Blm ransomware (Virus Removal Guide) - Decryption Methods Included
Blm virus Removal Guide
What is Blm ransomware?
Blm ransomware is a Dharma family cryptovirus that encrypts all files and demands money from its victims
Blm ransomware is malware that belongs to the widely known Dharma[1] ransomware family and became active in September 2020. It is similar to other analogs because it encrypts[2] user data with AES+RSA algorithm. If the victim wants to recover files, this virus demands a ransom in Bitcoin currency for the decryption.
Blm ransomware encrypts various files: pictures, videos, audio records, documents, etc. During the encryption process, all infected files get new .Blm extension and users can't open any of them.
Once encryption is done, the victim not only gets a text file named “FILES ENCRYPTED.txt” but also sees a pop-up window. Both of these serve exactly the same purpose, however – they explain that victims need to contact them via blacklivesmatter@qq.com and pay bitcoins for the decryption tool that could allegedly allow them to regain access to files.
| Name | Blm ransomware |
| Family | Dharma family |
| Type | File locking virus, cryptovirus, ransomware |
| Distribution | This malware comes from spam, infected email attachments, torrent websites, malicious ads, etc. |
| Issues | This virus is using an encryption algorithm to lock all personal data on the infected device. The victim can't open any encrypted file and cybercriminals demands to pay the ransom for the decryption |
| File extension | Each of the files gets .Blm extension. They are encrypted and cannot be opened or used without decryption |
| Ransom note | A file named FILES ENCRYPTED.html is dropped for victims to inform about virus behavior and possible steps to this problem. Also, the victims see a pop-up window. Hackers state that the only solution is to pay the ransom |
| File recovery | Data recovery might be impossible if you don't have backups but in some cases, official decryption tools or third-party programs recovery software can help |
| Malware removal | Remove Blm ransomware by scanning your device with a powerful anti-malware application. |
| System fix | Ransomware or other threats sometimes can cause serious damage to your device OS. In some cases, you will even need to reinstall it. To avoid that, we recommend fixing the virus damage with FortectIntego repair software |
The biggest misconception that victims have after being infected is that they can remove Blm ransomware extension and access their data again. Unfortunately, it is not the case, as a unique decryption key is required, and it is being held hostage by the attackers. While there is no guarantee to recover data without backups, we provide alternative solutions for data recovery below. Nonetheless, we recommend using SpyHunter 5Combo Cleaner or Malwarebytes for the elimination of the infection and then fixing virus damage to the Windows system with repair tools such as FortectIntego.
As soon as the .Blm virus changes Windows settings and injects malicious entries, it delivers the ransom note. The text message that can be opened with Notepad or similar program explains:
'all your data has been locked us
You want to return?
Write email blacklivesmatter@qq.com.'
More information is presented in the pop-up window. Victims see a message with an e-mail address and recommendation to resend the letter to a different e-mail if they didn't receive a reply within 12 hours. While the ransom should be paid in Bitcoin cryptocurrency, the ransom size is not specified and depends on the various factors.
Also, cybercriminals try to lure victims to pay the ransom with decryption testing. Hackers will successfully decrypt up to 5 files if they are no bigger than 1MB and are not valuable (they won't help for large Excel sheets, backups, etc.). They send these files back to the victim of Blm ransomware because they want to demonstrate that the decryption is indeed possible.
The pop-up message also warns that the renaming corrupted files or/and trying to decrypt them with other tools won't help and the victim may lose all data permanently. The Blm virus ransom text displayed in the pop-up window looks like that:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail blacklivesmatter@qq.com
Write this ID in the title of your message –
In case of no answer in 24 hours write us to these e-mails:blacklivesmatter@qq.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as a guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Criminals want your money but paying is not recommended
Unfortunately, in many cases, the cybercriminals are correct by saying that the only possible way to decrypt files is by paying hackers. But the recovery might be still possible if the virus has significant flaws. Also, the victim can recover important data if he/she has backups. Even if your computer is infected and you don't have your data backed in online servers or in other devices, cybersecurity experts[3] recommend against paying the criminals behind .Blm file virus.[4]
In some cases, victims still do not receive decryption tools even after the money transfer. So, users not only lose their files but money too. We recommend having backups, relying on reliable programs, and performing Blm ransomware removal instead.
Moreover, you should be very careful on the internet if you don't want to catch new ransomware in the future. In most cases, ransomware comes through spam campaigns, trojans, fake updaters, illegal activation tools, etc. You should avoid dubious downloads channels and always think before the installation of any new software. Untrustworthy sources like to contribute to spreading infections.
Remove Blm ransomware and rely on file-recovery options
If your device is infected we recommend you remove Blm ransomware. If you don't want to do it manually, you should use anti-malware software like such as SpyHunter 5Combo Cleaner or Malwarebytes. A reliable program will help you to detect and delete all threats on your computer.
Only after the Blm ransomware removal, you may try to recover your data from backups. But ransomware or other infections sometimes can cause serious damage to your computer OS. In some cases, you will even need to reinstall it. To avoid such inconvenient things to happen, we recommend fixing the Blm virus damage with FortectIntego repair tool.
After you remove Blm ransomware, you may try to recover your files. We recommend using the free decryption tool, third-party recovery solutions, or checking whether the automatic Windows backups were not deleted. Unfortunately, if none of the steps below help, there is no other way to recover encrypted data.
Getting rid of Blm virus. Follow these steps
Manual removal using Safe Mode
You should access Safe Mode with Networking and perform the scan from there
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Blm using System Restore
System Restore is the feature that allows recovering the system to a previous state based on the time
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Blm. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove Blm from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.If your files are encrypted by Blm, you can use several methods to restore them:
Data Recovery Pro option
Data Recovery Pro might be useful when trying to retrieve data encrypted by Blm ransomware.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Blm ransomware;
- Restore them.
Windows Previous Versions Feature might be of use
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
ShadowExplorer – feature recovering files
You can rely on ShadowExplorer when Shadow Volume Copies are not damaged by the Blm ransomware.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
Ufortunatelly, decryption might be impossible
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Blm and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Protect your privacy – employ a VPN
There are several ways how to make your online time more private – you can access an incognito tab. However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of Private Internet Access VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise. Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and Private Internet Access VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers – human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence. In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. Data Recovery Pro is one of the leading file recovery solutions you can find on the market – it is likely to restore even lost emails or data located on an external device.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Jake Doevan. Dharma ransomware goes rampant during the summer of 2020 – tens of new variants released during June and July. 2-Spyware. Security and spyware news.
- ^ Encryption. Wikipedia. The Free Encyclopedia.
- ^ Virusai. Virusai. Security and spyware news.
- ^ Larry Dignan. Ransomware attacks: Why and when it makes sense to pay the ransom. ZDNet. News articles.