Remove .Thor extension virus tagged posts

Decrypt .Thor extension virus (How to remove .Thor extension virus permanently)

Delete .Thor extension virus with Simple Steps Manually

.Thor extension virus is a part of Locky Ransomwar that has infected thousands of Windows and Mac based PC in world-wide geographical regions. This is a new variant with more powerful encryption algorithm and complex decryption key which is not easy to decode for any malware researchers. .Thor extension virus is spreading like a wild-fire because ransomware is one category which is aggressively used by cyber-criminals to make quick money. .Thor extension is appended on the targeted file and then it becomes totally inaccessible. This is a panic situation for any user and they eventually agree to pay the ransom to cyber-criminals. This is a technical blog where you will know how to decrypt .Thor extension virus without paying the ransom.

Technical Details

  • Name: .Thor extension virus (.Thor Ransomware)
  • Type: Cryptolocker, Ransomware
  • Description: Encrypts the personal files and asks user to pay the ransom to access it again
  • Symptoms: Changes the files extension with “.thor”
  • Threat Level: Severe

.Thor extension virus is aggressively distributed through emails. It uses command and control servers for delivery. A downloader it added in the targeted PC through an empty email which only has the downloader attachment hidden in it. This downloader pieces the ransomware together and starts encrypting the personal files. The email looks very legitimate as it has proper sender’s name, address and so on. The downloader attachments are in legitimate file types such as .zip, .vbs, .wsf and so on.

Effects of .Thor extension virus

When the related downloader is executed in the work-station, a .dll file is executed. It will encrypt the personal files such as MS Office docs, multimedia files etc. and shows ransom note when user tries to access it.  The copy of ransom note is spread everywhere in different files and folders which has been encrypted. The ransom note image will replace the default desktop wallpaper. There will be payment instruction such as how much money is to be paid and what is the method of paying. It may also contain an email ID in order to communicate with the cyber-criminals. Generally, the ransom money is asked to be paid through Bitcoin method so that the real identity of the hacker remains hidden.

How to unlock .Thor extension virus

The aim of .Thor extension virus is to get ransom from innocent victim. However it is a very bad idea to pay money to untrusted cyber-criminals. There have been many cases where cyber-criminals totally ignore the victim once the ransom money is paid. They neither provide the decryption key nor provide the solution to access the personal files. So, if are lucky enough to have the “Shadow Copy” or backup files then this is the time to use it. Scan your PC with a powerful anti-malware tool to thoroughly scan the entire System and remove all the related items of .Thor extension virus quickly. Make sure that all the files and downloaders are removed so that this malware could not encrypt other files.

Read More