Hermes837 Extension Virus - How to remove

The Hermes837 extension virus is an example of really destructive and harmful malware — at least, if you don’t have data backups. It makes most user files on the infected computer unusable and leaves no easy or direct way to get them back. Some data recovery software might be able to restore the lost files.

Hermes837, recently found by a cybersecurity analyst, was developed and is being spread by some criminals as a part of an extortion scheme. Files on the victim’s computer are broken with a strong cryptographic algorithm. Then a ransom note — !!!READ_ME!!!.txt — is left for the victim to read. In it, you’re asked to send the money and then the extortionists promise to restore the files.

Whether these criminals can be trusted isn’t really known yet. But, needless to say, cybersecurity experts and law enforcement advise to never pay the ransom. Not just because it’s usually very expensive, but also because it gives some of your information to the criminals and rewards them for their criminal activity. Those people are using ransomware to make money because it continues to work.

This note is similar to Nemty and Kokoklock’s ransom notes, though it has differences, too. Hermes837 might also be confused with Hermes ransomware and Hermes666 ransomware, both of which are separate viruses. There doesn’t seem to be a known relation of Hermes837 to another extension virus.

Hermes837 memo:

Symptoms	Files don’t open Files have the “.hermes837” suffix A file called !!!READ_ME!!! appears in various folders
Functioning	Encryption turns portions of the files into ciphertext Encryption can only be reversed with the decryption key The decryption keys are known to the developers of Hermes837 The decryption key is unique to each victim
Sources	Malicious email spam RDP Malicious ads Infected files uploaded online
Removal	Automatic scan with anti-malware (Spyhunter)

 

Hermes837 is called that and recognized by the extension that this virus gives to each encrypted/locked/broken file: “.hermes837”. If you don’t see it, you might need to change your Windows File Explorer settings to display extensions: open the File Explorer, open the “View” menu, then check “File name extensions”.

Remember that, for most files, getting rid of the “.hermes837” extension by renaming the files won’t do anything to fix them. In fact, try not to mess with the locked files until after you’ve created a copy of all of them.

Excerpt from the !!!READ_ME!!! note:

ALL YOUR DATA WAS ENCRYPTED
Whats Happen?
Your files are encrypted, and currently unavailable. You can check it- all files on you computer has extension .hermes
By the way, everything is possible to restore, but you need to follow our instructions. Otherwise, you cant return your data (NEVER).

How to avoid ransomware

The problem with file-encrypting ransomware is that it continues to be lucrative to cybercriminals and probably won’t go away any time soon. So, what are the most important things to do to insure yourself against the harm of an extension virus?

The first thing is to have a data backup prepared. If you haven’t already, buy an external drive or some cloud space to save the contents of your computer on. Or at least put your most important projects and documents somewhere safe. Some malware can get into network-attached storage, so it’s best to keep your backups separate somehow.

It’s also super important to update your anti-malware program regularly. Early, Hermes837 was only recognizable as malware to a fraction of the cybersecurity programs that detect it now. But antivirus vendors do their best to be quick with updating their definitions — you only need to take advantage of their quick updates by installing them as soon as possible and enabling real-time protection, if that’s available to you.

Then there is avoiding the infection. The ways by which various ransomware is distributed are diverse but the main one must be malicious email spam. Avoid any email letters that lack personal details and want you to open an attachment or a link. Or, at least, scan the attached file before you open it. Similarly, social media messages are used to spread various malware.

Remote Desktop infections happen when you’ve left the RDP connection open for anyone to try and only protected with a weak password. It’s even worse if you failed to install some security updates. RDP hacking is automated and can happen to anyone. If it does, Hermes837 could just show up on your computer one day, out of nowhere.

Other ways include Hermes837 hiding in files that you can download from shady websites — pirates are especially vulnerable. This virus could also be spread by malicious ads, so people infected with adware at a greater risk.

How to remove Hermes837

If Hermes837 has gone through your files and locked them, those encrypted files with the “.hermes837” extension are not dangerous. The virus still is, though, and should be removed using a powerful anti-malware program, like SpyHunter.

Then, you can restore the files from the backup if you have one. Whatever vulnerability allowed Hermes837 into your system should be patched, too. Repeat infections do happen, after all.

Automatic Malware removal tools

As for restoring the files, there are a few options that don’t require you to deal with the criminals, though they don’t guarantee success. You can try data recovery if you used your infected PC very little. Or you could try System Restore in case Hermes837 failed to delete the needed files.

Since the data is encrypted, you might think that a universal decrypter might be developed at some point. However, there is no guarantee that that will happen. Strong encryption can’t be broken, the only hope is that either the extortionists left some bugs in their software, or they’re arrested at some point and the decryption keys are released. Check nomoreransom.org for updates.

How to recover Hermes837 Extension Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Hermes837 Extension Virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Hermes837 Extension Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Hermes837 Extension Virus. You can check other tools here.  

Step 3. Restore Hermes837 Extension Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Hermes837 Extension Virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Hermes837 Extension Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.