.HeroesOftheStorm File Virus – Removal and Restore Guide

The .HeroesOftheStorm file virus aims to establish its malicious files on a system, encrypts important data and then blackmails victims into playing the game Heroes of the Storm 24 hours. The threat is classified as a ransomware that is based on the open source code of the project HiddenTear. However, playing Heroes of the Storm does not guarantee decryption of corrupted .HeroesOftheStorm files. Being a ransomware, it is likely to demand a ransom payment for the decryption key.

This article provides more information about .HeroesOftheStorm file virus and guides you through the removal process so you can restore PC and regain corrupted files.

Threat Summary

Name	.HeroesOftheStorm file virus
Type	Ransomware, Cryptovirus
Short Description	Encrypts target files on the infected computer. Demands 24 hours playing on Heroes of the Storm game.
Symptoms	The ransmware drops a ransom note that is contained in the What is it?.txt file.
Distribution Method	Spam Emails, Email Attachments, Executable files
Detection Tool	See If Your System Has Been Affected by .HeroesOftheStorm file virus Download Malware Removal Tool
User Experience	Join Our Forum to Discuss .HeroesOftheStorm file virus.
Data Recovery Tool	Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

How Does .HeroesOftheStorm Land on the PC?

The .HeroesOftheStorm file virus author can use different methods to distribute the payload. The preferred infection vector is considered to be the spam email messages. Such emails allow hackers to pose as legitimate organizations that are pretending to deliver valuable information that should be seen. Once the email is opened, it may present a message that urges you to click on a web link or download a file attachment. And if you do follow the instructions your PC will get infected with .HeroesOftheStorm file virus. Instant message services can also be used for the distribution of malicious links that lead to web pages with injected malware code.

How Does .HeroesOftheStorm File Virus Corrupts Data?

Being based on the Hidden Tear open source code, this data locker ransomware utilizes the strong AES cipher for data encryption. Like other ransomware based on HiddenTear (ZenCrypt, Unikey, Barrax) .HeroesOftheStorm can seek to encrypt frequently used files of the following types:

→ .txt, .doc, .docx, .xls, .xlsx, .pdf, .pps, .ppt, .pptx, .odt, .gif, .jpg, .png, .db, .csv, .sql, .mdb.sln.php, .asp, .aspx, .html, .xml, .psd, .frm, .myd, .myi, .dbf, .mp3, .mp4, .avi, .mov, .mpg, .rm, .wmv, .m4a, .mpa, .wav, .sav, .gam, .log, .ged, .msg, .myo, .tax, .ynab, .ifx, .ofx, .qfx, .qif, .qdf, .tax2013, .tax2014, .tax2015, .box, .ncf, .nsf, .ntf, .lwp

It then renames all corrupted files with .HeroesOftheStorm extension. The .HeroesOftheStorm files remain completely unusable until the decryption key is applied to the decryptor. Have in mind that many HiddenTear variants have been cracked by security researchers so there is chance that they will release freely available decryptor soon. Meanwhile, you can try to recover .HeroesOftheStorm files with the help of any alternative data recovery tool provided in the instruction at the end of the article.

How Does .HeroesOftheStorm File Virus Damage the PC?

The file restolocker.exe triggers the ransomware attack once it is running on the system. The malicious executable file can initiate various changes of the system settings. To ensure its persistent presence on the PC .HeroesOftheStorm ransomware can add or modify values in the Windows Registry. The registry keys Run and RunOnce are the main two that are targeted by crypto viruses as they manage all processes that need to be started when the Windows operating system is loaded.

Another frequent target of ransomware is the Shadow Volume Copies that can serve as a backup option in case of data loss. They are automatically created and stored in the system by default. So usually the ransomware accesses the Command Prompt and enters the following command line to erase all Shadow Volume Copies:

→ vssadmin.exe delete shadows /all /quiet

At the end of the attack when all target files are encrypted and marked with the extension .HeroesOftheStorm the threat drops a ransom note file called What is it?.txt on the Desktop. It reads the following:

Hi. I encrypted your personal files.
Heroes Of The Storm is the god game. But, people don’t know that.
So, I made this program that make people to play Heroes Of The Storm.
To dectrypt your files, follow this procedure. First, You have to install Heroes Of The Storm. Second, Play Heroes Of The Storm 24hours. (Only Play Time Will Be Recorded)
NOW, Let’s play the King God Emperor General Chungmoogong Majesty Game HEROES OF THE STORM
*Warning* Do NOT KILL This Program and Computer.

In addition the .HeroesOftheStorm crypto virus can replace the desktop wallpaper with the following image:

According to the ransom message attackers‘ demand from you to install Heroes of the Storm and play the game 24 hours. Eventually, after completing the challenge all .HeroesOftheStorm will be decrypted. However, there is no guarantee this will happen as it seems that the threat is in development. Even if it does, all ransomware files and objects remain on the machine. Thus on the next boot up, all your files can be encrypted again. Then hackers will be able to extort a ransom in Bitcoins from you.

Remove .HeroesOftheStorm File Virus and Restore Data

The .HeroesOftheStorm File Virus should be eliminated as soon as possible from the infected system. Otherwise, it has the chance to spread itself to all devices that are connected to the same network as the infected machine. The detailed guide below provides .HeroesOftheStorm ransomware removal instructions. After the removal backup all encrypted files and check step “Restore files encrypted by .HeroesOftheStorm file virus” for alternative data recovery solutions.

Manually delete .HeroesOftheStorm file virus from Windows and your browser

Note! Substantial notification about the .HeroesOftheStorm file virus: Manual removal of .HeroesOftheStorm file virus requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Remove or Uninstall .HeroesOftheStorm file virus in Windows

Remove or Uninstall .HeroesOftheStorm file virus in Windows.

Step 1: Remove/Uninstall .HeroesOftheStorm file virus in Windows

Here is a method in few easy steps to remove that program. No matter if you are using Windows 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program get left behind, and that can lead to unstable work of your PC, mistakes with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

Hold the Windows Logo Button and “R” on your keyboard. A Pop-up window will appear (fig.1).

In the field type in “appwiz.cpl” and press ENTER (fig.2).

This will open a window with all the programs installed on the PC.
Select the program that you want to remove, and press “Uninstall” (fig.3).

Follow the instructions above and you will successfully uninstall .HeroesOftheStorm file virus.

2. Remove .HeroesOftheStorm file virus from Your Browser and Your Registry Editor

Remove .HeroesOftheStorm file virus from Your Browser.

Remove a toolbar from Mozilla FirefoxRemove a toolbar from Google Chrome Remove a toolbar from Internet Explorer Remove a toolbar from Safari Fix registry entries created by .HeroesOftheStorm file virus on your PC.

Start Mozilla Firefox Open the menu window

Select the “Add-ons” icon from the menu

Select .HeroesOftheStorm file virus and click “Remove”

After .HeroesOftheStorm file virus is removed, restart Mozilla Firefox by closing it from the red “X” in the top right corner and start it again.

Start Google Chrome and Open the drop menu

Move the cursor over “Tools” and then from the extended menu choose “Extensions“

From the opened “Extensions” menu locate .HeroesOftheStorm file virus and click on the garbage bin icon on the right of it.

After .HeroesOftheStorm file virus is removed, restart Google Chrome by closing it from the red “X” in the top right corner and start it again.

Start Internet Explorer:

Click “‘Tools’ to open the drop menu and select ‘Manage Add-ons’

In the ‘Manage Add-ons’ window, make sure that in the first window ‘Add-on Types’, the drop menu ‘Show’ is on ‘All add-ons’

Select .HeroesOftheStorm file virus to remove, and then click ‘Disable’. A pop-up window will appear to inform you that you are about to disable the selected toolbar, and some additional toolbars might be disabled as well. Leave all the boxes checked, and click ‘Disable’.

After .HeroesOftheStorm file virus has been removed, restart Internet Explorer by closing it from the red ‘X’ in the top right corner and start it again.

Start Safari

Open the drop menu by clicking on the sprocket icon in the top right corner.

From the drop menu select ‘Preferences’
In the new window select ‘Extensions’
Click once on .HeroesOftheStorm file virus
Click ‘Uninstall’

A pop-up window will appear asking for confirmation to uninstall .HeroesOftheStorm file virus. Select ‘Uninstall’ again, and the .HeroesOftheStorm file virus will be removed.

Some malicious scripts may modify the registry entries of your computer to change different settings. This is why manual clean up of your Windows Registry Database is strongly recommended. Since the tutorial on how to do this is a bit lenghty, we recommend following our instructive article about fixing registry entries.

Automatically remove .HeroesOftheStorm file virus by downloading an advanced anti-malware program

1. Remove .HeroesOftheStorm file virus with SpyHunter Anti-Malware Tool and back up your data

Remove .HeroesOftheStorm file virus with SpyHunter Anti-Malware Tool

1. Install SpyHunter to scan for and remove .HeroesOftheStorm file virus.2. Scan with SpyHunter to Detect and Remove .HeroesOftheStorm file virus. Back up your data to secure it against infections and file encryption by .HeroesOftheStorm file virus in the future.

Step 1:Click on the “Download” button to proceed to SpyHunter’s download page.

Download

Malware Removal Tool

It is highly recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter.

Step 2: Guide yourself by the download instructions provided for each browser.
Step 3: After you have installed SpyHunter, wait for it to automatically update.

Step1: After the update process has finished, click on the ‘Scan Computer Now’ button.

Step2: After SpyHunter has finished scanning your PC for any .HeroesOftheStorm file virus files, click on the ‘Fix Threats’ button to remove them automatically and permanently.

Step3: Once the intrusions on your PC have been removed, it is highly recommended to restart it.

Back up your data to secure it against attacks in the future

IMPORTANT! Before reading the Windows backup instructions, we highly recommend to back up your data automatically with cloud backup and insure it against any type of data loss on your device, even the most severe. We recommend reading more about and downloading SOS Online Backup .

SOS Online Backup

2. Restore files encrypted by .HeroesOftheStorm file virus

Restore Files Encrypted by .HeroesOftheStorm file virus

Ransomware infections like .HeroesOftheStorm file virus aim to encrypt your files using an encryption algorithm which may be very difficult to directly decrypt. This is why we have suggested several alternative methods that may help you go around direct decryption and try to restore your files. Bear in mind that they may not be 100% effective but they may help you little or a lot in some situations.

Method 1: Scanning your drive’s sectors by using Data Recovery software.
Another method of restoring your files is by trying to bring back your files via data recovery software. Here are some suggestions for preferred data recovery software solutions:

• Stellar Phoenix Data Recovery Technicians License(Pro version with more features)
• Stellar Phoenix Windows Data Recovery
• Stellar Phoenix Photo Recovery

Method 2: Trying Kaspersky and EmsiSoft’s decryptors.
If the first method does not work, we suggest trying to use decryptors for other ransomware viruses, in case your virus is a variant of them. The two primary developers of decryptors are Kaspersky and EmsiSoft, links to which we have provided below:

• Kaspersky Decryptors
• Emsisoft Decryptors

Urgent! It is strongly advisable to first remove the .HeroesOftheStorm file virus threat before attempting any decryption, since it may interfere with system files and registries. You can do the removal yourself just in 5 minutes, using an advanced malware removal tool.

Method 3: Using Shadow Explorer

To restore your data in case you have backup set up, it is important to check for shadow copies in Windows using this software if ransomware has not deleted them:

• Shadow Explorer

Method 4: Finding .HeroesOftheStorm file virus decryption key while it communicates it via a network sniffing software.

Another way to decrypt the files is by using a Network Sniffer to get the encryption key, while files are encrypted on your system. A Network Sniffer is a program and/or device monitoring data traveling over a network, such as its internet traffic and internet packets. If you have a sniffer set before the attack happened you might get information about the decryption key. See how-to instructions below:

Instructions on How to Find Decryption Key for Files Encrypted By Ransowmare

Optional: Using Alternative Anti-Malware Tools

Remove .HeroesOftheStorm file virus Using Other Alternative Tools

STOPZilla Anti Malware

1. Download and Install STOPZilla Anti-malware to Scan for And Remove .HeroesOftheStorm file virus.
Step 1: Download STOPZilla by clicking here.
Step 2: A pop-up window will appear. Click on the ‘Save File’ button. If it does not, click on the Download button and save it afterwards.

Step 3: After you have downloaded the setup, simply open it.
Step 4: The installer should appear. Click on the ‘Next’ button.

Step 5: Check the ‘I accept the agreement’ check circle if not checked if you accept it and click the ‘Next’ button once again.

Step 6: Review and click on the ‘Install’ button.

Step 7: After the installation process has completed click on the ‘Finish’ button.

2. Scan your PC with STOPZilla Anti Malware to remove all .HeroesOftheStorm file virus associated files completely.
Step 1: Launch STOPZilla if you haven’t launched it after install.
Step 2: Wait for the software to automatically scan and then click on the ‘Repair Now’ button. If it does not scan automatically, click on the ‘Scan Now’ button.

Step 3: After the removal of all threats and associated objects, you should Restart your PC.

Gergana Ivanova

Gergana Ivanova is a computer security enthusiast. She keeps track on the latest malware issues and hopes that more people will outsmart hackers.

More Posts

Follow Me: