Do you know what Erenahen Ransomware is?
Erenahen Ransomware is meant to slither into your operating system without your notice. That being said, it is likely to slither in with your help. Just like most file-encrypting ransomware, this threat is likely to employ spam emails and suspicious downloaders to slither in; however, it cannot do that without you. That means that you have to be tricked into clicking a link, opening a file, or clicking the download button. Without a doubt, you want to be extra careful about what you do online because even the slightest misstep can help cybercriminals drop malware. Unfortunately, once the ransomware is executed, your personal files are doomed, unless you remove Erenahen Ransomware instantly. What if you did not delete this infection? Most likely, your personal files were encrypted and will never be decryptable.
According to our research team, Erenahen Ransomware is a variant of the malicious Globe Imposter 2.0. There are other variants of this malware too, including, for example, DDT Ransomware. After execution, these threats start encrypting files immediately, and they add unique extensions to the files’ names. In the case of Erenahen Ransomware, we are introduced to the “.Erenahen” extension. This is why the infection is named the way it is. When files are encrypted, a file named “How_to_open_files.html” is created close to them. In fact, every single location affected should have a copy of this file, and while opening it is safe, you have to be extra cautious about the message inside. According to it, you will be able to recover the encrypted files only after you pay for a decryptor that is in the hands of the attackers. The sum of the ransom is unknown, but you can email Erenahen@cock.li and Kishemez@tutanota.com to find out. Of course, just because you can, does not mean you should. Communicating with cybercriminals is risky because they could, for example, send you malicious files, and so we recommend focusing on the removal.
Erenahen Ransomware screenshot
Scroll down for full removal instructions
Some victims of the malicious Erenahen Ransomware might have set a system restore point, and they might hope that all files will be recovered using it. Unfortunately, this malware is capable of deleting shadow volume copies, and so internal backups will not save you. External backups stored online or on external drives will, and so we really hope that you have these backups. If your only option is to pay the ransom requested by the attackers, you might decide to do whatever the attackers tell you to do. That would be a mistake because cybercriminals cannot be trusted. Most likely, everything that they tell you is only meant to convince you to give away your money. Your chances of getting a decryptor in return are slim to none. In any case, whether or not you have paid the ransom, you must delete Erenahen Ransomware.
You can follow the guide below if you are interested in removing Erenahen Ransomware manually, but note that this option does not suit everyone. The components of this malware have random names, and identifying them can be difficult. Needless to say, that creates a risk of removing the wrong files or registry entries, and this could cause more problems for you. If you are not ready to delete Erenahen Ransomware from your system yourself, it is wise to install anti-malware software. It will automatically eliminate the infection, but the files will remain encrypted. Hopefully, you have backups that can replace the corrupted personal files.
Remove Erenahen Ransomware
- Delete the launcher of the infection. Its name and location are unknown.
- Delete every copy of the ransom file, How_to_open_files.html.
- Simultaneously tap Win+E keys to open Windows Explorer.
- Enter %LOCALAPPDATA% right into the field at the top.
- Delete a malicious .exe file, whose name is random.
- Enter %TEMP% right into the field at the top.
- Delete a malicious .bat file (the format of the name: tmpE396.tmp.bat).
- Simultaneously tap Win+R keys to access Run and then enter regedit into the dialog box.
- In Registry Editor, move to HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.
- Delete the value named BrowserUpdateCheck if the value data points to the file in step 5.
- Close all windows and then Empty Recycle Bin.
- Perform a full system scan to check for leftovers using a trusted malware scanner.
In non-techie terms:
Erenahen Ransomware is one of the thousands of file-encrypting and ransom-demanding infections that are out in the wild, looking for victims. This malware uses disguises and clever tricks to slither in, and most users cannot even tell when it does that. Unfortunately, once files are encrypted, they might be undecryptable. At the time of research, that was the case. Since Erenahen Ransomware deletes shadow volume copies, internal backups cannot save the day, but external backups can. Hopefully, you do not need to experience loss, but, first, you need to figure out the removal of the infection. The manual removal of this malware is not so straightforward, but a legitimate anti-malware tool can delete it automatically in no time. That is not all that it can do. It also can reinstate full Windows protection, which you need if you want to evade malware in the future.