1

On my computer there are lots of html files with titles DECRYPT_INFORMATION. I have scanned them with AVG and it says they are no threat but I am suspicious. I don't know html so when I open them on notepad I can't understand it. My question is is this somthing I should worry about?

1

From a bit of googling the DECRYPT_INFORMATION looks like a thumbprint of Hermes Ransomware, symantec has a technical description here

According to the link the executed Trojan creates the following files, which you could search for to confirm, but definitely don't click on that Reload.exe file if you find it:

  • %AllUsersProfile%\Reload.exe
  • %AllUsersProfile%\shade.bat
  • %AllUsersProfile%\system_.bat
  • [LOCATION OF ENCRYPTED FILES]\DECRYPT_INFORMATION.html
  • [LOCATION OF ENCRYPTED FILES]\UNIQUE_ID_DO_NOT_REMOVE

And creates the following registry subkey:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper

It targets files with a range of extensions, available at the Symantec link, but the recommendations apply mostly for network admins and won't help you much.

Note: I'm sharing this bleepingcomputer forum post just for information, not at all suggesting to follow the suggestions there.

From this bleepingcomputer forum post, it seems that the Hermes Trojan may have some difficulty traversing directories, so it could be minor if you don't make things worse in your detective work.

I suggest backing up any information on your computer that you don't want to lose, and opening files by right-clicking them and opening them in notepad instead of double-clicking.

If I remember right Windows has the unpleasant feature of hiding file extensions and you don't want to stumble on any more executables in case it has more landmines.

0

Unfortunately this sounds a lot like files that are created by ransomware, that contain instructions on how to decrypt files after the ransomware has encrypted them.

Are you able to access your normal files (e.g. files in the Documents folder)?

Additionally: are these files new? (When does it say they were created?) Could you share the contents of these files?

1
  • I am able to access a word document I had on my desktop. I don't have documents in my documents folder so I can't test that. Also I am not using internet on the infected computer? Is it safe to turn on Wi-Fi and search things online or is it possible for other devices on my Wi-Fi to get infected as well? – Jim Bob Aug 10 '18 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.