How to Remove .hofos Files Virus (STOP Ransomware)

How to Remove .hofos Files Virus (STOP Ransomware)

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)


What is .hofos files virus? How to remove it from infected PC? Can files encrypted by .hofos ransomware be recovered?

The .hofos files virus is a new strain of the nasty ransomware infection called STOP. It disrupts system security in order to find important files and encodes them with the help of built-in cipher module. Once infected by .hofos ransomware your PC remains vulnerable to future attempts for malware attacks. Unfortunately, you won’t be able to access all files that are renamed with the extension .hofos. Since these files are likely to store valuable information of yours, you will be forced to pay a ransom fee for their recovery.

Keep up with our removal guide that will help you to get rid of all malicious files created by .hofos files virus and show you how to potentially restore .hofos files.

Threat Summary

Name.hofos Files Virus
TypeRansomware, Cryptovirus
Short DescriptionEncrypts files on your computer and extorts a ransom fee for their recovery.
SymptomsImportant files are locked and renamed with .hofos extension. You see a ransom message that forces you to contact hackers for a decryption tool.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by .hofos Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .hofos Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.hofos Files Virus – How Does It Infect and What Does It Do?

Being identified as a

Update June 2019! What is STOP? Is STOP ransomware going to encrypt your files? Can you decrypt files encrypted by STOP ransomware?
STOP ransomware strain, .hofos files virus is a threat that primarily aims to corrupt valuable data stored on the devices it infects.

Before it could reach the main infection stage which is data encryption, .hofos files virus corrupts essential system settings. Affected could be the registry key RunOnce as its functionalities could enable the ransomware to load its ransom message on the screen.

The key Run is also likely to be affected. The moment the ransomware adds its malicious values under this key, the latter starts executing infection files on every system boot up. So when removing .hofos ransomware you have to check system registries for malicious entries. Since this is a hard task even for tech-savvy users and could lead to the fatal system crash, security experts recommend the help of advanced anti-malware tool for this step.

When .hofos ransomware reaches the data encryption stage, it launches a specific cipher module. This module is designed to scan all drives for target files which files are likely to be:

  • Audio files
  • Video files
  • Document files
  • Image files
  • Backup files
  • Banking credentials, etc

Whenever a file matches the predefined scan parameters, the ransomware transforms the file’s code with the help of one or more sophisticated cipher algorithms. So following encryption, all files that are marked with the specific extension .hofos cannot be opened.

The ransom message that attempts to extort a ransom fee for .hofos files recovery, appears soon after the encryption process. It is stored in a text file named _readme.txt and below you could see a copy of its text:

Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
[email protected]
Reserve e-mail address to contact us:
[email protected]

According to the details presented in the ransom message, when you pay the ransom you will receive a decryption tool for .hofos files. However, since there is no guarantee that this tool is functioning, we recommend you to avoid any negotiations with cyber criminals and attempt to deal with the problem in a secure way.

What could have caused infection with .hofos ransomware? It could be a visit of a corrupted web page, an infected email attachment, or a recently downloaded freeware.

Remove .hofos Files Virus and Attempt to Restore Data

The so-called .hofos files virus is a threat with highly complex code that corrupts both system settings and valuable data. So the only way to use your infected system in a secure manner again is to remove all malicious files and objects created by the ransomware. For the purpose, you could use our removal guide that reveals how to clean and secure your system step by step. In addition, in the guide, you will find several alternative data recovery approaches that may be helpful in attempting to restore files encrypted by STOP .hofos ransomware. We remind you to back up all encrypted files to an external drive before the recovery process.

Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for three years, researching malware and reporting on the latest infections.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share