How to remove Battlefield ransomware virus

Battlefield – another ransomware inspired by Hidden Tear open-source project

Battlefield is a file-encrypting virus that is based on HiddenTear ransomware project.^[1] It uses AES-256 algorithm and appends .locked file extension to each of the targeted files. Then it changes computer’s desktop saying “Oops! Your files have been encrypted!” – the same phrase has been used by WannaCry.

Then it drops a ransom demanding message in READ_ME.txt file where crooks tell that data encrypted by Battlefield virus can be restored only with specific decryption tool. Victims can buy it directly from cyber criminals for 50 USD in Bitcoins. Once users transfer the ransom to the provided BTC address, they need to send an email to alihacker8001@gmail.com with transaction code and user name:

Ooops! Your files have been encrypted.
Warning: Never change the file names and extensions and their location.
Send the transaction code and user name of the system and the date and time of the Ransomware to the following email.
You must send 50 USD to this address.
Decrypt your files after payment!
Buy Bitcoin with Credit Card and send to me: [xxx]
Address Mail:alihacker8001@gmail.com
BTC Address: [xxx]

Nevertheless, crooks demand quite a small sum of money; you should not risk and pay it. Creators of the Battlefield ransomware may not allow you to use decryptor. What is more, no one can assure that this tool is actually working. Thus, you should spend your money on reputable security tool that will wipe out malware from the PC and protect it from cyber threats in the future.

When Battlefield gets inside the computer, it also installs Battlefiled-Decrypter.exe file. Just like the name suggests, it’s an executable of the decryption tool. Once people pay the ransom, they are supposed to be able to use it in order to get rid of .locked file extension. However, as we have just mentioned, it may not happen.

At the moment of writing, there’s no free and safe method to restore corrupted files. However, it’s a brand new crypto-malware; thus, security experts may release official decryptor soon. Meanwhile, you should focus on Battlefield removal.

Elimination is necessary because the virus not only encrypts files but causes many changes on the system. It might affect legitimate Windows processes, delete or create new Registry entries, and install various malicious files. All these changes make the operating system vulnerable, and the computer becomes sluggish.

To remove Battlefield safely and get rid of all its related components, you have to employ a professional antivirus or malware removal tool. We recommend using FortectIntego and scanning the system with the help of it. At the third part of the article, you will find the explanation how to install and activate security program because malware might block access to it.

Cyber criminals use multiple distribution methods to spread the virus

Typically, ransomware enters the system when users clicks, opens or downloads an infected file. It might be an email attachment, link or ad. Battlefield distribution methods barely differs from over file-encrypting viruses’, so you should learn about ransomware distribution methods in order to avoid data loss.

The major ways how ransomware spreads:

• malicious email campaigns;
• malvertising;
• fake software updates;
• illegal downloads;
• exploit kits.

Most of the time malware executable is being spread as an obfuscated email attachment that includes some important information. Social engineering helps crooks to convince users to open an infected Word or PDF file that has a malicious code. Thus, you should never open a suspicious and unexpected email^[2] even if it was sent from the governmental organization or a well-known company.

Torrents, free file-sharing websites and similar sources often spread malicious programs. Thus, you should never install illegal programs or movies to avoid infiltration of malware. What is more, set automatic software updates. Keeping software updated prevents ransomware from exploiting security flaws and hijacking device.

Uninstall Battlefield virus from the computer using security tools

Battlefield removal must be completed using professional security software. According to experts from UtanVirus,^[3] regular computer users do not have proper skills to terminate file-encrypting virus manually. Only experienced IT specialists can do this job without damaging the system.

However, bringing your PC to the nearest computer service center is not necessary. You should install FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and remove Battlefield with the help of one of these malware elimination programs. The guidelines below will show you how to access your chosen security tool.