Honor Ransomware

Honor Ransomware appears to be a rather unusual malicious file-encrypting threat. According to our researchers who tested the malware it does encrypt users files, creates a text document containing the unique user’s ID number, but it does not show a ransom note. It means it’s developers do not ask the victim to pay a ransom in exchange of a decryption tool. There could be various reasons for the malicious application to act this way, but we will discuss it further in the article. Users who encounter it should also know specialists recommend removing Honor Ransomware with no hesitation because there is simply no point keeping it on the system. On the contrary, leaving it unattended might only put your system at risk. To help you erase the threat faster, we will place deletion instructions showing how to get rid of the infection manually at the end of the article.

There are a few possible ways of how the malicious application could enter the system. First of all, Honor Ransomware might travel with infected email attachments. In such case, the user may accidentally infect the system by simply opening an email attachment from an unknown sender. To avoid such mistakes, our researchers recommend scanning all suspicious data received with Spam or other untrustworthy sources with a reliable antimalware tool. Another way the malware might enter the system is through malicious software installers, unreliable pop-up advertisements, and so on. Accordingly, besides being cautious with Spam emails, we would urge you to be careful while visiting various torrent and other potentially malicious web pages. Keeping a reliable antimalware tool installed could help you recognize possible threats and guard the system against them too.

Even though we cannot confirm the particular malware’s distribution channel, our researchers were able to confirm that it is based on a similar threat known as My little Ransomware. It is possible it could be a new version from the same creators who developed the mentioned malicious application. In fact, there is also a possibility Honor Ransomware could still be in the development stage. That is because the infection encrypts user’s data, but it does not show a ransom note demanding to pay for decryption like other similar ransomware programs. Our researchers say the malware should target data with the following extensions: .png .3dm .3g2 .3gp .aaf .accdb .aep .aepx .aet .ai .aif .arw .as .as3 .asf .asp .asx .avi .bay .bmp .cdr .cer .class, and so on. Besides, it should not encrypt files belonging to the operating system or other software. It means the malware might damage only private user’s data.

Furthermore, it looks like Honor Ransomware can both rename encrypted files and mark each them file with .honor extension. For example, a file called rose.jpg could turn out to be DOva=~0.jpg.honor, and so on. After making these changes, the malicious application might create data called data recive, secret.txt, secretAES.txt, and sendBack.txt in the %USERPROFILE%\Desktop directory. One other file should appear in the HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce directory. What we have in mind is a malicious value name called adr or similarly. Its creation might allow the infection to restart automatically with the operating system. Because of this, it is possible all new files you might create or upload may become encrypted as well. For this reason, we urge users not to waste any time an erase Honor Ransomware at once.

Soon after the malware is deleted, the user could replace encrypted files with copies from cloud storage, removable media devices, and so on. As for the ways you could get rid of the threat we may suggest using the instructions located a bit below this article. They will tell you how to eliminate Honor Ransomware manually step by step. The other way to remove it once and for all is to download a reliable antimalware tool and set it to scan the infected device. Later on, the chosen tool should identify malicious files belonging to the infection or even other potential threats hiding on the system. The best part is all detections could be quickly erased by simply pressing the deletion button.

Eliminate Honor Ransomware

1. Press Ctrl+Alt+Delete.
2. Go to the Task Manager.
3. Find the malware’s process.
4. Mark this process and click End Task.
5. Exit Task Manager.
6. Press Win+R, type Regedit and click OK.
7. Navigate to: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
8. Find a value name called adr.
9. Right-click this value name and press Delete.
10. Exit Registry Editor.
11. Tap Win+E.
12. Navigate to:
    %TEMP%
    %USERPROFILE%\desktop
    %USERPROFILE%\downloads
13. See if you can find the malicious file launched when the computer got infected.
14. Right-click the suspicious file and press Delete.
15. Then go to %USERPROFILE%\Desktop
16. Look for the listed files:
    data recive
    secret.txt
    secretAES.txt
    sendBack.txt
17. Right-click the listed files one by one and select Delete.
18. Close File Explorer.
19. Empty Recycle bin.