On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on notepad I can't understand it. My question is is this somthing I should worry about?
From a bit of googling the DECRYPT_INFORMATION looks like a thumbprint of Hermes Ransomware, symantec has a technical description here
According to the link the executed Trojan creates the following files, which you could search for to confirm, but definitely don't click on that Reload.exe file if you find it:
- [LOCATION OF ENCRYPTED FILES]\DECRYPT_INFORMATION.html
- [LOCATION OF ENCRYPTED FILES]\UNIQUE_ID_DO_NOT_REMOVE
And creates the following registry subkey:
It targets files with a range of extensions, available at the Symantec link, but the recommendations apply mostly for network admins and won't help you much.
Note: I'm sharing this bleepingcomputer forum post just for information, not at all suggesting to follow the suggestions there.
From this bleepingcomputer forum post, it seems that the Hermes Trojan may have some difficulty traversing directories, so it could be minor if you don't make things worse in your detective work.
I suggest backing up any information on your computer that you don't want to lose, and opening files by right-clicking them and opening them in notepad instead of double-clicking.
If I remember right Windows has the unpleasant feature of hiding file extensions and you don't want to stumble on any more executables in case it has more landmines.
Unfortunately this sounds a lot like files that are created by ransomware, that contain instructions on how to decrypt files after the ransomware has encrypted them.
Are you able to access your normal files (e.g. files in the Documents folder)?
Additionally: are these files new? (When does it say they were created?) Could you share the contents of these files?