They will emphasize that HGSH ransomware virus has compromised their computer and equally encrypted the entire files contained in it, such as pictures, important data, documents etc. And since they made use of very strong encryption key, there is no other way they can possibly retrieve their data unless they pay a stipulated amount of money as ransom. Also contained in it will be two email addresses (manager@mailtemp.ch and helpsupportmanager@airmail.cc.) left for the victim to contact them with. In order to influence the victim into paying the ransom demand as soon as possible, they will give a condition that if the victim could pay within the next 72 hours or 3 days, they will slash the ransom demand by 50%, thus instead of paying $980 to have their encrypted files decrypted, they will now have to pay $490. However, once 3 days elapses, they would be made to pay the full ransom demand. If the victim reaches out to them, they will inform him that payment can only be made through cryptocurrency. Therefore, they would have to the cryptocurrency equivalent of the amount into a particular wallet address they will provide. The reason for using this channel is to enable the cybercriminals to remain anonymous and evade possible tracking and arrest by law enforcement agencies. To impress the victim and gain their confidence, they may request for excerpts from the encrypted files so they can decrypt as sample. However, they will warn that such excerpt must not contain any information that could be perceived as important to the victim. Regardless of how important the encrypted data is, our in-house experts recommend that victims shouldn’t pay the ransom, and this position is in line with FBI’s recommendation regarding payment of ransom. Note that paying ransom does not guarantee that the cybercriminals will restore your encrypted data. Moreover, complying with their demand will only increase their income and encourage them to continue constituting nuisance and victimizing others. In addition to that, the virus is also known to release Trojans such as AZORULT and VIDAR on the compromised computer for the purposes of stealing information, like your banking details, software account login details, saved passwords, cryptocurrency wallets and browsing history. With such sensitive information in the hands of cybercriminals, issues such as blackmail or loss of other valuables become a possibility.  Victims of any STOP/DJVU variant attack should remove HGSH ransomware virus from their computer as soon as they can. They can do this by running a reliable antivirus while setting up your computer on Safe Mode with Networking. Using this set up is good to ensure the antivirus functions optimally in removing all trace of the virus in your computer. If you’re not sure on what antivirus to use, our team recommends INTEGO Antivirus. Additionally, you may want to download and run RESTORO, a tool that can identify virus damage on Windows OS files for free. To repair it, you may need to purchase its full version.

Ransomware Summary

REPAIR VIRUS DAMAGE

Techniques used in distributing ransomware 

The most common way STOP/DJVU ransomware variants such as HGSH virus are spread is through download of malicious torrents. The virus will often hide in non-genuine software contents such as “cracks” or key generator and once opened by unsuspecting users, they will trigger malware infection. Based on data tallied over the years, many victims had reported of such ransomware attack after downloading certain software contents from online torrent platforms, after being deceived that such illegal activation tools and “cracks” could be accessed without following due process. Some of the fake versions of popular software copies often used by the cybercriminals are listed below: 

League of Legends;Fifa 20;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;VMware Workstation;Cubase;Adobe Illustrator;Adobe Photoshop;Internet Download Manager;KMSPico (illegal Windows activation tool).

As you can see, going to torrents online to download copyrighted software contents is risky and not worth the effort. Instead of getting what you need without paying the legal price as those rogue platforms promise, you only end up making yourself vulnerable to ransomware attack. Likewise, when you try to obtain other people’s product without paying the statutory price, it could be termed a criminal act and would be subject to prosecution. Therefore, it is always advisable to follow the right channel as promoted by the legitimate brand owners and pay the price attached to it. Remember that getting the software contents you need the right way will protect you from possible ransomware attack that would potentially cost you hundreds of dollars as well as loss of vital/sensitive data.  Aside online torrent libraries, another prolific way cybercriminals distribute ransomware is through malicious email attachments. They will compose messages that will appear real, often using DOCX, PDF or XLS. Why they normally chose such platforms is because they allow JavaScript as well as other macro function both of which can effectively enable the storage of payload and its activation in any computer.  However, it can be quite difficult to tell if an email is genuine or not since the cybercriminals have increasingly become more sophisticated in their approach. They often impersonate friends and family, colleagues or even popular brands. They may even attach a file and give it an irresistible name, for instance, they may present the email as coming from FedEx or DHL while the accompanying attachment may be named Invoice, Tracking Details or Order Summary. On the other hand, they may out-rightly decide to obfuscate the sender’s address by making use of email spoofing techniques. Either way, your curiosity may get the better of you to see what’s inside. However, you must apply extreme caution when faced with such dicey situation.  For those that have fallen victims already, you may be tempted to go after certain websites that claim to provide decryption services but instead consider it as red flags because such solutions rarely exist. Also have it in mind that cybercriminals equally spread other versions of ransomware in the name of fake STOP/DJVU decryptors. Don’t think you have nothing more to lose because such fake decryptors can worsen the situation by doubly encrypting your files. 

More details about this file-encrypting malware attack

Oftentimes, victims tend to wonder the extent to which their computer was compromised during the HGSH ransomware attack. Actually, the first thing the malware does is to set up build.exe or build2.exe. Afterwards, it will connect to https[:]//api.2ip.ua/geo.json while saving the outcome to geo.json file. It then extracts all necessary information about the computer, particularly its zip code, geolocation, time zone, latitude and longitude, etc. These set of information would be sent to their main server.  Shown below are two examples of geo.json files. With the geolocation data, it will check if the computer is located in any of their encryption-exempted countries such as Kyrgyzstan, Ukraine, Russia, Syria, Uzbekistan, Kazachstan, Armenia, Belarus and Tajikistan. If it shows positive, they will immediately truncate their operations but if otherwise, they will move to the next stage. Now, it will get the online encryption from their server and combine it with the victim’s ID before saving it in the bowsakkdestx.txt file and to PersonalID.txt file. A good example is displayed below. If for any reason it couldn’t extract an online encryption ID, it will resort to the use of an offline one. The main difference is that unlike the online ID that is peculiar to each victim, the offline one is uniform for all. You can tell if an offline key was used if t1 characters appear at the end of the personal ID. This is a preferable option because it brightens the possibility of being able to decrypt .hgsh files. More details about it are provided in this tutorial. At this point, the ransomware will commence full data encryption by scanning every folder and encrypting them with Salsa20 before using RSA-2048 to lock it. Below is a sample of _readme.txt ransom note that is dropped in every folder. The virus then deletes Volume Shadow Copies by leveraging a command prompt as shown here: vssadmin.exe Delete Shadows /All /Quiet Additionally, this ransomware collects data about victim’s computer, such as hardware used, computer name, active processes and the list of installed software. The virus collects these details into information.txt file and sends it to its C&C server. To complete the process, the virus now blacklists certain domains and adds them to Windows HOSTS file. This move is to prevent the victim from getting help online and when they try to visit any of those sites, DNS_PROBE_FINISHED_NXDOMAIN error message may appear on their screen. At this point, it may release more malware on the victim’s computer system.  

Remove HGSH Ransomware Virus and Recover Your Files

Victims of STOP/DJVU virus are advised to report the incident to relevant local authorities and also remove HGSH ransomware virus as fast as they can. You can avail yourself the guide below to learn how you can boot your computer using Safe Mode and Networking option. Our team recommends using professional software like INTEGO Antivirus and download RESTORO to see what virus damage on Windows OS files can be repaired. Before we conclude, always remember the actions to take after any ransomware attack in order to limit the extent of damage. They include: informing relevant law enforcement agency nearest to you, making use of your backup to restore lost files (provided you have any but you must ensure the malware is totally removed), go for tutorials on how to repair files infected by STOP/DJVU, and finally change all passwords associated with the compromised computer.  In all you do, always ensure that a strong antivirus is installed in your computer and also scan it always. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove HGSH Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove HGSH Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt HGSH files

Fix and open large HGSH files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. HGSH Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt HGSH files, follow the given tutorial.

Meanings of decryptor’s messages

The HGSH decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your HGSH extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of HGSH Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.