Hommy EXPOSED: .hommy Files, +README-WARNING+.txt, and an Outlook Inbox

You open Documents the way you did yesterday. The vacation photo should still be a simple 1.jpg. The invoice should still end in .pdf. The tax sheet should still end in .xlsx. Then the listing stretches. Each familiar name has a long extra stamp hanging off the end. A small text file whose name starts and ends with plus signs is sitting in the same folder, as if it has always belonged there.

The photo will not open. Spreadsheet software asks for a file that is still listed. The desktop image is not the one you left last night. A new wallpaper is waiting behind every window you minimize. The first instinct is to double-click the text file, because it is the only name that still looks like English.

That hour is the trap. This page is for that hour. It is not a miracle key. It is a map of the names in the folder, so the plus-signed flyer does not become your incident plan.

Overview

Hommy is a Makop-family locker. It locks the files first. Then it keeps the old name, hangs an ID in brackets, hangs an inbox in brackets, and finishes with .hommy. The published test rename is 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy. That string is the costume. You can still read 1.jpg. You cannot open it.

The second tell is the note. After the files are locked, the malware drops +README-WARNING+.txt into the same folders. The plus signs make the file sort to the top of a listing. README sounds like a help file. WARNING sounds like a safety notice. It is a storefront. The note says the files on your server are encrypted and stolen. It tells you to pay to decrypt those files and to stop a publish. It points at an Outlook inbox, privatehommy@outlook.com.

The third tell is the wallpaper. The desktop image changes so you cannot miss the flyer even if you never open the text file. The published wallpaper text is short: Your files were encrypted! Please contact us for decryption. Every time you minimize a window, that billboard is there. That is not a new technical step. It is the same storefront painted on the wall after the locksmith left.

Notice what the published sample does not give you. It does not print a $ figure. It does not fill in YOUR ID. The ID field in that note is blank. The only ID sitting in public is the one already stamped on the test filename, 2AF20FA3. This page will not invent a victim ID for you, and it will not invent a bill. If your copy of the note has an ID, that string is yours. The published sample does not hand one out as a quote.

That is the whole costume. A locked folder of .hommy names built like 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy. A plus-signed README. A wallpaper that says the files were encrypted and asks you to make contact. A leak line that says stolen, plus a pay-to-stop-publish squeeze. An Outlook inbox as the checkout. A blank YOUR ID in the published note. There is no public free decryptor known for this strain. There is no reason to write that inbox. There is no reason to pay a number they name after you arrive.

The .hommy stamp is the first warning

Most lockers pick a short ending so you notice the change in seconds. This family uses .hommy. Windows may now call the type a HOMMY File and offer a useless “choose an app” box. An app cannot talk locked bytes back into a JPEG. Double-clicking 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy does not open the photo. Spreadsheet software does not open a tax sheet that grew the same stamp. A video player does not open a family clip that grew it either.

The listing still has one object per file. The shock lands because the old name is still readable at the front. People sometimes think the disk died. The disk is usually fine. The contents were rewritten so only the attackers’ key can turn them back. Everyday programs fail in a boring way. The photo app shows a broken thumbnail. Accounting software asks for a file that is still sitting in the same folder, only the name is longer.

Do not treat that readable front as a fix. Do not strip .hommy off the end and expect Photos or Excel to open the file. Do not run a bulk “extension fixer” you found in an ad. The name is a label. The lock is in the content. Editing the label can make a later trusted tool have a harder time matching the file to what it was. Leave the locked copies as they are until you have a clean machine and a plan that does not start in an Outlook draft.

The long name is a billboard, not a receipt

Makop-family lockers like this one do not hide the original filename behind a random code. They keep the old name, then add two bracketed stamps, then add the custom ending. In the published test, that produces 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy. The first brackets hold an ID. The second brackets hold the inbox they want you to write. The ending holds the brand.

That shape is advertising. Anyone who sees the pile can quote the Outlook address back to you and sound like they already have your case. Anyone can quote 2AF20FA3 as if it were a ticket they issued. The ID in the filename is sitting in the folder. Quoting it proves they can read a listing. It does not prove they can unlock a JPEG.

The extra cruelty is how complete the name already looks. You can see the photo. You can see an ID. You can see a mailbox. You can see .hommy. A panicked first reading treats that as a filled-out form. It is not a form you submitted. It is a label the locker wrote after it finished the lock. Do not copy the inbox out of the filename “just to ask a question.” The filename already told you where the shop lives. Stay out of that shop.

+README-WARNING+.txt is a sales floor, not a help file

The note is a plain text file with a name that wants the first click. +README-WARNING+.txt looks like documentation that came with the lock. It did. It came with the lock the way a fake invoice comes with a fake shop. The plus signs push it to the top of a folder. README wants trust. WARNING wants urgency. Together they read like a safety card. They are a checkout flyer.

The file tells you the data on your server is encrypted. Then it adds stolen. Then it tells you to pay to decrypt the files and to stop a publish. Then it points at privatehommy@outlook.com. That order matters. Scare. Second scare. Price without a number. Door. There is no printed $ amount in the facts for this strain. There is no printed wallet. The missing number is not mercy. It lets the crew set a price after they see who writes.

Keep the file on disk. Then close it. Do not treat it as a set of steps you should follow. A README that has to shout WARNING in its own filename is not a recovery desk. It is a flyer dropped after a break-in. Saving a copy is useful. Following the inbox inside it is how a locked folder becomes a negotiation.

Encrypted and stolen is the second squeeze

The note does not stop at the lock. It claims the files on your server were encrypted and stolen. That second word is for people who already have backups. A backup can replace a photo. A backup cannot unsay a leak they claim they will use. The threat is meant to pull you into the Outlook inbox even when the folder is not your only copy. The pay-to-stop-publish line is the same squeeze in different clothes. It tells you the lock is only half the bill.

A leak claim can be true. Crews do steal mail, payroll, and scans before they lock files. A leak claim can also be a bluff copied from the last job. Either way, writing privatehommy@outlook.com does not give you a receipt that the copies were deleted. The CISA StopRansomware Guide is blunt about this kind of squeeze. Paying does not ensure the files come back, does not ensure the systems are clean, and does not ensure the data stays unpublished.

Do not try to settle the stolen line by sending a sample. A “worthless” file can still hold a client name, an address, or an internal path. You do not owe that inbox a test. You do not need their proof. If a trusted decryptor ever appears, it will come from a project like No More Ransom, not from an Outlook address that just landed in your Documents folder.

The Outlook inbox is the checkout

The contact printed with this strain is privatehommy@outlook.com. It sits in the filename. It sits in the note. That repetition is the product. The locker wants you to feel that the mailbox is already part of the case file, the way a real ticket number would be. It is not a help desk. It is the aisle they opened for themselves.

Outlook is a costume, not a comfort. A familiar mail brand makes the first reply feel like writing a vendor. It is not a vendor. There is no manager to escalate to when a key never arrives. There is no chargeback window on a conversation that exists to collect a payment. Keep the string as an identifier. Do not treat it as support.

Do not send a sample file to prove you are a real victim. Do not argue about a price that has not even been named yet. Do not ask whether YOUR ID should be filled in. Curiosity is how the storefront stays open. If a later helper quotes that same Outlook address and offers “the real wallet,” they are still selling the same aisle.

YOUR ID is blank in the published sample

Ransom notes like this one often leave a field labeled YOUR ID. The published sample left that field blank. That blank is not a kindness and it is not a puzzle you are supposed to solve. It is a hook. An empty required field is how a form tells you that you are not done. You sit with the feeling of being one string away from the vacation photo.

The filename already shows 2AF20FA3 in the published test. That is not a reason to type it into the note, mail it to Outlook, or invent a second ID because the field looks lonely. This page will not invent a victim ID. If your disk shows a different ID in the filename, that is your copy. If your note still shows a blank YOUR ID, leave it blank. Filling a criminal form is not progress.

Watch what the blank does to the next hour. You search the extension. You search the README name. You search the Outlook address. You open comment threads. Each of those places can plant a string and tell you to paste it. The note already taught your hands where a YOUR ID would go. That is the funnel. Scare, blank, paste, send.

The wallpaper is the same bill, only louder

After the files are locked, the desktop image changes. A text file can be ignored if you are busy trying to open the photo. A desktop cannot. The published wallpaper text is: Your files were encrypted! Please contact us for decryption. It does not print a $ figure. It does not fill YOUR ID. It does not even have to name the inbox, because the filename and the README already did. It only needs to keep the scare on the wall.

People waste the first hour on that picture. They screenshot it. They search every word on it. They change the image back and hope the files follow. The files do not follow. Put the wallpaper in the same mental box as +README-WARNING+.txt. Keep a copy if you need evidence. Then stop decorating the crime scene. Changing the picture back is fine for your nerves. It is not a repair. The lock does not live behind your icons. The lock lives in every .hommy file.

If you spend the evening hunting a “wallpaper remover” from a search ad, you are still shopping in the market this attack created. A tool that wants remote access to fix the desktop is not a desktop tool. The wallpaper is hurry-up. The checkout is still privatehommy@outlook.com.

This is not Hommys.shop, and it is not Cdd

An older MalwareTips write-up covered Hommys.shop, a scam store. That page was about a fake shop. It did not append .hommy to documents. It did not drop +README-WARNING+.txt. It did not paint a ransom wallpaper. It did not name privatehommy@outlook.com. If your only symptom is a checkout you do not trust, you are in that older story. A storefront and a locker can share a scrap of branding and still be different files.

Hommy also sits next to another Makop-family locker that uses .cdd and controldata2026@outlook.com. Same family. Same plus-signed README name. Same blank YOUR ID habit in the published sample. Different ending. Different Outlook inbox. If photos now look like 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy, you are in this campaign, not that one. Mixing the two wastes the first hour, because the mailbox you would write is the whole product.

If photos, invoices, and shares now look like that published .hommy rename, and a plus-signed README is sitting in those folders, you are not in the Hommys.shop story. You are not in the .cdd story either. This ransomware wants a payment and a conversation in Outlook. Treat the lookalikes as different files with a shared scrap of letters.

How The Scam Works

The shop is simple once you stop reading it as a rescue. Lock the files. Brand the names with an ID, an Outlook inbox, and .hommy. Drop +README-WARNING+.txt. Paint the desktop with Your files were encrypted! Please contact us for decryption. Claim the files on your server are encrypted and stolen. Tell the victim to pay to decrypt and to stop a publish. Leave YOUR ID blank in the published note. Wait for a scared person to write privatehommy@outlook.com and ask what it costs.

1. The lock keeps enough of the old name so you feel the loss

Hommy encrypts the files it wants as leverage, then writes the long Makop-style name. That is why 1.jpg is still readable inside 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy. The operators want you to inventory the damage in seconds. They want you to see the vacation photo, the invoice, the tax sheet, and the family video in one glance. A coded filename can confuse you. A readable filename makes you feel the theft.

The types that usually get hit are the ones people miss first. Pictures. Documents. Spreadsheets. Videos. Archives. System files may still boot. The browser may still open. That is not mercy. A machine that still turns on is a machine that can still display a wallpaper and still open Outlook.

If only one folder looks wrong, do not assume the rest of the disk is safe. Ransomware walks trees. It hits Documents, Desktop, Pictures, Downloads, and any drive letter it can reach, including a USB stick you forgot was plugged in. The note talks about files on your server because this family is happy to hit a share, not only a home PC. Unplug extra disks. Do not plug in the backup drive “just to check.” Checking is how the backup gets the same .hommy ending.

2. +README-WARNING+.txt turns a break-in into a shopping list

Once the names look wrong, the only file that still reads like a plan is the note. That is by design. A person who cannot open 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy will open the file that promises a warning. The filename does the first half of the sale before the body does any talking.

The body then does three jobs at once. It names the lock. It names the theft. It tells you the way back is a payment, a promise to stop a publish, and a mail to privatehommy@outlook.com. A note that starts with WARNING and ends with an inbox is not confused about its purpose. It is a flyer that borrowed a help-file title.

Keep that file. Screenshot it if you want a second copy. Do not follow it. The note is evidence. The Outlook address inside it is not a to-do list. The blank YOUR ID is evidence. This page will not fill that field for you so you can “just look.”

3. Encrypted and stolen does two jobs at once

Encrypted is the first lock. Stolen is the second. Together they close the two exits people reach for in the first hour. “I have a backup” is supposed to die on stolen. “I can live without those photos” is supposed to die on encrypted. The note wants both feelings in the same paragraph so the Outlook inbox looks like the only adult left in the room. Pay to decrypt. Pay to stop a publish. One mailbox for both bills.

You cannot audit a leak claim from the flyer. You cannot see whether a copy left the machine. You cannot see whether a copy will ever be posted. Writing the inbox does not settle that question. It only tells them you are the kind of victim who finished the page. The CISA StopRansomware advice has been consistent for years. Isolate. Keep the locked files. Look for clean backups. Do not start a relationship with the people who locked the disk.

If this is a company machine, stolen is also a legal sentence. Tell counsel and your incident lead before anyone “just emails them to see.” A first reply can become a recorded conversation you did not mean to start. If this is a home PC, tell the people whose files lived on it. Then stop feeding the inbox more of their names.

4. The Outlook inbox is the door they want you to walk through

The printed contact is privatehommy@outlook.com. That mailbox is an identifier for this campaign. It is not a support queue. There is no ticket you can escalate. There is no refund window. There is no manager who will honor a promise the note never even priced.

A first mail is how a quiet lock becomes a live customer. Do not send a “test” file. Do not send a screenshot of the wallpaper. Do not send 2AF20FA3 as if you were checking in. Do not ask what it costs. A missing $ figure is not an invitation to collect a quote. It is how they size you after they see your letterhead, your language, or your company domain.

If you already wrote that inbox before you found this page, stop there. Do not send more files. Do not pay a deposit to “hold the price.” Do not answer a follow-up that claims the stolen copies will go public at midnight. Urgency is the cheapest tool in this trade. A deadline in an Outlook thread is specific the way a fake shipping countdown is specific. The people who set it can wait, raise the number, or vanish.

5. A blank YOUR ID is still a hook

The published sample left YOUR ID empty. That empty field is doing sales work. It makes the first conversation feel necessary. You already have a filename that looks numbered. You already have an inbox. All that is left, the costume says, is to complete the form. Completing a criminal form is how you join their checkout.

Do not invent an ID because the box looks unfinished. Do not copy 2AF20FA3 from the published test into a mail as if that were your ticket. Do not let a later helper invent one for you and call it a case number. The published facts stop at a blank field. This page stops there too.

If your own note has an ID, treat that string as evidence, not as a password. Write it down on paper if you need it for a report. Do not type it back into Outlook. Do not paste it into a “recovery portal” a stranger built after they saw your screenshot. An ID in a ransom note is a tracking label for them. It is not a key for you.

6. The wallpaper keeps the bill on the wall

The wallpaper is the hurry-up layer. It repeats the scare so you do not have to open the README. Your files were encrypted! Please contact us for decryption. That is the whole published line. It sits behind every window. It turns a locked folder into a room you cannot leave. People hunt wallpaper removers. People restore an old desktop theme and think they made progress. The .hommy files are still locked. The Outlook inbox is still the checkout.

A search ad that promises to “remove Hommy wallpaper and unlock files” is a second shop standing in the doorway. Changing a picture does not decrypt a JPEG. A tool that wants remote access to fix the desktop is not a desktop tool. Keep a screenshot of the wallpaper if you still have it. Then put the real desktop back for your own sanity and move on to isolation, not to that inbox.

7. A second shop offers the same miracle

After a ransomware incident, search results and inbox ads fill up with companies that say they can decrypt Hommy or “all .hommy files.” Some of those shops are ordinary overpriced consultants. Plenty are a second scam. They will quote +README-WARNING+.txt so they sound close to the case. They will quote privatehommy@outlook.com. They will quote 2AF20FA3 from the published sample as if they issued it. They will ask for a sample file, a remote-access session, or a deposit.

The second scam has a friendly website and a case manager. It may even open one junk file, because anyone who is in contact with the original criminals can borrow the same demo. Then the price rises, the chat dies, or the remote tool installs more malware. A logo in a banner does not make them a rescue desk. A promise to beat a leak timer does not make them faster than the people who wrote stolen on the flyer.

A real public decryptor, when one exists, shows up on an official project page that already existed before your incident. The No More Ransom project is the place people check for those tools. It does not need a deposit. It does not need a YOUR ID you invent. It does not need privatehommy@outlook.com. If the pitch is “we can decrypt, pay us first,” you are still in the market the ransomware created. There is no public free decryptor known for this strain.

8. Payment closes nothing

Paying is not a guarantee. That sentence is not a slogan. It is the recorded experience of victims across ransomware families. The people who send the note can take the money and disappear. They can send a tool that only unlocks a few files. They can come back later and lock the same machine again. An Outlook inbox that exists to collect scared first mails makes that outcome easier, not harder. You cannot leave a review on a checkout like that.

The same access that delivered Hommy the first time can still be open. A payment teaches the operators that this victim pays. It does not close the hole that let them in. It does not give you a contract you can enforce. It does not unsay stolen. It does not stop a publish they already control. If someone later tells you that paying victims got everything back, ask for a public source that is not the person selling the key.

Official advice from No More Ransom and from CISA has been consistent for years. Isolate. Keep the locked files. Look for clean backups. Look for a trusted decryptor if one exists. Do not start a relationship with the people who locked the disk. A blank YOUR ID and a missing $ figure do not make this a smaller incident. They make the next step a conversation in Outlook. Refuse that conversation.

What To Do If Your Files End in .hommy

Do not write to privatehommy@outlook.com. Do not send a “test file” to that inbox. Do not ask for a price. Do not fill in YOUR ID because the published sample left it blank. Do not treat the wallpaper as a second set of orders. If you already opened the note before you found this page, stop there. Do not mail a sample. Do not pay a deposit to “hold the price.”

• STEP 1: Use Rkill to terminate suspicious programs.
• STEP 2: Use Malwarebytes to remove for Ransomware and Unwanted Programs
• STEP 3: Use HitmanPro to remove Trojans and other Malware
• STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware
• STEP 5: Perform a final check with ESET Online Scanner
• STEP 6: Restore the files encrypted by ransomware

STEP 1: Use Rkill to terminate suspicious programs.

In this first step, we will download and run Rkill to terminate suspicious programs that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Use Malwarebytes to remove Ransomware and Unwanted Programs

In this second step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 3: Use HitmanPro to remove Rootkits and other Malware

In this third step, while the computer is in normal back, we will download and run a scan with HitmanPro to remove Trojans, rootkits, and other malicious programs.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware

In this next step, we will use AdwCleaner to remove malicious browser policies and unwanted browser extensions from your computer.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 5: Perform a final check with ESET Online Scanner

This final step involves installing and running a scan with ESET Online Scanner to check for any additional malicious programs that may be installed on the computer..

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

STEP 6: Restore the files encrypted by ransomware

Unfortunately, in most cases, it’s not possible to recover the files encrypted by this ransomware virus because the private key which is needed to unlock the encrypted files is only available through the attackers. However, below we’ve listed three options you can use to try and recover your files.

Option 1: Search a decryption tool for this ransomware

The cybersecurity community is constantly working to create ransomware decryption tools, so you can try to search these sites for updates:

• https://id-ransomware.malwarehunterteam.com/
• https://decrypter.emsisoft.com/
• https://noransom.kaspersky.com/
• https://www.avast.com/ransomware-decryption-tools

Option 2: Use EaseUS Data Recovery Wizard Free to recover the encrypted files

EaseUS Data Recovery Wizard Free can restore files and repair corrupted files with simple clicks. Its powerful scanning algorithms can identify and retrieve huge file type library, including all of the popular video files, audio files, photos, and document formats.
While the free version only allows you to recover 2 GB of data, this can be helpful to see if the recovery is possible and restore back the most important files from your computer.

1. Download EaseUS Data Recovery Wizard Free.

   You can download EaseUS Data Recovery Wizard Free by clicking the link below.

   

   EASEUS DATA RECOVERY WIZARD FREE DOWNLOAD LINK
   (The above link will open a new page from where you can download EaseUS Data Recovery Wizard)

2. Double-click on the EaseUS Data Recovery Wizard Free setup file.

   When EaseUS Data Recovery Wizard Free has finished downloading, double-click on the setup file to install EaseUS Data Recovery Wizard on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow EaseUS to make changes to your device. If this happens, you should click “Yes” to continue with the EaseUS Data Recovery Wizard Free installation.

3. Follow the on-screen prompts to install EaseUS Data Recovery Wizard.

   When the EaseUS Data Recovery Wizard installation begins, click on the “Install Now” as seen in the image below.
   

   When your EaseUS Data Recovery Wizard installation completes, click the “Start Now” button to start the program.
   

4. Select a location to start recovering the encrypted files.

   Choose the drive or folder where you are the encrypted files that you want to recover and click “Scan“.
   

5. Wait for the EaseUS Data Recovery Wizard scan to complete.

   EaseUS Data Recovery Wizard will now scan your computer files that can be restored. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
   

6. Find the files you want to recover.

   When the EaseUS Data Recovery Wizard scan is finished scanning it will show a screen that displays the files that can be recovered. This tool can recover a lot of data, use the “Filter” button to quickly filter specific file types and find the files that you want to recover.
   

   Click the “Preview” button or double-click on a file for a full preview.
   

7. Select your files and click “Recover”.

   Finally, select the the files you want to recover and click “Recover“.
   
   Choose a safe location to save all the files.
   
   The free version only allow you to recover 2 GB of data, however, this will allow you to recover the most important files and see if EaseUS Data Recovery Wizard can correctly recover them.
   

Option 3: Try to restore your files with ShadowExplorer

This ransomware will attempt to delete all shadow copies when you first start any executable on your computer after becoming infected. Thankfully, the infection is not always able to remove the shadow copies, so you should continue to try restoring your files using this method.

1. Download ShadowExplorer.

   You can download ShadowExplorer from the below link.

   SHADOW EXPLORER DOWNLOAD LINK
   (This link will open a new web page from where you can download “ShadowExplorer”)

2. Install ShadowExplorer.

   Double-click on the ShadowExplorer-x.x-setup file to start the installation process, then follow the on-screen promts to install this program.
   

3. Select snapshot date.

   Open ShadowExplorer and then from the top bar select the drive where the files that you want to save are located, then select from the snapshot available one previous to this infection.

   

4. Export the files that you want to recover.

   Once you have found a copy of the original file or folder, right-click on it and the select “Export”. A window will prompt you where you want to save the file or folder.
   

Keep every .hommy name exactly as it is. Do not bulk-rename 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy back to 1.jpg. Do not strip the brackets, the Outlook address, or the .hommy ending off vacation photos, invoices, tax sheets, or videos either. Stripping the extra stamp is not a repair. It can make a later trusted tool worse, not better. The original name is already sitting at the front of the listing.

Keep +README-WARNING+.txt with the locked files. Keep a screenshot of the wallpaper if you still have it. Those two artifacts, plus the Outlook inbox in the filename, are how you prove this was this strain and not a different locker that only shares a scrap of letters. They are evidence. They are not instructions you should carry out. Changing the picture back is for you. It does not unlock a single file.

Do not run a third-party decryptor you found in an ad, a YouTube description, or a chat “recovery” channel. Leave the locked copies alone until a trusted project publishes a tool for this family. None is public now.

If a later message quotes privatehommy@outlook.com and offers “the real wallet,” that is still the same shop. If someone claims they can fill YOUR ID for a fee, they are selling the blank, not a key. If someone quotes 2AF20FA3 from the published test and calls it your case number, they read a folder listing. Do not answer. Do not complete their checkout. Do not help them set a $ figure the original note never printed.

If Windows still offers to pick an app for the .hommy type, decline it. There is no player for that ending. If you need to describe the incident, use the .hommy stamp, the published rename shape, +README-WARNING+.txt, the wallpaper line, the encrypted-and-stolen claim, the pay-to-stop-publish squeeze, and privatehommy@outlook.com. You do not need to invent a YOUR ID to be taken seriously. Report the crime through the CISA ransomware reporting page or the FBI IC3 desk if those paths fit where you live.

The Bottom Line

Hommy ransomware is a Makop-family locker with a long, readable filename and an Outlook inbox for a storefront. It keeps the old name, hangs an ID in brackets, hangs a mailbox in brackets, and finishes with .hommy. The published test is 1.jpg.[2AF20FA3].[privatehommy@outlook.com].hommy. The note is +README-WARNING+.txt. The desktop wallpaper repeats the same bill: Your files were encrypted! Please contact us for decryption.

The note claims the files on your server are encrypted and stolen. It tells you to pay to decrypt and to stop a publish. It points at privatehommy@outlook.com. The published sample leaves YOUR ID blank. There is no public $ figure to quote. There is no public free decryptor known for this strain. Hommys.shop is a different file, a scam store, not this locker. The sibling .cdd campaign uses a different Outlook inbox. It is not this locker either.

Do not pay. Do not write that Outlook inbox. Do not invent a victim ID to finish their form. Do not rename the pile in bulk. The wallpaper is the same bill. If you take one sentence with you, take this. A folder of names ending in .hommy, plus +README-WARNING+.txt and that Outlook address, is ransomware on the first sighting. Treat it that way before anyone in that inbox collects a first reply.