Hitler ransomware could penetrate the computer in many different ways, from an e-mail attachment to download from a malicious site. By itself, a virus consists of three files, each of which performs its function. They are called ErOne.vbs, chrst.exe and firefox32.exe. ErOne.vbs file starts immediately after penetrating the computer and performs a single function: it removes the names of the extensions from the names of all the files on your computer. It means, if you had a picture called \"Photo.jpg\", now it will be referred to simply as \"Photo\". Thereafter, the second file enters the game. Chrst.exe is responsible for displaying messages with ransom demands. This is very interesting message. It`s very simple, contains a minimum of text, and even in these few words hackers have managed to make a mistake ( \"ransonware\" instead of \"ransomware\"). Usually, in their ransom messages, hackers are talking about the pros of their creations, provide links to Wikipedia, to show the victim how strong is the encryption algorithm used by the virus. Here, everything is very simple. \"Your data was encrypted. Do you want to recover them? Then buy Vodafone card in denominations of E 25, and enter its code in the box below.\" Also there is the timer attached to the post, measuring off exactly one hour before the complete removal of files, and the famous historical photo of Hitler, throwing his nazi-greeting. You try to open any of your files, and find that there is no access to them. Neither the file does not open, and the user realizes that the files are really encrypted, and he needs something to do, and the time comes ... Most of the victims did not realize that there is no encryption, and that hackers are trying to trick to lure 25 Euro from you, and they don`t even try to do a little bit of serious work. Anyway, the payment of ransom will not change anything, and after one hour the data in any way will be removed from your computer. This is a job of a third file, called firefox32.exe. It is installed in the startup folder. After one hour, the message disappears, and 보안 instead there is a blue screen, talking about a critical system error. Thereafter, the user restarts the computer, and firefox32.exe file has priority when loading, removing all files from the computer at the time, as you can see the inscription \"Welcome\" on the screen.