Step-By-Step HeroesOftheStorm Ransomware Removal Process

Brief Details on HeroesOftheStorm Ransomware

 

HeroesOftheStorm Ransomware is one of the most noxious file-encrypting virus reported by the cyber security analysts on September 13^th, 2017. It is yet another ransomware infection based on the open-source HiddenTear ransomware project which was published by Utku Sen back in year 2015 on Github.com platform. The name of this file-encoder virus is derived from the fact that it is especially programmed by the criminal hackers in order to encipher the data stored onto the compromised machine and urge the victimized computer users to play a game identified as 'Heroes of The Storm by Blizzard' just for 24 hours and after that the encrypted data will be decoded by this program.

Besides, the important system files that has been encoded by HeroesOftheStorm Ransomware will be appended with a specific file extension reported as '.HeroesOftheStorm'. Although, the encrypted computer files are likely to be recognized by the white icons as well. On an affected computers, it runs as an executable file i.e. 'restolocker.exe'. Due to the executable it uses to run on the targeted machine, some of the security investigators may describe this malware under the name of Restolocker Ransomware. After the successful encryption of system files, the threat displays a program window named 'Play Heroes of The Storm' which included the game logo and details why some of the crucial PC files have been encoded with '.HeroesOftheStorm' extension and cannot be accessible.

How Does HeroesOftheStorm Ransomware Work?

According to the malware researchers, HeroesOftheStorm Ransomware or Restolocker Ransomware does not connect the compromised machine to a malicious remote server and it can work as an offline malware. However, it might be possible that the ransomware was created as a prank, but it has been categorized as a most dangerous file-encoder due to its behavior and ability to perform severe damages onto the infected machine. Furthermore, in order to protect your machine from the attack of this vicious computer virus, you should avoid opening the files attached on spam emails, downloading pirated contents and rogue games program from phishing domains, because the Restolocker virus or HeroesOftheStorm Ransomware may be deployed through such deceptive means. Therefore, if your PC have already been infected with this threat, then you should immediate actions for the complete removal of this ransomware from your compromised machine.

Malicious Files Associated with HeroesOftheStorm Ransomware

• Trojan.Win32.Z.Hiddentear.1488384
• Ransomware-FTD!7AF72B295C43
• Trojan ( 004cd60c1 )
• Ransom_Ryzerlo.R055C0CIC17
• malicious_confidence_90% (W)
• TR/AD.HiddenTear.tixjz
• W32/Ransom.XYUO-5436
• Trojan.Ransom.HiddenTear.H

Free Scan your Windows PC to detect HeroesOftheStorm Ransomware

Remove HeroesOftheStorm Ransomware From Your PC

Step 1: Remove HeroesOftheStorm Ransomware in Safe Mode with Command Prompt

• First of all disconnect your PC with network connection.
• Click restart button and keep pressing F8 key regularly while system restart.

 

• You will see “Windows Advanced Options Menu” on your computer screen.

• Select “Safe Mode with Command Prompt” and press Enter key.

• You must login your computer with Administrator account for full privilege.

• Once the Command Prompt appears then type rstrui.exe and press Enter

• Now follow the prompts on your screen to complete system restore.

Step 2: Remove HeroesOftheStorm Ransomware using MSConfig in Safe Mode:

• Power off your computer and restart again.
• While booting press the “F8 key” continuously to open “Windows Advanced Options Menu”.

• Use the arrow keys to select “Safe Mode” option and press Enter key.

• Once system get started go to Start menu. Type “msconfig” in the search box and launch the application.

• Go to the Startup tab and look for files from %AppData% or %Temp% folders using rundll32.exe. See an example below:

C:\Windows\System32\rundll32.exe C:\Users\username\appdata\local\temp\regepqzf.dll,H1N1

• Disable all the malicious entries and save the changes.
• Now restart your computer normally.

Step 3 : Kill Malicious Process Related To HeroesOftheStorm Ransomware

• Press Alt+Ctrl+Del buttons together.

• It will open the Task manager on your screen.
• Go to Process Tab and find HeroesOftheStorm Ransomware related process.
• Click the End Process Now button to stop the running process.

Step 4 : Remove HeroesOftheStorm Ransomware Virus From Registry Entry

• Press “Windows + R” key together to open Run Box.

• Type “regedit” and click OK button.

• Find and remove HeroesOftheStorm Ransomware related entries.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Now hopefully you have completely removed the HeroesOftheStorm Ransomware virus from your computer. If you are still get ransom message from the threat or unable to access your files, then it means that virus still remain into your computer. In such situation you don’t have any other option except removing this virus using any powerful malware removal tool.

Whereas if you have any backup of your infected or encrypted files, then you can also reinstall your Windows OS. This will erase all your files and data as along with the HeroesOftheStorm Ransomware infection. You will get a completely empty computer system with no files. Now you can use your backup to get your files. If you don’t have any backup then using malware removal tool is a better option for you.

If you have any query or question regarding your computer, then you can easily ask your problem to our experts. Go to the Ask Any Question page and get the answer for your query directly from out experts.