BigBobRoss ransomware (Virus Removal Guide) - Decryption Steps Included

BigBobRoss virus Removal Guide

What is BigBobRoss ransomware?

BigBobRoss ransomware is the cryptovirus that requires a ransom in Bitcoin to return encrypted files marked with .obfuscated appendix

BigBobRoss ransomwareBigBobRoss ransomware virus is the threat that affects various types of data on the targeted machine. Your photos, documents, audio or video files can get useless due to the encryption.

BigBobRoss ransomware is the cryptovirus that has a few versions actively spreading around the globe. It has also been named as Obfuscated ransomware, based on the file marker. The biggest damage caused by the virus is its encryption process which is launched against every file on the system. To inform the infected user about the damage made, malware also delivers a ransom note in the Read Me.txt file which requires using one of these;;; The virus was first spotted in January. However, more recent activity shows that the first variant was switched with other versions, including .djvu and .ecryptedALL. Remember that there is no need to pay the ransom or contact these people because it may lead you to data and money loss. Besides, keep in mind that most of the versions in this family can be decrypted, thanks to Emsisoft and Avast decrypters.[1]

Name BigBobRoss ransomware
Type Cryptovirus
File marker [id=unique_victims'_number]original_filename.obfuscated, .djvu, .ecryptedALL
Executable files BigBobRoss.exe; bedoneupx.exe
Contact emails
Encryption method AES-128
Removal Employ FortectIntego for BigBobRoss ransomware removal
Decryption You can find all the information on Emsisoft decrypter tool here

The initial BigBobRoss ransomware virus discovery was made on the second week of January, when malware researchers reported about the new ransomware sample. First two details about this threat were .obfuscated file extensions and ransom note file Read Me.txt.

At the time, BigBobRoss ransomware was called various names since developers haven't marked the name of their product as others do. Obfuscated was based on the file marker and BigBobRoss on the email shown in the ransom message.

BigBobRoss ransomware ransom note reads the following:

Hello, dear friend!
1- [All your files have been ENCRYPTED!]

Your files are NOT damaged! Your files are modified only.
The only way to decrypt your files is to receive the decryption program.
your files can not be decrypted without the special program we made it for your computer.


To receive the decryption program Write to our email “”
and tell us your unique ID


Free decryption as guarantee.
We guarantee the receipt of the decryption program after payment.
To believe, you can give us 1 file that must be less than 1MB and we decrypt it for free.
File should not be important to you! databases, backups, large excel sheets, etc.

4- [ Instruction ]

the easiest way to buy bitcoins is LocalBitcoins site. you have to register, click “buy bitcoins”
and select the seller by payment method and price.

please do not change the name of files or file extension if your files are important to you!
Your unique ID :

There was no relation to other ransomware families at the time, so BigBobRoss ransomware gained a new name in the cybersecurity world. Developers were silent for a while, but in March the new version with the same marker but new email addresses came out. Following that, the decryption tool was released for this virus.

BigBobRoss ransomware virusBigBobRoss ransomware is the cryptovirus that spreads around the world using spam email attachments. Fortunately, the virus can be decrypted.

When BigBobRoss ransomware developers released .encryptedALL and .djvu variants, researchers were expecting this reaction from cybercriminals.[2] Often after the decryptor developers make a new version to compensate. The notorious GandCrab is one of many examples.[3]

You should remove BigBobRoss ransomware from the machine as soon as possible. The best tip for the process from experts[4] is to get the anti-malware program and clean the system thoroughly. You should use FortectIntego or a similar program and perform a system scan to delete all possible threats.

Although there are a few methods of BigBobRoss ransomware removal or even a few decryption tools, the system should be entirely virus-free so that the user can work on the machine regularly. Remember that ransomware alters various system programs or functions to keep persistent.

For this reason that BigBobRoss ransomware alters system settings, we recommend rebooting the machine in Safe Mode with Networking before scanning the system with anti-malware program. This way all cyber threats can be found since the program is not disabled or blocked by the virus.

Email spam gets used to infect targeted computers with ransomware

The primary method used to spread ransomware is the email spam that delivers infected attachments on safe-looking emails named as financial notifications from known companies, services or even software providers. Emails may contain a direct link to downloading page or a document attachment.

Spam emails often pose as sent from DHL, eBay or any other commonly used website that may send invoices or receipts. This way virus developers mask the real purpose of the message – delivering the malware. Once you download the file automatically or click on the Enable content button in the document, malicious macros lands on the system.

You should avoid clicking on emails with grammar mistakes or different suspicious content because those emails with red flags often contain malicious script or programs. Delete emails received out of nowhere and check the email box more often to clean unwanted material.

Terminate BigBobRoss ransomware and avoid infections in the feature

The best tip that security experts give to users is to keep their software updated and employing a reputable antivirus program. For the best BigBobRoss ransomware removal results, you should also employ the anti-malware tool and scan the system entirely.

This way you can remove BigBobRoss ransomware and get rid of all associated files or programs at the same time. The application indicates possibly dangerous programs and suggests removing them by following some simple steps. Use FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes for this job.

When BigBobRoss ransomware virus is terminated, you can get back to the safe and secure computer, browse online without risk and replace encrypted files using data backups. Also, you can find a decryption tool below.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of BigBobRoss virus. Follow these steps

Manual removal using Safe Mode

Get rid of BigBobRoss ransomware by entering the Safe Mode with Networking and removing all potential threats:

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):


After you are finished, reboot the PC in normal mode.

Remove BigBobRoss using System Restore

System Restore is the feature helpful in virus removal when the whole system is affected:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of BigBobRoss. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that BigBobRoss removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove BigBobRoss from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

If your files are encrypted by BigBobRoss, you can use several methods to restore them:

Data Recovery Pro is the program designed to restore files after virus attack

This program is a great alternative for data backups since not everyone has the needed files backed up

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by BigBobRoss ransomware;
  • Restore them.

Windows Previous Versions is the method for file recovery

This is a useful solution when System Restore gets enabled

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer is the file restoring tool

If BigBobRoss ransomware affected Shadow Volume Copies, ShadowExplorer could not work

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Decrypter for BigBobRoss ransomware

You can find all the information on Emsisoft decrypter tool here

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from BigBobRoss and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting ransomware

Stream videos without limitations, no matter where you are

There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.

Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.

Data backups are important – recover your lost files

Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.

While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.

About the author
Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Ugnius Kiguolis
About the company Esolutions