Blower ransomware (Virus Removal Guide) - updated Feb 2019

Blower virus Removal Guide

What is Blower ransomware?

Blower ransomware is crypto malware that infects users with the help of cracks and keygens

Blower ransomwareBlower ransomware is a file locking infection which encrypts data such as images, audio, video, databases, excel sheets, etc.

Blower ransomware is data locking malware and one of the Djvu virus variants which on itself stems from STOP ransomware – one of the most prominent threats currently. Researchers believe that the infection originated in Ukraine, although there are also some accomplices from other countries. The malicious payload is usually injected with the help of illegal cracks and keygens,[1] usually downloaded from torrent sites. Blower virus uses AES cipher to lock data and appends .blower extension – the encryption process usually takes only a few seconds, so victims cannot do much to stop it. Databases, documents, pictures, and other data becomes inaccessible, and users are shown a _readme.txt note that explains what happened, and they are asked for a ransom of $490 in bitcoin for the file release. Bad actors also clarify that the amount doubles if the sum is not transferred within 72 hours of the infection. However, this variant might be decryptable, so there is no need to contacting hackers. Users reported that they managed getting infected with two ransomware viruses – Blower and GEFEST (a variant of Scarab) at the same time.[2]

Name Blower ransomware
Type Cryptovirus
Associated Djvu ransomware
Belongs to ransomware family STOP ransomware
File extension .blower
Ransom amount $490 – $980
Ransom note _readme.txt
Related files 1.exe, 2.exe, 3.exe, updatewin.exe, 8651.tmp. exe, hehjrebu.exe, install.exe, vsruwcaw.exe
Contact emails blower@india.com; blower@firemail.cc
Decryption Might be possible, contact security researcher for help
Distribution Infected spam email attachments
Removal Employ reputable anti-malware like Malwarebytes to remove Blower ransomware

Cybercriminals who developed Blower ransomware suggest victims send one file for test decryption for free. But this action is done to create a fake sense of trust. We do not recommend trusting these people and contacting them in any way.

Also, note that Blower ransomware demands a huge amount and might not even consider restoring your data. The best solution for file recovery is data backups on external device or cloud services. If you are not sure that you have files you need, you can try data recovery software options that we suggest below the article.

Blower ransomware starts with an encryption process and uses the AES algorithm to change the original code of your files in various formats from photos, documents, video files to audio and archives or databases.[3] All encrypted data get .blower file marker and become unreadable.

Blower virusBlower virus - ransomware which appears in the system after opening a hazardous attachment or visiting an infected website

The ransom note placement follows the encryption process when every folder on the machine gets _readme.txt. Blower ransomware ransom message reads the following:

ATTENTION! Do not worry my friend, you can return all your files! All your files are encrypted with the unique key. Decrypt tool for you. This software will decrypt all your encrypted files. What guarantees you have? You can send your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get a video of the decrypt tool: https://we.tl/t-1aaC7npeV9 Price is $ 980.

Discount 50% available if you contact us first 72 hours, that's price for you is $ 490.
Please note that you never restore your data without payment.
Check your e-mail address if you don’t get it more than 6 hours.
E-mail:
blower@india.com
Reserve e-mail address to contact us:
blower firemail.cc @
Your personal ID:
030GHsgdfT7878YsY9gsafL ***

You need to proceed with Blower ransomware removal and follow expert[4] suggested routine: terminate the virus using professional anti-malware tools and then clean the device using PC repair program like FortectIntego, recover your data using file backups or recovery software.

When you remove Blower ransomware using the automatic method you have the advantage of cleaning the system thoroughly. However, you need to double-check before any data recovery because ransomware can damage your device and encrypt files again if not terminated completely.

Avoid opening and downloading files attached to suspicious emails

Make sure to pay more attention to emails you receive without expectation and do not rush to open files attached to the email itself. You can risk getting cyber infections or malware that delivers direct ransomware on your device from the infected email attachment.

Email often contains executables, Word or Excel documents, PDFs and ZIP files as attachments and when you open the file on your computer, you get the option to enable content that includes malicious macros. When you allow those macros to run payload dropper gets activated, and your system is easily infected.

You can avoid this infiltration if you delete suspicious emails without opening and downloading the attachment. Pay attention to emails you receive and try scanning the file before downloading if you have any doubts.

Blower ransomware infectionMany AV engines recognize the payload as malicious. Make sure to install security software in order to prevent dangerous Blower ransomware infection

Terminate the dangerous Blower ransomware virus automatically

The Blower ransomware removal process might be too hard to perform by using a manual technique. For this case, we suggest you download and install reliable computer software. We also offer using a tool such as FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes for finding malicious components in the computer system. Note that all hazardous content needs to be eliminated at once.

Remove Blower ransomware before you proceed with data recovery purposes. Make sure that you reboot your machine to Safe Mode or activate the System Restore feature as this way you will be able to deactivate the malicious activity. Later on, try some data recovery methods that we have displayed below this text. Perform each step as required to reach the best results.

Offer
do it now!
Download
Fortect Happiness
Guarantee
Download
Intego Happiness
Guarantee
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of Blower virus. Follow these steps

Manual removal using Safe Mode

Use Safe Mode with Networking to disable virus-related activities. Follow these steps to accomplish such goal:

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
    Settings
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
    Reboot
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.
    Startup

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Downloads
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):

    %AppData%
    %LocalAppData%
    %ProgramData%
    %WinDir%

After you are finished, reboot the PC in normal mode.

Remove Blower using System Restore

Activating the System Restore feature might help you to stop the spreading of the ransomware infection. Follow these steps to complete the process:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Blower. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that Blower removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Blower from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If you have spotted encrypted files on your computer, do not rush to make decisions. We suggest overthinking everything twice and evaluating every risk. Better try out our below-given data recovery methods and restore some of your files.

If your files are encrypted by Blower, you can use several methods to restore them:

The Data Recovery Pro tool might help you with your files:

Complete all these steps if you want to recover some of your files successfully.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Blower ransomware;
  • Restore them.

Using ShadowExplorer might allow you to restore some data of yours:

Try using this tool as it might help you with data recovery purposes.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

No official decryptor has been released.

While no official tool has been released, you can contact security researcher Michael Gillespie – he might be able to help. Additionally, you can also try using STOPDecrypter created by the same security expert.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Blower and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting ransomware

Stream videos without limitations, no matter where you are

There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.

Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.

Data backups are important – recover your lost files

Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.

While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.

About the author
Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions

References