What is BWall ransomware? And how does it carry out its attack?
BWall ransomware is one of the latest crypto-viruses discovered at the end of September 2019. This new crypto-virus adds a “.bwall” extension to every file it corrupts. Just like other ransomware threats, BWall ransomware can leave your files useless and inaccessible once it carries out its attack. It starts its attack by dropping its payload file in the system which will be followed by its other malicious components.
After it places its malicious components in system folders, BWall ransomware will modify the Windows Registry so that it can resume its attack every time a victim turns on the infected computer. It also launches and represses system processes making it a persistent threat. Aside from that, it also employs data gathering module and stealth protection module. The first module is used to obtain information from the computer that will be used for the next module. The second module is used to prevent any security and antivirus programs from interrupting the attack.
Once the system modifications are completely implemented, BWall will start encrypting its targeted files using a combination of AES and RSA ciphers. Once the encryption is completed, it attaches the “.bwall” suffix to every affected file and opens its ransom note named “HOW_DECRYPT_FILES.txt” that states:
“Your files are encrypted!
Your files (documents, pictures, audio files, source codes) were encrypted with
combination of AES-256 and RSA-4096 cryptographic algorithms. your files will
not be deccryptable, without our specia decryption service; futhermore, there is
an condition that will leave your files encrypted forever if it’s not met:
there is a deadline to pay for your data! If that is exceeded, we will not let you
decrypt your data (we will not offer any kind of service). You have exactly two weeks
to decrypt your data! No recovery tool will help you, such as Recuva, and no Microsoft
feature will help (shadow Copies>. Files with “.bw” extension are encrypted. verify.
The current date time was inserted into the ID, and we can guess every patching attempt.
End of the deadline: HU-HU-HAI
To pay for your files, follow these steps :
1) Set-up a BitCoin account. we cannot help you in that, but you can search on
Google or similar for “bitcoin get started” or “bitcoin help”. You can skip
this step, if you have already one; we also accept Monero as currency, and we’ll
give a discount if an anonymous currency like that is used (20%). Do the same
research to set-up a Monero account if you don’t have one, as well.
2) send the following amount of money (0,018 BTC) to the following Bitcoin address,
and keep the TXID (payment \ transaction ID) for later:
1P7VBy5YLBRXxNiTjJBCQUEzyr yZEcfdQwGD
Monero address, for “getting a discount”:
44NMuci8TSUI4TBafyJpQDAHjTEStCObXwAVmB31mJiaCZFGxotyfZ5LW83VQYdHKM5DG313aFsw7fjnc8ga9JBk6bwAuHa
3) after, send this file and the TxID of before to the following e-mail address, with
the subject “Decryption” and with a e-mail address that can receive e-mails at every
moment; don’t use temporary services, we will reply after six hours at least:
[email protected]
4) wait, you will get an e-mail with even more istructions, and, the decryptor.
Don’t rename, modify, or try to decrypt your files without our special service.
Don’t modify this text file! Don’t make decryption impossible even for us.
ID: KILL-ID
Don’t modify the ID! Remember, any bad words to our side will make your address banned!
Also, please, don’t try to patch or decompile the decryptor once you get it, it doesn’t
contain the private key of the encryption algorithm.”
Paying the ransom should not be part of your recovery solution as there really is no guarantee that the crooks behind BWall ransomware will do their end of the bargain once they receive the ransom payment. Usually victims of ransomware threats are ignored by crooks that had successfully deceived them into paying the ransom.
How does BWall ransomware proliferate?
It isn’t clear yet how exactly BWall ransomware proliferate but it could be using one of the most common distribution method of ransomware threats like malicious spam email campaigns that might contain a .docx file attachment with macro scripts. This macro-enable document is the one who will connect the system into the Command and Control server of BWall ransomware. Because of this, you need to be careful when opening any kinds of email from your inbox as it might contain a malicious file that could be used to install threats like BWall ransomware into your computer.
Using the removal guide provided below, obliterate BWall ransomware from your computer and all of its malicious components.
Step_1: Close the ransom note of BWall ransomware and end its malicious processes via Task Manager. To open it, tap Ctrl + Shift + Esc keys on your keyboard.
Step_2: Under the Task Manager, go to the Processes tab and look for any suspicious-looking process that takes up most of your CPU’s resources and is most likely related to BWall ransomware.
Step_3: After that, close the Task Manager.
Step_4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Programs and Features under Control Panel.
Step_5: Under the list of installed programs, look for BWall ransomware or anything similar and then uninstall it.
Step_6: Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step_7: Navigate to the following locations below and look for BWall ransomware’s malicious components such as HOW_DECRYPT_FILES.txt, [random].exe and other suspicious files, then delete all of them.
- %TEMP%
- %WINDIR%\System32\Tasks
- %APPDATA%\Microsoft\Windows\Templates\
- %USERPROFILE%\Downloads
- %USERPROFILE%\Desktop
Step_8: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use Restoro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then by all means go on to the next steps.
Step_9: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.
Step_10: Navigate to the following path:
- HKEY_CURRENT_USER\Control Panel\Desktop\
- HKEY_USERS\.DEFAULT\Control Panel\Desktop\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Step_11: Delete the registry keys and sub-keys created by BWall ransomware.
Step_12: Close the Registry Editor and empty the Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if BWall ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.
Congratulations, you have just removed BWall Ransomware CryptoMalware in Windows 10 all by yourself. If you would like to read more helpful articles and tips about various software and hardware visit fixmypcfree.com daily.
Now that’s how you remove BWall Ransomware CryptoMalware in Windows 10 on a computer. On the other hand, if your computer is going through some system-related issues that have to get fixed, there is a one-click solution known as Restoro you could check out to resolve them.
This program is a useful tool that could repair corrupted registries and optimize your PC’s overall performance. Aside from that, it also cleans out your computer for any junk or corrupted files that help you eliminate any unwanted files from your system. This is basically a solution that’s within your grasp with just a click. It’s easy to use as it is user-friendly. For a complete set of instructions in downloading and using it, refer to the steps below
Perform a full system scan using Restoro. To do so, follow the instructions below.
