Bucbi Ransomware virus (Virus Removal Instructions)

What is Bucbi Ransomware virus?

Beware: Bucbi ransomware attacks again

The family of Bucbi ransomware was discovered in 2014; however, it seems that cyber criminals who have developed Bucbi virus have decided to revive this computer threat again. This updated variant of Bucbi malware does not need to use an Internet connection once it reaches the compromised computer. It begins the encryption process, taking all victim’s files hostage. Unfortunately, it is unknown what crypto-algorithm Bucbi uses to encrypt victim’s data. Once it finishes the encoding procedure, it creates README.TXT file and drops it on the desktop. This file, which can be called a ransom note, states:

We are members of Ukrainian Right Sector.
You are taking money worldwide until we are fighting with world’s evil into the East of our Motherland.
To decrypt the files you need to obtain a private key.
You have to transfer 5 BTC into the out account […] for us.
Also you have to send message for us to e-mail: dopomoga.rs@gmail.com.
After it you’ll get the crypto key for decrypt your files.
Regards.
Your defenders.

As you can see, the cyber criminals who have created this malware claim that they are members of Ukrainian Right Sector, which is a far-right Ukrainian nationalist political party. While some researchers claim that the “Right Sector” might be trying to fund their needs by spreading ransomware, we highly doubt that it is true. We assume that this virus is created by criminals who just use the name of “Right Sector” to scare computer users and urge them to pay the ransom immediately. The Bucbi ransom cost, which is equal to 5 Bitcoins (2300.25 USD), is an exceedingly high comparing to other ransomware variants. We do not recommend you to pay it because you can never know whether cyber criminals are going to provide you with the decryption software or not. If your computer has been infected with Bucbi ransom virus, we strongly recommend you to remove it from your system using a malware removal tool like FortectIntego.

How does Bucbi malware spread?

Bucbi virus seems to spread in other ways than the majority of ransomware-type viruses do. Bucbi ransomware infiltrates victims’ computers via RDP brute force attacks. Reportedly, crooks who have developed Bucbi use “RDP Brute (coded by z668)” tool, which is intended to guess the right login and password of the target computer. There are several ways how to protect your machine from brute force attacks. You can adjust Local Security Policy and make your computer lock itself after someone enters an invalid logon info several times in a row. Another suggestion is to use a strong password (including uppercase and lowercase letters and also numbers) for your device.

It seems that Bucbi does not spread the way other ransomware viruses do, however, we would like to warn you and inform you how to prevent ransomware attacks in general. Cyber criminals often spread these viruses via scam emails, so we advise you to check whether you know the sender of email before opening it. Commonly, frauds send malicious files concealed as notifications from banking institutions, law enforcement agencies, or well-known companies. Unfortunately, cyber criminals are so advanced nowadays that they can insert malicious codes into legitimate websites, so you can end up installing malware after a single click on an infectious ad, button, or link. The only way to prevent such clickjacking attacks is to secure your PC with anti-malware software that can ensure real-time protection.

As we have already suggested, you can use FortectIntego to remove Bucbi automatically. In case you want to uninstall this ransomware manually, follow Bucbi removal instructions that are given on page 2.

How to remove Bucbi ransomware and recover your files?

Bucbi virus a noxious computer threat, which leaves no hope to recover files without a special decryption key. However, before you decide to pay more than 2300 dollars for cyber criminals, consider whether your files are worth such big sum of money. Besides, remember that cyber criminals have the freedom to choose whether they want to give you the decryption key or not. Therefore, they might just steal your money and forget about you. The only way to recover files after a ransomware-type virus encrypts them is to import them from a backup, of course, if you had one. If you did, you have to implement Bucbi removal and then plug the backup device into your computer. Take note that you must remove the virus BEFORE you plug the storage device into the computer; otherwise, the virus will encrypt all files stored on the device, too. As we have already mentioned, you can eliminate Bucbi malware automatically with a help of SpyHunter, but if you want to, you can uninstall this malware using Bucbi removal instructions provided below.