Hlas Virus (.hlas File) Ransomware

The Hlas virus is a new member of the STOP/Djvu ransomware family that targets Windows PCs. It causes significant disruption by encrypting files and appending a “.Hlas” extension to their names. The malware also disables antivirus programs and deletes backups, significantly complicating recovery efforts.

In this article, I will guide you through the steps to remove the Hlas virus from your system and explore various methods to attempt recovery of files post-attack, despite the challenges posed by the malware’s robust encryption and system modifications.

Hlas Ransomware

The Hlas virus encrypts files using a robust Salsa20 cipher, incapacitates antivirus programs, and erases backups. It modifies every document – a Word file, Excel spreadsheet, or photo – by appending a Hlas file extension. For instance, “photo.jpg” becomes “photo.jpg.hlas”. It then creates a ransom note called _readme.txt and places it in each folder containing encrypted files on your desktop, which details the ransom payment instructions as follows:


ATTENTION!

Your personal ID:


Sharing habits with most STOP/Djvu ransomware variants, the Hlas ransomware represents over 70% of individual ransomware attacks since its 2018 inception. It introduced many features now common across ransomware targeting individuals, such as ransom demands, notification methods, and backup prevention measures.

Hlas Ransomware

STOP/Djvu ransomware, including the Hlas variant, spreads through similar channels, namely software cracks, unlicensed programs, and dubious internet tools. Specifically, it leverages single-use websites that offer trending items like new movies or software cracks. These sites often pushed to the top of search results through spam techniques, host malicious links that deliver ransomware.

Initially, cybercriminals inject downloader malware that paves the way for the ransomware by disabling security defenses, such as Windows Defender, and implementing changes to hinder antivirus programs from blocking or removing the ransomware.

The Hlas Virus Encryption Process

Upon entry, the Hlas ransomware disables common backup methods and blocks access to potential recovery solutions. It then systematically encrypts files, connecting to its server for an encryption key before starting the encryption process, which it repeats until all target files are encrypted.

To ensure persistence, Hlas ransomware clones its executable file into obscure directories, avoiding detection by most antivirus software.

Removing Hlas and Ransomware Protection

Given its sophistication, detecting and removing ransomware demands the utmost care. The Hlas virus, known for hindering security software execution, requires you to bypass these restrictions for successful removal and system recovery.

Loaris Trojan Remover stands out as the premier choice for eradicating the ransomware threat and restoring your system. It boasts an advanced scanning engine that detects ransomware in all forms and allows for targeted scans with its Custom Scan feature.

To navigate around the ransomware’s execution blocks, boot your PC in Safe Mode with Networking. This can be done through the Troubleshooting panel by restarting your PC while holding the Shift key, navigating to Startup Settings, and selecting Windows 10 Safe Mode with Networking.

In Safe Mode, launch the Loaris installer, follow the installation prompts, and activate the free trial for full functionality.

Conduct a full scan, review the list of detected threats, and proceed with the recommended removal actions.

Decrypting Hlas Files

Decrypting files affected by Hlas ransomware might seem daunting, but not all hope is lost. The malware uses two key types – online and offline – with the latter offering a ray of hope for decryption.

Emsisoft’s free tool for STOP/Djvu decryption leverages collected keys to offer victims a chance at recovering their files.

Decryption with Emsisoft Decryptor for STOP Djvu

Install the Emsisoft Decryptor for STOP Djvu from the official website, set it up by specifying target folders, and initiate the decryption process.

If Emsisoft’s tool cannot decrypt your files, consider file recovery tools as an alternative. For example, PhotoRec, a free tool, can recover files deleted by ransomware by searching for residual data left on the disk.

Recovering .Hlas Files with PhotoRec

Download PhotoRec, specify the disk or partition and desired file formats for recovery and start the recovery process to salvage your encrypted data.

Frequently Asked Questions