Remove HandShake Ransomware

File-encryption Trojans can be very dangerous because of their ability to silently damage your data. While it is usually possible to recover from malware attacks by running an antivirus scanner, this might not be enough in the case of a ransomware attack. Threats like the HandShake Ransomware aim to lock as many of your files as possible and then offer an expensive decryption service. File-lockers often change the names of the files they lock, but the HandShake Ransomware does not do this – the names of encrypted files will remain unchanged.

The HandShake Ransomware Spares No Files

After the HandShake Ransomware's attack is complete, it spawns a new program window with the title 'HandShake v1.0.' The window contains a list of encrypted files. The surprising part is that this file-encryption Trojan goes after all sorts of file formats, including EXEs and DLLs. This means that it has the potential to break important software and system components. The program window also lists the demands of the criminals who ask victims to contact them at no-reply@forgetit.com. The window also contains an input field to enter the unlock password that the crooks are supposed to provide.

Although the ransom message does not specify a ransom fee, it is likely that victims will be asked to pay a hefty sum for the decryption password. Other ransomware operators tend to ask for payments via Bitcoin, and the situation with the HandShake Ransomware is likely to be the same. We advise you not to consider sending money to ransomware operators because you are likely to become the victim of a scam.

The correct way to proceed if your data has been taken hostage by the HandShake Ransomware is to run an up-to-date anti-malware scanner. It will ensure the removal of the malicious components, preventing the threat from causing more damage. Once you do this, you can start to restore files from a backup or experiment with alternative data recovery solutions.