This article will help you remove the Hand of God ransomware in full. Follow the ransomware removal instructions provided at the bottom of the article.
Hand of God is the name of a ransomware virus. The virus is a screenlocker type and pretends to have a message from the FBI. It states that you have been involved with illegal activity and must pay a fine. Do not pay as that is a scare tactic, trying to persuade you to do so. Hand of God may not encrypt your files but still open a window, displaying the ransom payment instructions. These instructions demand that you pay 555 US dollars to the cybercriminals in Bitcoin cryptocurrency. Read on below and find out what ways you could try to potentially recover some of your files.
|Name||Hand of God|
|Short Description||The ransomware is not reported to encrypt files and is of the screenlocker type. No matter if it encrypts or not now, it will still show a ransom note if you get infected.|
|Symptoms||This ransomware virus demands you to pay the sum of 555 US dollars as ransom in the form of Bitcoin to the cybercriminals stating that your files are encrypted.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by Hand of God |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Hand of God.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Hand of God Ransomware – Delivery
Hand of God ransomware could be delivered in more than one way. However, the way that is the most widespread is via a payload dropper file which initiates the malicious script for the ransomware. A sample has been spotted by malware researchers and you can preview its analysis available on the VirusTotal service from down below:
The Hand of God ransomware might be using other ways to deliver the payload file, such as social media and file-sharing sites. Freeware applications found on the Internet could be promoted as helpful but also could hide the malicious script for this virus. Before opening any files after you have downloaded them, you should instead scan them with a security program. Especially if they come from suspicious places, such as emails or links. Also, don’t forget to check the size and signatures of such files for anything that seems out of place. You should read the ransomware prevention tips given in the forum.
Hand of God Ransomware – Details
The Hand of God ransomware is a virus, which has been recently discovered by malware researchers. Although the virus is of the screenlocker variety, it will still show a ransom note demanding payment. Hand of God ransomware will pop up a window that serves as a ransom note with instructions that is actually a screen locking your computer and blocking access.
In the future, the Hand of God ransomware could be set to make new registry entries in the Windows Registry to achieve a higher level of persistence. Those entries are usually designed in a way that will start the virus automatically with every launch of the Windows Operating System, like in the example given below:
The ransom message will load up as a screenlocking image and it can be seen right here below:
The message states the following:
Sortie de Secours
V0TR3 M4CH1N3 35T M41NT3N4NT INN4CE55I813
ATTENTION You Have Been Hacked !!!
Cet Ordinateur et toutes ses données importantes ont été véroufllé
La Main de Dieu vous puni pour avoir escroqué des chercheurs d’emploi
en leurs promettant un emploi au Canada pour le poste de téléopérateur…
Toutes tentatives de désactivation ultérieures a ce programme échouerons
Vos fonctions systèmes ont été désactivées
Ce Programme est concu pour s‘auto-détruire dans 2 jours en entraînant la
Suppression complete de tous vos fichiers
Comment Désactiver Ce Virus
Vous devez payer le montant de 0.06 Bitcoin (ETC) = 555.29 Dollar (CAD)
à l‘adresse bitcoin suivante : 1Emhk1iJhcVTxPEWu4vqwPyUjXqz33So3F
Moyens de payement
Vous disposez de plusieurs moyens de payement qui consistent
a acheter ou a transferer des bitcoins à l‘adresse indiquée plus haut
Veuillez visiter le site suivant : https://cryptogains.fr/229-comment-acheter-des-bitcoins
A rough English translation will look like this:
YOUR MACHINE IS INACCESSIBLE
ATTENTION You Have Been Hacked !!!
This Computer and all its important data have been gobbled
The Hand of God punishes you for cheating job seekers
promising them a job in Canada for the teleoperator position …
Any subsequent disabling attempts to this program will fail
Your system functions have been disabled
This program is designed to self-destruct in 2 days by executing the
complete deletion of all your files
How to Disable This Virus
You must pay the amount of 0.06 Bitcoin (ETC) = 555.29 Dollar (CAD)
at the following bitcoin address: 1Emhk1iJhcVTxPEWu4vqwPyUjXqz33So3F
Means of payment
You have several means of payment which consist
of buying or transferring bitcoins to the address indicated above
Please visit the following site: https://cryptogains.fr/229-how-to-purchase-bitcoins
The ransom sum that is demanded as payment for allegedly restoring access to your computer device is 555 US dollars. As the virus doesn’t necessarily lock your files themselves but just the access to them, it is probably removable. You should NOT in any case consider paying these cybercriminals. By paying, you can motivate them to do similar criminal acts in the future, which is strongly advised against.
Hand of God Ransomware – Encryption
There is no official list with file extensions that the Hand of God ransomware seeks to encrypt and the article will be updated if there are changes regarding the matter. The virus might still be in-development. However, the files used most by users and which are probably going to get encrypted are from the following list of categories:
- Document files
- Audio files
- Video files
- Image files
- Backup files
- Banking credentials and data
The Hand of God cryptovirus is more than likely to erase the Shadow Volume Copies from the Windows Operating System by executing the following command:
→vssadmin.exe delete shadows /all /Quiet
If the above-stated command is inputted into the command prompt of the Windows operating system, that will make the encryption process more effective, as one of the main ways for file recovery will be gone. Continue reading to find out what methods you can try out to potentially restore some of your files.
Remove Hand of God Ransomware and Restore Files
If your computer got infected with the Hand of God ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.