaws can’t be abused to harm your system.

It’s not always possible to avoid ransomware or other malware, but if you set up backups, you can rest easy knowing that if anything happens to your files, you have copies that you can restore from. Adame, Matrix, WannaCry — these are not scary if you have backups.

Automatic Malware removal tools

How to recover Herad File-Locking Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Herad Virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Herad File-Locking Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Herad Virus. You can check other tools here.  

Step 3. Restore Herad File-Locking Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Herad Virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Herad File-Locking Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.