Blower ransomware (Virus Removal Guide) - updated Feb 2019
Blower virus Removal Guide
What is Blower ransomware?
Blower ransomware is crypto malware that infects users with the help of cracks and keygens
Blower ransomware is data locking malware and one of the Djvu virus variants which on itself stems from STOP ransomware – one of the most prominent threats currently. Researchers believe that the infection originated in Ukraine, although there are also some accomplices from other countries. The malicious payload is usually injected with the help of illegal cracks and keygens,[1] usually downloaded from torrent sites. Blower virus uses AES cipher to lock data and appends .blower extension – the encryption process usually takes only a few seconds, so victims cannot do much to stop it. Databases, documents, pictures, and other data becomes inaccessible, and users are shown a _readme.txt note that explains what happened, and they are asked for a ransom of $490 in bitcoin for the file release. Bad actors also clarify that the amount doubles if the sum is not transferred within 72 hours of the infection. However, this variant might be decryptable, so there is no need to contacting hackers. Users reported that they managed getting infected with two ransomware viruses – Blower and GEFEST (a variant of Scarab) at the same time.[2]
| Name | Blower ransomware |
|---|---|
| Type | Cryptovirus |
| Associated | Djvu ransomware |
| Belongs to ransomware family | STOP ransomware |
| File extension | .blower |
| Ransom amount | $490 – $980 |
| Ransom note | _readme.txt |
| Related files | 1.exe, 2.exe, 3.exe, updatewin.exe, 8651.tmp. exe, hehjrebu.exe, install.exe, vsruwcaw.exe |
| Contact emails | blower@india.com; blower@firemail.cc |
| Decryption | Might be possible, contact security researcher for help |
| Distribution | Infected spam email attachments |
| Removal | Employ reputable anti-malware like Malwarebytes to remove Blower ransomware |
Cybercriminals who developed Blower ransomware suggest victims send one file for test decryption for free. But this action is done to create a fake sense of trust. We do not recommend trusting these people and contacting them in any way.
Also, note that Blower ransomware demands a huge amount and might not even consider restoring your data. The best solution for file recovery is data backups on external device or cloud services. If you are not sure that you have files you need, you can try data recovery software options that we suggest below the article.
Blower ransomware starts with an encryption process and uses the AES algorithm to change the original code of your files in various formats from photos, documents, video files to audio and archives or databases.[3] All encrypted data get .blower file marker and become unreadable.
The ransom note placement follows the encryption process when every folder on the machine gets _readme.txt. Blower ransomware ransom message reads the following:
ATTENTION! Do not worry my friend, you can return all your files! All your files are encrypted with the unique key. Decrypt tool for you. This software will decrypt all your encrypted files. What guarantees you have? You can send your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get a video of the decrypt tool: https://we.tl/t-1aaC7npeV9 Price is $ 980.
Discount 50% available if you contact us first 72 hours, that's price for you is $ 490.
Please note that you never restore your data without payment.
Check your e-mail address if you don’t get it more than 6 hours.
E-mail:
blower@india.com
Reserve e-mail address to contact us:
blower firemail.cc @
Your personal ID:
030GHsgdfT7878YsY9gsafL ***
You need to proceed with Blower ransomware removal and follow expert[4] suggested routine: terminate the virus using professional anti-malware tools and then clean the device using PC repair program like FortectIntego, recover your data using file backups or recovery software.
When you remove Blower ransomware using the automatic method you have the advantage of cleaning the system thoroughly. However, you need to double-check before any data recovery because ransomware can damage your device and encrypt files again if not terminated completely.
Avoid opening and downloading files attached to suspicious emails
Make sure to pay more attention to emails you receive without expectation and do not rush to open files attached to the email itself. You can risk getting cyber infections or malware that delivers direct ransomware on your device from the infected email attachment.
Email often contains executables, Word or Excel documents, PDFs and ZIP files as attachments and when you open the file on your computer, you get the option to enable content that includes malicious macros. When you allow those macros to run payload dropper gets activated, and your system is easily infected.
You can avoid this infiltration if you delete suspicious emails without opening and downloading the attachment. Pay attention to emails you receive and try scanning the file before downloading if you have any doubts.
Terminate the dangerous Blower ransomware virus automatically
The Blower ransomware removal process might be too hard to perform by using a manual technique. For this case, we suggest you download and install reliable computer software. We also offer using a tool such as FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes for finding malicious components in the computer system. Note that all hazardous content needs to be eliminated at once.
Remove Blower ransomware before you proceed with data recovery purposes. Make sure that you reboot your machine to Safe Mode or activate the System Restore feature as this way you will be able to deactivate the malicious activity. Later on, try some data recovery methods that we have displayed below this text. Perform each step as required to reach the best results.
Getting rid of Blower virus. Follow these steps
Manual removal using Safe Mode
Use Safe Mode with Networking to disable virus-related activities. Follow these steps to accomplish such goal:
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Blower using System Restore
Activating the System Restore feature might help you to stop the spreading of the ransomware infection. Follow these steps to complete the process:
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Blower. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove Blower from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.If you have spotted encrypted files on your computer, do not rush to make decisions. We suggest overthinking everything twice and evaluating every risk. Better try out our below-given data recovery methods and restore some of your files.
If your files are encrypted by Blower, you can use several methods to restore them:
The Data Recovery Pro tool might help you with your files:
Complete all these steps if you want to recover some of your files successfully.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Blower ransomware;
- Restore them.
Using ShadowExplorer might allow you to restore some data of yours:
Try using this tool as it might help you with data recovery purposes.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
No official decryptor has been released.
While no official tool has been released, you can contact security researcher Michael Gillespie – he might be able to help. Additionally, you can also try using STOPDecrypter created by the same security expert.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Blower and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important – recover your lost files
Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Djvu Ransomware Spreading New .TRO Variant Through Cracks & Adware Bundles. IBM. X-Force Exchange.
- ^ i am hit by 2 ransomware.. Bleeping computer. Official forums.
- ^ Advanced Encryption Standard. Wikipedia. The free encyclopedia.
- ^ LesVirus. Lesvirus. Spyware related news.