CheckEmoji Community · the emoji forum
🏠 Home 🆕 What's new ❓ Unanswered 🔥 Popular 📡 RSS Members 👥 0 online log in · register
Home › IT › IT Support › How to recover data after a Thor virus infection?

How to recover data after a Thor virus infection?

Started by northerncyclist32 · · 👁 4 views · 5 replies

📡 Subscribe to replies

Participants northerncyclist32Larry Ortiz5nimblegardener82
northerncyclist32 northerncyclist32 NewcomerOP
5 messages
joined Oct 2012
#1 ·
My computer's been hit by some kind of virus that’s encrypting all my files and slapping a THOR extension on them. I just got a message saying my data is encrypted with 128-bit encryption and that I need to follow the instructions they sent over. Is there any actual way to get my files back?
Larry Ortiz5 Larry Ortiz5 Regular
710 messages
joined May 2020
#2 ·
northerncyclist32 northerncyclist32 NewcomerOP
5 messages
joined Oct 2012
#3 ·
Alright, so how do I actually get rid of it? And more importantly, is there any way to get my lost files back?
Larry Ortiz5 Larry Ortiz5 Regular
710 messages
joined May 2020
#4 ·
We put this guide together to help you get rid of the .Thor virus for Free without spending a dime. Plus, we’ve included some steps on how you might be able to recover those files locked up by .Thor Ransomware.
nimblegardener82 nimblegardener82 Newcomer
4 messages
joined Apr 2016
#5 ·
Thor is essentially the latest iteration of Locky Ransomware—which means you’ve hit a serious snag. You might be able to recover if you had a recent backup or a system restore point active... allowing you to roll everything back to how it was before the infection. I would suggest downloading http://www.shadowexplorer.com/downloads.html to see if any restore points are actually available. It will tell you if there is a way back. If not... then you're likely out of luck.

The Ransomware likely triggered because you opened a specific file containing Thor—it then proceeds to lock down every file with a matching extension. If you can identify which file caused this (a zip, a txt, etc.), simply deleting that original file might help.

If you aren't certain which file was the culprit, there is an open-source tool called MBRFilter that can block Ransomware (http://www.bleepingcomputer.com/news...r-boot-record/); you can find it on GitHub and install it fairly easily... if you feel up to it.
northerncyclist32 northerncyclist32 NewcomerOP
5 messages
joined Oct 2012
#6 ·
Thanks, everyone! This is hands down the best forum I know. I always get a response so quickly, and everything makes perfect sense now. I’m going to give it my best shot and try to restore the system.
Thanks again for being so quick to help out.
Best,

You must log in or register to reply here.

Log in Register

🔗 Similar threads