Havoc ransomware - How to remove

Havoc crypto-ransomware (full name Havoc Ransomware MK II) is a cyber nightmare that you cannot wake up from. It will selfishly encrypt your files with complicated algorithms that perform encoding without feelings of remorse. As you might have become aware from the previous sentence, this infection belongs to ransomware category which is probably the worst of all malware. If a vicious virus attacks your system and uses files as hostages, then you should contact a reliable security consultant to help your sort this issue out. You should not rely on hackers that designed Havoc ransomware: they might say a lot, but fail to keep their promises. Bear in mind: these sly programmers are only after money and will do everything they can to get it. Havoc virus is not a surprisingly innovative or unexpected addition in the malware clan, but it surely cannot be underestimated. This infection attempts to run silently in the background until demands can be explained in a ransom note. At the time of writing this article (which is the 18 of January), security researchers were not capable to produce a reliable tool for decryption. If there are any changes, we will surely inform you about them. Do not allow this infection to cause havoc by ripping your files apart like a destructive hurricane.

Havoc ransomware and devastation: how is this infection going to proceed

Its activity will begin secretively and without any warning. To cause the most damage, hackers are not going to announce their plans upfront, but keep them sealed from victims. Havoc ransomware is a product, attempted to lure money out of users that keep a lot of valuable data in their computer systems. If you have your files stored in other, secure locations, ransomware virus is not a threat to you. Nevertheless, even if the popularity of backup storages is rising, there are millions of people that choose to be ignorant to this opportunity. In our opinion, this is an ill-advised, unsafe practice that many voluntarily carry out. Upon its arrival, Havoc virus will make sure that its payload has suitable conditions for proceeding. One of the prevalent modifications that ransomware viruses make is the new entries in Windows Registry Keys. This is done to assure that the malicious process will run without any obstacles, together with other software that is assigned to automatically run after the device gets rebooted.

You will not be aware of its presence until the ransomware decides that it is time to show itself. Havoc ransomware can be identified from the extension it adds to the encrypted data: _Ink.HavocCrypt!. Surprisingly, it deletes the old extension entirely. After the encryption is done, users won’t be able to access files that have been selected as targets. This might include all sorts of executables: documents from Microsoft Word, Power Point presentations, PDF books, photos, videos and etc. It will probably keep vital folders and categories untouched since the ransomware would not wish to completely ruin your system.

Havoc virus is identified to have been constructed by BinaryEmperor. Even though their ransom note explains that file decryption is an easy process and all you need to do is pay a considerably tiny amount of 150 US dollars. Of course, this transaction is demanded to be made via bitcoin payment system. It is not like you can show up with a briefcase of cash and negotiate with hackers. In addition to that, hackers give 48 hours to send money in exchange for decryption key. After the time hits zero, it is very likely that the payload is programmed to start deleting the encrypted files.

File decryption: is it possible to defeat Havoc ransomware?

For now, a tool for decryption has not been released. As security researchers are constantly working on such projects, we have high hopes that victims of this ransomware are going to be introduced with an appropriate solution. For now, the only way to restore files is to pay hackers their demanded fee, but this is not a realistic fix. It is no news that hackers constantly leave their victims hanging: they receive money, but no decryption key is send. If you do not want to be tricked, please do not send money that can be exploited to create new ransomware viruses or other threats of malware. Lastly, we want to end this paragraph with an advise: store your files in backup storages or other secure locations (USB flash drives).

How do hackers distribute Havoc ransomware?

It is no picnic to become infected with Havoc ransomware. But how does it happen? You can be compromised by downloading software or files from unreliable sources. If you download a Trojan, which is going to intentionally infiltrate a ransomware infection, you are partially responsible for this unfortunate turnout of events. Since using malicious spam campaigns is also a popular tactic to spread ransomware viruses, we should mention it as well. If you receive an urgent message from a seemingly reputable authority, please make sure that the email letters is send from appropriate sources and not fake ones. Hackers can pose as important figures from tax return facilities, police, banks, airports or etc.

To have the best chance in restoring files that have been encrypted by Havoc ransomware, you should eliminate it from your system. This can be done if you run a security scan with an appropriate tool for malware removal. Spyhunter or Malwarebytes are the programs that you should seriously consider. More information about manual removal and file-decryption is indicated below.

How to recover Havoc ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Havoc virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Havoc Ransomware MK II

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Havoc ransomware. You can check other tools here.  

Step 3. Restore Havoc virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Havoc Ransomware MK II tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Havoc ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.