HERMES File Virus (Restore Files and Remove It) - How to, Technology and PC Security Forum |

HERMES File Virus (Restore Files and Remove It)

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

Article created to help you remove Hermes ransomware and try to restore your files, in case they have been encrypted by it with an added HERMES extension to them.

A ransomware infection, known as HERMES ransomware has been detected by malware researchers to heavily modify computer settings and encrypt the files using an AES encryption algorithm to render files on the compromised machine no longer able to be opened. The virus also ads it’s distinctive HERMES file extension to the encrypted files and then leaves an .html file which is named DECRYPT_INFORMATION.html. In case you have become an unfortunate victim of this ransomware infection, advices are to read this article and learn how to remove this virus and restore encrypted files.

Threat Summary



Short DescriptionThe malware encrypts users files using a strong AES encryption algorithm, making direct decryption possible only via a unique decryption key available to the cyber-criminals.
SymptomsThe user may witness ransom notes and “instructions” called DECRYPT_INFORMATION.html linking to a web page and a decryptor. Changed file names and the file-extension HERMES has been used.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by Hermes


Malware Removal Tool

User ExperienceJoin our forum to Discuss Hermes.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Hermes Ransomware – How Is It Spread

This particular virus uses malicious e-mail spam campaigns to spread either malicious web links or malicious executable files that cause the infection. The e-mails are accompanied by multiple deceptive messages that aim for one thing only – to convince potential victims to open the attachment. The attachments may be Microsoft Office documents or Adobe Reader files with malicious macros. But they may also be direct executable files such as:

→ ‘sys’,’shs’,’wmf’,’chm’,’wmf’,’ozd’,’ocx’,’aru’,’xtbl’,’bin’,’exe1′,’386′,’dev’,’xnxx’,’vexe’,’tps’,’pgm’,’php3′,’hlp’,’vxd’,’buk’,’dxz’,’rsc_tmp’,’sop’,’wlpginstall’,’boo’,’bkd’,’tsa’,’cla’,’cih’,’kcd’,’s7p’,’smm’,’osa’,’exe_renamed’,’smtp’,’dom’,’vbx’,’hlw’,’dyz’,’rhk’,’fag’,’qrn’,’fnr’,’dlb’,’mfu’,’xir’,’lik’,’ctbl’,’dyv’,’bll’,’bxz’,’mjz’,’mjg’,’dli’,’fjl’,’ska’,’dllx’,’tti’,’upa’,’txs’,’wsh’,’uzy’,’cfxxe’,’xdu’,’bup’,’spam’,’nls’,’iws’,’ezt’,’oar’,’.9′,’blf’,’cxq’,’cxq’,’cc’,’dbd’,’xlv’,’rna’,’tko’,’delf’,’ceo’,’bhx’,’atm’,’lkh’,’vzr’,’ce0′,’bps’,’pid’,’hsq’,’zvz’,’bmw’,’fuj’,’ssy’,’hts’,’qit’,’aepl’,’dx’,’lok’,’plc’,’mcq’,’cyw’,’let’,’bqf’,’iva’,’xnt’,’pr’,’lpaq5′,’capxml’

To learn how to protect yourself from malicious e-mails, we advise visiting the following related article:

Hermes Ransomware – Post-Infection Analysis

After the user becomes infected by opening the malicious e-mail attachment, there is no going back from this. The ransomware drops it’s malicious files amongst which is the hermes.exe file which is responsible for the file encryption procedure. Then, the virus may heavily modify the Windows Registry Editor with the one and only purpose of doing this is to run the malicious executable every time Windows starts up. There are many sub-keys that may be targeted by Hermes ransomware, but the primary ones are the Run and RunOnce sub-keys, located in the following keys:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

After it’s preparation phase is over, the Hermes virus may begin to encrypt files on the compromised computer. To encode files, the virus uses several different configuration settings of pre-set file types to corrupt. The files targeted by Herpes ransomware are often used by everyone and may be the following:


The virus may also connect to various domains to send information about the unlock key of the encrypted files. Hermes not only uses the AES encryption algorithm but the malware also ads its HERMES file extension to the files which are no longer openable. They may look like the following:

The Herpes ransomware does not stop it’s terror there. It also has to make sure the victim is made known of its presence. The malware leaves behind a DECRYPT_INFORMATION.html file which contains the ransom instructions. The file looks like the following when opened:

Remove Hermes Ransomware and Restore Encrypted Files

For the removal of Hermes ransomware, advices are to follow the instructions below. In case you lack the experience to perform the removal manually, experts always recommend using an advanced anti-malware program. Such software will also make sure that your system is protected in the future, besides removing Hermes virus completely.

After the removal of the virus, advices are to take into consideration multiple other options to restore your files, several of which we have mentioned in the removal instructions below in step “2. Restore files encrypted by Hermes” below.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share