HelpDCFile Ransomware is a type of malware that encrypts your files and demands a ransom in exchange for the decryption key. We believe it to be a variant of the well-known Locky ransomware.

History

This ransomware is relatively new, first appearing in December 2016.

Spam Campaigns

Someone primarily spread HelpDCFile through spam emails that contain malicious attachments or links. These emails often pose as invoices, receipts, or other important documents. If you open the attachment or click on the links, you will download and execute HelpDCFile on your computer.

Encryption Process

HelpDCFile uses the AES encryption algorithm to encrypt victims’ files and appends the .locked extension to them. Once encrypted, the victim will see a ransom note named _HELP_INSTRUCTION.TXT which contains instructions on how to pay the ransom and decrypt their files.

Ransom Amount

The amount of the ransom varies but is typically around 0.5 Bitcoin, which is currently equivalent to approximately USD 3,000. But, regardless of the amount, we recommend that you do not pay the ransom as there is no guarantee that you will get your files back.

Prevention

The best way to prevent HelpDCFile or any other ransomware from infecting your computer is to practice basic cyber hygiene and have a robust backup solution in place.

Basic Cyber Hygiene

- Be suspicious of unsolicited emails and attachments, even if they appear to come from a trusted source.- Do not click on links or open attachments unless you are sure they are safe.- Keep your software up-to-date, including your operating system, browser, and anti-virus program.

Backups

One of the most important things you can do to protect your computer from HelpDCFile or any other ransomware is to have a robust backup solution in place. That way, even if your files are encrypted, you will still have a copy that you can restore.There are many different backup solutions available, so find one that meets your needs and make sure you use it regularly.For more information on HelpDCFile Ransomware and how to protect yourself, visit our website.

Decryption

HelpDCFile does not currently have a decryptor available.

What should you do?

If attackers have infected you with HelpDCFile ransomware, we recommend that you follow these steps:

1. Do not pay the ransom. There is no guarantee that you will receive the decryption key even if you do pay.
2. Use a reliable anti-malware program to scan your computer for any remaining malicious files and remove them.
3. Use data recovery software to attempt to recover any encrypted files. Note that this may not be possible in all cases.

We built SalvageData data recovery software to help you.

4. If you have backups of your files, you can restore them from backup.

Contact a data recovery service

If you are not able to decrypt your files or if you do not have backups, you may be able to use a data recovery service. Data recovery services specialize in recovering data from infected computers and may be able to help you recover your files.However, data recovery services can be expensive and there is no guarantee that they will be able to recover your files. In addition, using a data recovery service may require you to send your computer to them, which means that you will be without your computer for some time.Before you decide to use a data recovery service, we recommend that you attempt to use data recovery software first.SalvageData has a team of certified data recovery engineers who can help you recover your files. We offer a free consultation to assess the feasibility of recovery and provide you with a no-obligation quote.Our data recovery services start at $495 and we have a success rate of 96%. Contact us today to get started.