This page aims to help you remove the File .him0m Virus Extension. These File .him0m Virus Extension removal instructions work for all versions of Windows. The virus has two accompanying main files – the message “readthisshitnoworelse” and secretkeyishidinghere.key, a file that should “release” your files once the payment is complete.
If you have just been greeted by a pop-up window claiming all of your files have been encrypted and you have to pay a hefty ransom to recover them – yes, you do have a serious problem. Your computer has been infected by the ransomware known as File .him0m Virus Extension. The most important thing is to remain calm and not rush into any haste decisions like paying the hackers any money or deleting the encrypted files. With some luck all of your data may be recovered and the ransomware removed without having to resort to paying the criminals.
The following message, titled “readthisshitnoworelse” appears on infected users’ PCs:
|Name||File .him0m Virus Extension|
|Danger Level||High (These viruses are among the most dangerous as they can make all data stored on your PC unreadable)|
|Symptoms||None, until the ransomware reveal itself and you find all of your files ending with weird file extensions and unusable.|
|Distribution Method||Predominantly installed by Trojan Horses.|
1: Enter Safe Mode.
2: Remove File .him0m Virus Extension from your system.
3: Permanently delete File .him0m Virus Extension from Task Manager’s processes.
4: Uninstall the virus from Regedit and Msconfig.
Some facts about File .him0m Virus Extension and ransomware in general
Despite the spike in popularity in recent years Ransomware are not new tech, they have been known to exist ever since the nineties. Their recent success has been mostly attributed to the online currencies such as BitCoin. There is a reason all ransom is demanded in BitCoin – the online currency is completely untraceable and it allows the hackers to remain completely unanimous. Until today the most successful ransomware viruses were called Cryptowall and Cryptolocker. Security experts estimate that at least $10 million were extorted from victims only between those two, mostly due to misinformation or panic.
Ransomware usually sets a time limit for the payment of ransom to put pressure on the victims and make them less likely to seek professional help. Despite what the messages created by File .him0m Virus Extension might say there are alternative and free ways to recover your data – this is what is article is about.
Paying the ransom asked by File .him0m Virus Extension should only be done as a last resort
To put it simple – when the Ransomware began encrypting your files it did not transform them – it merely created the encrypted copies and deleted the originals. The hackers aren’t lying – the encrypted copies are totally worthless without the key used in the encryption process. What we can do is try to recover the original files – which works much in the same way as restoring accidentally deleted files. The bigger your HDD and the less it was used since the deletion – the better the chances of recovery. However, be careful not to delete the secretkeyishidinghere.key as it can help you recover your files if you decide to pay.
You still have to remove the ransomware itself before attempting the recovery. Complete success is not guaranteed, that is why we recommend that you do not try to remove the encrypted copies. See how much of your files will be recovered and then make a decision of any remaining missing data is worth the ransom.
- Keep in mind that you are dealing with criminals that are under to obligation to recover your files even if you pay the money they ask for.
In the future please try to keep an active anti-virus or anti-malware program on your PC. Deviant viruses like Ransomware never reveal themselves until it is too late, as it was with File .him0m Virus Extension. Finding and removing them before they can do any damage is the best form of defense their is and it can only be done by an in-depth system scan. You can find our recommendation about a protection software above.
File .him0m Virus Extension Removal
This guide was created to help you get rid of the virus itself. We can in no case guarantee that the procedures here (or the software) will 100% help you recover your files.
Reboot in Safe Mode (use this guide if you don’t know how to do it).
This is just the first preparation.
The first mandatory thing is to allow you to see Hidden Files and Folders. Each version of Windows does this slightly differently.
- I repeat – it’s extremely important you do this. File .him0m Virus Extension may have hidden some of its files and you need to see them to delete them.
Hold the Start Key and R again – but this time copy + paste the following and click OK:
A .txt file will open – don’t type or change it. If you are hacked and someone has access to your PC, there will be a bunch of other IPs connected to you at the bottom. This is what a hosts file looks like:
If there are a bunch of strange IPs connecting to you below “Localhost” you may be hacked, and it’s best to ask us in the comments for directions.
Right click on each of the malware processes separately and select Open File Location. Also, End the process after you open the folder. Just to make sure we don’t delete any programs you mistakenly took for a malware, copy the folders somewhere, then delete the directories you were sent to. There’s a good chance File .him0m Virus Extension is hiding somewhere in here.
A BIG WARNING HERE! READ THIS BEFORE PROCEEDING!
This is perhaps the most important and difficult step, so be extremely careful. Doing this can damage your PC significantly if you make a big mistake. If you are not feeling comfortable, we advise you to download a professional File .him0m Virus Extension remover. Additionally, accounts connected to your credit cards, or important information, may be exposed to the virus.
If you do not remove the virus completely it could leak the information to its creator, so be careful!
Right click on each of the virus processes separately and select Open File Location. Also, End the process after you open the folder. Just to make sure we don’t delete any programs you mistakenly took for a virus, copy the folders somewhere, then delete the directories you were sent to.
Take a look at the following things:
Type msconfig in the search field and hit enter: you will be transported to a Pop Up window.
Go in the Startup tab and Uncheck entries that have “Unknown” as Manufacturer.
Type Regedit in the windows search field and press Enter.
Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If you can’t find them this way, look in these directories, and delete/uninstall the registries manually:
- Type regedit in the Windows Search Field. Search for the ransomware (try typing its name) in your registries and delete anything with that name. But be extremely careful – if you delete the wrong thing here, you can damage your system.
- Type %temp% in the Windows Search Field and delete all the files in the folder you are transported to.
Remember to leave us a comment if you run into any trouble!
How to Decrypt files infected with File .him0m Virus Extension
There is only one known way to remove this virus successfully, barring actually giving in the to the demands of the people who created the virus – reversing your files to a time when they were not infected.
There are two options you have for this:
The first is to do a full system restore. This can take care of the file extension for you completely. To do this just type System Restore in the windows search field and choose a restore point. Click Next until done.
Your second option is a program called Shadow Volume Copies.
Open the Shadow Explorer part of the package and choose the Drive (C or D usually) you want to restore information from. Right click on any file you want to restore and click Export on it.
Did we help you? Please, consider helping us by spreading the word!