Thor virus Removal Guide
Description of Thor ransomware virus
Thor ransomware – another version of the Locky virus
Thor virus is the newest version of famous Locky virus that has been causing problems for computer users since the beginning of the year. Recently, we have talked about other versions of this ransomware – Zepto, Odin and Shit viruses. Now it’s time to announce the latest malware version. Thor ransomware spreads via malicious spam emails and is activated when the victim opens an infected file. The virus is capable of encoding more than 400 different types of files using combined AES-128 and RSA-2048 ciphers. During data encryption virus changes filenames and appends .thor file extension to all corrupted files. Since then, victims cannot access their personal data, and what is worse, they might not be able to use it ever again. Unfortunately, virus researchers haven’t managed to crack any version of Locky virus, so there’s no decryption tool created yet. At the moment there’s only one risk-free solution to restore data – to use backup copies. Indeed, the creators of ransomware always offer to pay the ransom and get back your files. However, we believe it’s just a waste of money. Instead of reaching for your credit card, start Thor removal.
Hackers inform about Thor ransomware attack by delivering two scary messages in _WHAT_is.bmp and _WHAT_is.html files. After successful data encryption, the .bmp file becomes new background picture which tells about ransomware attack and encourages opening .html file. The ransom note includes unique victim’s ID, necessary information for data encryption and how to purchase file decryption tool. Hackers explain that there’s no other possibility to get back access to the corrupted files, just transferring 0.5 Bitcoins via Tor browser and using Locky Decryptor. They briefly explain what tools are needed for paying the ransom and how to use them. No matter how helpful they are, do not follow their instructions. Paying the ransom does not guarantee that hackers provide you a necessary key for data decryption. Therefore, you might lose both – your files and money. We strongly recommend spending your money on more valuable services. Remove Thor from the computer using ReimageIntego or other reputable anti-malware program.
Malware distribution techniques
The authors of Thor malware use the same three distribution methods: malicious spam campaigns, exploit kits, and malware-laden ads. Cyber criminals already know that the most efficient and successful way to infect computers is to send a malicious attachment via email. In this case, the virus usually arrives in .zip file that includes malicious files. The content of the email tricks users that it is an important document and they open it without any suspicion. It’s already known that infected email message a subject line ‘Budget forecast’. However, there are hundreds or even thousands of different spam campaigns where criminals pretend to be from financial institutions, governmental organizations and other reliable companies.
Besides, Thor virus might infiltrate computer’s system when the user clicks on a malware-laden advertisement. Usually, these ads offer software downloads or updates, and sometimes they warn about various computer issues and offers to fix them. Lastly, the virus might spread with a help of exploit kit, so it’s important to keep all your programs updated. Additionally, you should install strong security program and watch your steps online. You have to be careful because malware is lurking in every dark corner of the Internet.
Thor removal methods
To remove Thor from the computer, you have to employ strong and reputable anti-malware program. Cheap or free utilities won’t be able to complete the task. They are simply weak. For ransomware elimination we recommend using one of these programs: ReimageIntego, SpyHunter 5Combo Cleaner or Malwarebytes. If already use a strong antivirus program, you have to update it. Sometimes malware blocks access to security tools; in this case, follow the step-by-step guide presented below. After Thor removal, you will be able to retrieve corrupted files from backups. However, if you have never made backup copies, probably you learned your lesson the hard way. In this case, you can try to recover at least some of your files from backups.
After Thor removal, you will be able to retrieve corrupted files from backups. However, if you have never made backup copies, probably you learned your lesson the hard way. In this case, you can try to recover at least some of your files from backups.
Getting rid of Thor virus. Follow these steps
In-depth guide for the Thor elimination
The elimination guide can appear too difficult if you are not tech-savvy. It requires some knowledge of computer processes since it includes system changes that need to be performed correctly. You need to take steps carefully and follow the guide avoiding any issues created due to improper setting changes. Automatic methods might suit you better if you find the guide too difficult.
Step 1. Launch Safe Mode with Networking
Safe Mode environment offers better results of manual virus removal
Windows 7 / Vista / XP
- Go to Start.
- Choose Shutdown, then Restart, and OK.
- When your computer boots, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) a few times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click the Start button and choose Settings.
- Scroll down to find Update & Security.
- On the left, pick Recovery.
- Scroll to find Advanced Startup section.
- Click Restart now.
- Choose Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Choose 5) Enable Safe Mode with Networking.
Step 2. End questionable processes
You can rely on Windows Task Manager that finds all the random processes in the background. When the intruder is triggering any processes, you can shut them down:
- Press Ctrl + Shift + Esc keys to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes.
- Look for anything suspicious.
- Right-click and select Open file location.
- Go back to the Process tab, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check the program in Startup
- Press Ctrl + Shift + Esc on your keyboard again.
- Go to the Startup tab.
- Right-click on the suspicious app and pick Disable.
Step 4. Find and eliminate virus files
Data related to the infection can be hidden in various places. Follow the steps and you can find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive (C: is your main drive by default and is likely to be the one that has malicious files in) you want to clean.
- Scroll through the Files to delete and select the following:
Temporary Internet Files
- Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
After you are finished, reboot the PC in normal mode.
Eliminate Thor using System Restore
Step 1: Restart your computer in Safe Mode with Command Prompt
Windows 7 / Vista / XP
- Go to Start → Shutdown → Restart → OK.
- As soon as your computer starts, start pressing F8 key repeatedly before the Windows logo shows up.
- Choose Command Prompt from the list
Windows 10 / Windows 8
- Click on the Power button at the Windows login screen, and then press and hold Shift key on your keyboard. Then click Restart.
- Then select Troubleshoot → Advanced options → Startup Settings and click Restart.
- Once your computer starts, select Enable Safe Mode with Command Prompt from the list of options in Startup Settings.
Step 2: Perform a system restore to recover files and settings
- When the Command Prompt window appears, type in cd restore and press Enter.
- Then type rstrui.exe and hit Enter..
- In a new window that shows up, click the Next button and choose a restore point that was created before the infiltration of Thor and then click on the Next button again.
- To start system restore, click Yes.
Bonus: Restore your filesUsing the tutorial provided above you should be able to eliminate Thor from the infected device. novirus.uk team has also prepared an in-depth data recovery guide which you will also find above.
Even though hackers try to convince victims to purchase a decryption key, do not risk your money! After Thor removal, you can restore files from data backups. All you have to do is to plug in the external device with your files to the computer and copy them. However, if you do not have backup copies, check additional methods described below.
There are a couple of methods you can apply to recover data encrypted by Thor:
Restore data with Data Recovery Pro
This tool is not created for restoring files encoded by ransomware. Though, you should give it a try. Follow the steps below:
- Download Data Recovery Pro;
- Install Data Recovery on your computer following the steps indicated in the software’s Setup;
- Run the program to scan your device for the data encrypted by Thor ransomware;
- Recover the data.
It is strongly recommended to take precautions and secure your computer from malware attacks. To protect your PC from Thor and other dangerous viruses, you should install and keep a powerful malware removal tool, for instance, ReimageIntego, SpyHunter 5Combo Cleaner or Malwarebytes.
How to prevent from getting ransomware
Prevent the government from spying on you
As there is a growing debate in government about collecting users' data and spying on citizens, you should take a closer look at this issue and find out what shady ways of gathering information can be used to collect information about you. You need to browse anonymously if you want to avoid any government-initiated spying and tracking of information.
You can enjoy secure internet browsing and minimize the risk of intrusion into your system if you use Private Internet Access VPN program. This VPN application creates a virtual private network and provides access to the required data without any content restrictions.
Control government and other third party access to your data and ensure safe web browsing. Even if you do not engage in illegal activities and trust your ISP, we recommend being careful about your security. You should take extra precautions and start using a VPN program.
Recover files damaged by a dangerous malware attack
Despite the fact that there are various circumstances that can cause data to be lost on a system, including accidental deletion, the most common reason people lose photos, documents, videos, and other important data is the infection of malware.
Some malicious programs can delete files and prevent the software from running smoothly. However, there is a greater threat from the dangerous viruses that can encrypt documents, system files, and images. Ransomware-type viruses focus on encrypting data and restricting users’ access to files, so you can permanently lose personal data when you download such a virus to your computer.
The ability to unlock encrypted files is very limited, but some programs have a data recovery feature. In some cases, the Data Recovery Pro program can help recover at least some of the data that has been locked by a virus or other cyber infection.