Heimdall Ransomware Virus (Removal Steps and Protection Updates)

The open-source Heimdall ransomware has been developed by a brazilian developer Lenon Leite in the PHP language and it allows attackers to encrypts hosted sites.

Heimdall Ransomware Description

The Brazilian computer expert Lenon Leite has developed a proof-of-concept code for a malware strain in the PHP programming language named Heimdall ransomware. This virus can allow remote attackers to encrypt the contents of a web server making hundres of thousands of web sites inaccesible.

The creator of the ransomware describes the project as the following:

[sic] Heimdall is a ransomware file writte in PHP language and it run in services web Heimdall encrypted all files with a password register and only decrypted files with this password

The intentions and the purpose of Heimdall is stated as a “study of case”:

[sic] This project is only a concept prove and study of case. The ideia is prove for all the big extension of PHP and your utilities including vírus and malicious code. The utilization for real life is probably case of police in your country. Is recommend that use in controlled environment, with files with backup.

The initial code was published on OCtober 26, the ransomware itself is contained in a single PHP file with 482 lines.

Once the attacker opens up the GUI module by acessing the URL they can use it to configure the ransomware. The virus allows them to enter a password that locks the target files with an AES-128-CBC cipher.

The encryption targets the DOCUMENT_ROOT folder and all other locations that are contained in it. During the actual encryption Heimdall ransomware logs all activity to the GUI. Depending on the server’s performance and capacity the whole process can last from severeal seconds to several minutes.

All compromised files are renamed with the Heimdall— prefix.

The Heimdall ransomware code has been removed from the GitHub repository.

Heimdall Ransomware Distribution

Heimdall ransomware attacks are carried out by deploying the PHP file to the server and executing the instructions via URl access.

Heimdall Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Heimdall completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Heimdall Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter