How to remove THRSX Ransomware and decrypt .THRSX files

What is THRSX Ransomware

THRSX Ransomware represents a highly sophisticated form of file-locking malware that targets Windows systems by encrypting user data and demanding a monetary ransom in exchange for a decryption key. Its hallmark is the addition of the .THRSX extension to affected files, transforming originals such as photo.jpg into photo.jpg.THRXS to clearly signify compromised content. Utilizing robust cryptographic algorithms, specifically AES-256-CTR for symmetric file encryption combined with RSA-4096 for key protection, it ensures that unauthorized file recovery remains practically impossible. Once active, the malware generates a prominent ransom note named RECOVER_INSTRUCTIONS.html, strategically placing it in directories containing encrypted files and on the victim’s desktop. The message within the note claims that not only are files encrypted, but also that sensitive data—including credentials and documents—has been exfiltrated, thus threatening further exposure if demands are not met. Extortion instructions require payment of 0.5 Monero (XMR) cryptocurrency and further communication via the attackers’ Telegram handle, with stern warnings about data destruction or leakage in cases of non-compliance. Users also observe changes to their desktop wallpaper, alerting them to the ransomware’s successful encryption and directing them to read the ransom note for recovery steps.

Despite the urgency and pressure imposed by the attackers, no legitimate or universal decryption tools are currently available for .THRSX files due to the strength of the encryption protocols used and secure key management practices. Victims are strongly advised against paying the ransom, as payment does not guarantee the restoration of data and further finances criminal activity. Data recovery via shadow copies or Windows restore points is unlikely to succeed since THRSX typically deletes such backups during its attack. Users seeking to decrypt .THRSX files are recommended to periodically monitor reputable resources such as the No More Ransom Project for breakthroughs, although prospects remain slim at present. In practice, file restoration is only feasible through pre-infection backups stored offline or on untouched cloud repositories. Removing the ransomware itself is crucial, best accomplished through reputable anti-malware utilities, but file decryption should not be trusted to unofficial tools or unknown online “services” – these often prove fraudulent or damaging. Preventive measures going forward include regular, isolated backups and heightened caution with phishing emails, unknown downloads, and malicious websites. If infected, thorough disconnection from networks and consultation with trusted cybersecurity professionals are prudent next steps, with emphasis on data safety and system remediation.

How THRSX Ransomware infects computers

THRSX Ransomware typically infiltrates computers through a variety of deceptive methods, exploiting common vulnerabilities in user behavior and software. Attackers often distribute this malware via phishing emails that contain malicious attachments or links, which, when clicked, execute the ransomware code. Additionally, the use of pirated software, keygens, and cracking tools can unknowingly introduce THRSX into a system, as these often come bundled with hidden malware. In some cases, the ransomware spreads through fake tech support scams, where unsuspecting users are tricked into granting remote access to their systems. Furthermore, compromised websites and malicious advertisements can lead users to download the ransomware inadvertently. Once on the system, THRSX encrypts files and demands a ransom payment for decryption, while simultaneously exfiltrating sensitive data for further exploitation.

1. Download THRSX Ransomware Removal Tool
2. Get decryption tool for .THRSX files
3. Recover encrypted files with Stellar Data Recovery Professional
4. Restore encrypted files with Windows Previous Versions
5. Restore files with Shadow Explorer
6. How to protect from threats like THRSX Ransomware

THRSX Ransomware files:


RECOVER_INSTRUCTIONS.html
{randomname}.exe


THRSX Ransomware registry keys:

no information

How to decrypt and restore .THRSX files

Use automated decryptors

Download Kaspersky RakhniDecryptor

Use the following tool from Kaspersky called Rakhni Decryptor, that can decrypt .THRSX files. Download it here:

Download RakhniDecryptor

There is no purpose to pay the ransom because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

Dr.Web Rescue Pack

Famous antivirus vendor Dr. Web provides free decryption service for the owners of its products: Dr.Web Security Space or Dr.Web Enterprise Security Suite. Other users can ask for help in the decryption of .THRSX files by uploading samples to Dr. Web Ransomware Decryption Service. Analyzing files will be performed free of charge and if files are decryptable, all you need to do is purchase a 2-year license of Dr.Web Security Space worth $120 or less. Otherwise, you don’t have to pay.

If you are infected with THRSX Ransomware and removed from your computer, you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually, you can do the following:

Use Stellar Data Recovery Professional to restore .THRSX files

1. Download Stellar Data Recovery Professional.
2. Click Recover Data button.
3. Select the type of files you want to restore and click Next button.
4. Choose the location where you would like to restore files from and click Scan button.
5. Preview found files, choose ones you will restore and click Recover.

Download Stellar Data Recovery Professional

Using Windows Previous Versions option:

1. Right-click on infected file and choose Properties.
2. Select Previous Versions tab.
3. Choose a particular version of the file and click Copy.
4. To restore the selected file and replace the existing one, click on the Restore button.
5. In case there are no items in the list, choose an alternative method.

Using Shadow Explorer:

1. Download Shadow Explorer program.
2. Run it, and you will see a screen listing of all the drives and the dates that shadow copy was created.
3. Select the drive and date that you want to restore from.
4. Right-click on a folder name and select Export.
5. In case there are no other dates in the list, choose an alternative method.

If you are using Dropbox:

1. Login to the Dropbox website and go to the folder that contains encrypted files.
2. Right-click on the encrypted file and select Previous Versions.
3. Select the version of the file you wish to restore and click on the Restore button.

How to protect computer from viruses, like THRSX Ransomware, in future

1. Get special anti-ransomware software

Use ZoneAlarm Anti-Ransomware

Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.

Download ZoneAlarm Anti-Ransomware

2. Back up your files

As an additional way to save your files, we recommend online backup. Local storage, such as hard drives, SSDs, flash drives, or remote network storage can be instantly infected by the virus once plugged in or connected to. THRSX Ransomware uses some techniques to exploit this. One of the best services and programs for easy automatic online backup is iDrive. It has the most profitable terms and a simple interface. You can read more about iDrive cloud backup and storage here.

3. Do not open spam e-mails and protect your mailbox

Malicious attachments to spam or phishing e-mails are the most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications and provides a very high level of anti-spam protection.

Download MailWasher Pro