How to remove Bomber ransomware

Bomber ransomware — a virus that locks your files with the .hitler or .bomber extension and demands to pay the ransom

Bomber ransomware is a virus that encrypts your files secretly and then demands the ransom for the decryption. Although, this alleged decryption tool might not even exist. This virus is the variant of the Scarab ransomware and focuses on the Russian-speaking users, so the ransom note is not in English. After the encryption, files get “.bomber” or .”hitler” extension and this makes them useless. “HOW recover encrypted FAYLY.TXT” or “HOW TO RECOVER ENCRYPTED FILES.TXT” file is placed on every existing folder the minute this data got encrypted. Crooks urge a particular ransom in Bitcoin^[1] and suggest contacting them via s29js31@tutamail.com, s29js31@mail.ee email addresses. Moreover, you can recognize this dangerous virus from the malicious file named Сентябрь.scr, which means “September”.

Bomber ransomware^[2] has no preference for the encrypted files. Images, photos, videos, archives, documents or text files can be modified. This file encryption makes your data useless, and the only way to get the access back is file decryption or recovery from the external backup. 

However, authors of Bomber virus wants to give victims a data recovery solution. However, it's shady and security specialists do not recommend trying it. Once malware encrypts all files, it delivers recovery instructions in the text file. Typically ransom messages contain information like:

• ransom amount;
• preferred cryptocurrency;
• contact emails;
• ransomware name;
• identification of the victim;
• instructions for the payment;
• time period for the payment;
• encryption method;
• possibility to test decrypt files.

Bomber ransomware virus after the encryption creates HOW recover encrypted FAYLY.TXT file where the following information is provided:

Your files are encrypted!Your personal ID [redacted].. your documents, images, databases and other important data has been encrypted. For data recovery needs interpreter. To get the interpreter should send an email to soft2018@tutanota.com ( soft2018@mail.ee , newsoft2018@yandex.by ) In a letter to indicate your personal identifier (see. In the beginning of this document). When contacted via e-mail does not work * Sign up for http://bitmsg.me site (online service dispatch Bitmessage)

As you can see in translated ransom note quote, Scarab-Bomber ransomware gave no information about the ransom amount or term, but the test decrypt is suggested. This could be done on your selected three files that you need to send for the people. Also multiple email addresses. Although, we do not recommend to contact these cybercriminals in any way.

 * Write a letter to the BM-2.. address with your address and 
personal ID 
Next, you need to pay for the interpreter. In a response letter you will receive the address of 
Bitcoin-wallet, which is necessary to perform the transfer of funds and the amount of payment. 
If you have bitcoins 
 * Create a Bitcoin wallet: https://blockchain.info/ru/wallet/new 
 * Get cryptocurrency Bitcoin: 
   https://localbitcoins.com/ru/buy_bitcoins (via Visa / MasterCard, QIWI Wallet via Visa and others. ) 

Virus developers created a whole guide for the people to create the wallet so victims could pay the demanded ransom. But even this activity can be dangerous and lead to no positive results. If you are new to cryptocurrency^[3] and cybercrimes, you should be tricked by this data recovery offer provided by creators of Scarab-Bomber virus.

You better remove Bomber ransomware and not contact them. Do not pay the ransom either. This can be not helpful at all and possibly lead to money loss. Focus on virus elimination and then and only then think about data recovery. While virus resides on the computer, the system is vulnerable and you might not be able to use your PC safely.

The best solution when it comes to Scarab-Bomber removal is anti-malware tools like FortectIntego. Only professional security software can remove all the remaining pieces of virus from the system. We recommend scanning your computer repeatedly for later infection avoidance.

Spam email attachments filled with malicious viruses

The main method of ransomware spreading is spam email attachments. These attachments can be everything and anything from intrusive advertisements that causes redirects to safe-looking documents which contain malicious macros^[4]. You should be aware that these annoying letters can be a real threat to the safety of your computer system. If you download those attachments or purchase anything from the advertisements, you can get silent infections.

Avirus.hu^[5] specialists advise people to be careful when browsing through insecure websites, clicking ads, downloading programs and their updates. File-encrypting viruses and other malware might be installed using other methods and techniques. Hence, to avoid the attack, you should watch your clicks online. Moreover, get a strong antivirus tool to protect your system from various computer infections that might occur throughout the Internet while browsing.

Bomber ransomware elimination is essential for every victim

To remove Bomber virus from your computer, the first thing you should do is rely on professional anti-malware tools. FortectIntego, SpyHunterCombo Cleaner and MalwarebytesMalwarebytes are the options we can recommend, but feel free to chose whatever you are trusting. This option is the best because you can get rid of all the viruses on your computer.

Since your system was not secure enough and got affected by the ransomware, you might have other visors that you do not know of. Also, ransomware itself can contain additional tools or programs while infecting your system and spread them. You should proceed with Bomber ransomware removal and get back to the safe computer system.