How to recover the encrypted files by Thor ransomware virus?


Issue: How to recover the encrypted files by Thor ransomware virus?

I got infected with this Thor ransomware a few days ago. I finally managed to get rid of it but my files are still inaccessible, and they all have .thor extensions. What would you suggest for recovery of the files?

Solved Answer

The files bearing .thor extension are the primary sign that your computer is infected with Thor ransomware. This is the new version of Locky virus, a well-known computer threat, capable of corrupting thousands of devices and access personal files. Later on, it encrypts the files using a specific algorithm. As a result, users only see their documents in the locked form. Due to elaborate structure and successful infiltration techniques, the threat has maintained its dominating position for a couple of months already. The updates of the virus often come in the form of newly appended extensions. The original version of the ransomware included .locky, a couple of months .odin file extension version was launched, and now Thor ransomware came into daylight.

One of the key strengths of this threat is that it is able to encode more than 400 extensions. Even if they are placed in C or D local disk, they might not escape the menace of this threat. The _WHAT_IS.txt and _WHAT_IS.bmp files instruct victims to access Tor browser to remit the payment. If you did not follow the story of Locky evolution, you might have missed the fact that it managed to collect millions of dollars revenue from its victims. Though Thor only asks for 0,50 BTC which equals to 330 USD, it is unwise to expect the retrieval of the files even after transferring the money. Instead, use one of the options to decrypt the data until virus researchers come up with the free decrypter.

Option 1. Opting for Data Recovery Pro

Recover now!
To recover needed system components, please, purchase the licensed version of Fortect recovery tool.

This tool is designed to recover the files after a system crash. However, it might come in handy recovering the files affected by Thor as well.

  1. Download Data Recovery Pro and run the setup file.
  2. Follow the instructions of the wizard.
  3. Scan the system with it so that the app could locate the corrupted files.
  4. Choose the detected files and click Recover button.

Option 2. What is Windows Previous Versions feature and how beneficial is it?

Recover now!
To recover needed system components, please, purchase the licensed version of Fortect recovery tool.

This utility is practical only when System Restore function is activated. However, this method takes up more time as you have to go through each of the files separately.

  1. Locate the affected file right-click on it.
  2. Choose Properties and go to Previous Versions tab.
  3. Find the available copies of the file in Folder versions. Opt for the preferred version and click Restore.

Option 3. The usefulness of ShadowExplorer

Recover now!
To recover needed system components, please, purchase the licensed version of Fortect recovery tool.

This tool is another alternative to restore your files. Users, who have been infected with .odin file virus reported that the application helped them recover some of their files. While the original private key is the most suitable solution to data retrieval, the latter tool still provides many chances to recover a significant portion of valuable data. The main versions of Locky are not reported for deleting shadow volume copies which are automatically created by the system, however, keep in mind that there might always be an exception with Thor virus. In any case, try recovering the files by running ShadowExplorer.

  1. Download and run the program.
  2. Launch it and select the folder you want to retrieve the files from.
  3. Click on it and choose Export.

Recover files and other system components automatically

To recover your files and other system components, you can use free guides by experts. However, if you feel that you are not experienced enough to implement the whole recovery process yourself, we recommend using recovery solutions listed below. We have tested each of these programs and their effectiveness for you, so all you need to do is to let these tools do all the work.

do it now!
recovery software Happiness
Compatible with Microsoft Windows
Do you have any trouble?
If you are having problems related to Fortect, you can reach our tech experts to ask them for help. The more details you provide, the better solution they will provide you.
Fortect - a patented specialized Windows repair program. It will diagnose your damaged PC. It will scan all System Files, DLLs and Registry Keys that have been damaged by security threats.
This patented repair process uses a database of 25 million components that can replace any damaged or missing file on user's computer.
To repair damaged system, you have to purchase the licensed version of Fortect malware removal tool.

Access geo-restricted video content with a VPN

Private Internet Access is a VPN that can prevent your Internet Service Provider, the government, and third-parties from tracking your online and allow you to stay completely anonymous. The software provides dedicated servers for torrenting and streaming, ensuring optimal performance and not slowing you down. You can also bypass geo-restrictions and view such services as Netflix, BBC, Disney+, and other popular streaming services without limitations, regardless of where you are.

Don’t pay ransomware authors – use alternative data recovery options

Malware attacks, particularly ransomware, are by far the biggest danger to your pictures, videos, work, or school files. Since cybercriminals use a robust encryption algorithm to lock data, it can no longer be used until a ransom in bitcoin is paid. Instead of paying hackers, you should first try to use alternative recovery methods that could help you to retrieve at least some portion of the lost data. Otherwise, you could also lose your money, along with the files. One of the best tools that could restore at least some of the encrypted files –  Data Recovery Pro.

About the author
Jake Doe
Jake Doe - Computer technology geek

Jake Doe is the news editor at UGetFix. Since he met Ugnius Kiguolis in 2003, they both launched several projects that spread awareness about cybercrimes, malware, and other computer-related problems.

Contact Jake Doe
About the company Esolutions

Read in other languages

What you can add more about the problem: "How to recover the encrypted files by Thor ransomware virus?"