How to remove Borontok ransomware

Borontok ransomware is the cryptovirus that encrypts files on Linux servers and demands 20 Bitcoin for the recovery

Borontok ransomware (also known as Rontok ransomware) is the file-locking virus that affects server files and databases by encrypting them and marking with the .rontok file extension. As other ransomware-type attackers, the virus demands 20 Bitcoin in exchange for the decryption key for file recovery. The ransom note is generated on the screen of a web browser window and contains victim's UUID that is needed later on when the official page borontok.uk is visited. When the user enters the ID on that page, virus developers encourage people to pay 20 BTC in 3 days via the form on their provided website, or their files get deleted permanently. However, $75 000, which is equivalent to 20 BTC, is a huge amount of money. We do not recommend paying the ransom since it gives no guarantee that your data gets recovered. Reports from victims about B0r0nt0K ransomware have already stated that the encryption affects Linux servers and web sites, but there is a big possibility that the threat targeting Windows OS also exists.

Rontok ransomware virus is mainly targeting websites and servers like Linux, but the threat may also be able to encrypt data on devices running Windows. This is a serious cyber infection that can affect more than your files because it makes additional changes to ensure the persistent that may include:

• added files or programs;
• disabled functions or applications;
• changed startup settings;
• added registry entries.

However, the first thing this intruder does once it gets on the system is file encryption. A few early reports on B0r0nt0K ransomware stated that the website that was encrypted runs on Ubuntu 16.04 and most of the files got encrypted, renamed and then marked with .rontok extension. The ransom note is not displayed in a text format or the message itself.

Everything regarding the payment and the amount of money ransomware developers are demanding appears on the web browser when you visit borontok.uk page. This site provides users with the login form that requires their ID that was given to the victim.  

Once the UUID is entered, Rontok ransomware delivers particular payment page with the amount of ransom – 20 BTC and the contact email info@borontok.uk. The bitcoin payment address is also provided in this window. Although it seems that the price can be negotiated via the email, we recommend avoiding any contact with cybercriminals as well as not paying the ransom. This is not the solution because the decryption is possibly not happening even after the Bitcoin transfer.^[2]

Borontok ransomware developers display various web browser windows. One of them reads the following about the ransom amount:

UUID:
Send 20 BTC to this address: 
3P8nU1oLe23DtSuzFQMoVJdqcJA6xKnVJC 
. 
Negotiate? contact: info@borontok.uk 
[**********] 
Enter the TX ID BTC Already the if you sent bitcoin … 
[Check] 

You may think that Borontok ransomware is only encrypting your data and demanding the payment, but it is difficult to remove from the system for a reason. Many people call ransomware cyber threats as one of the most persistent infections because of the ability to change Windows Registry entries, for example. Cryptovirus can disable security tools or functions to keep running without interruption.

For that reason, we recommend entering the Safe Mode with Networking before Borontok ransomware removal. It helps anti-malware tools to run smoothly and scan the computer thoroughly. As many other researchers like NoVirus.uk^[3] team, we recommend antivirus tools like FortectIntego for virus damage termination.

You need to remove Borontok ransomware from the PC as soon as you notice any changes because in the meantime virus can alter more crucial parts of the device. We have a few suggestions below the article with software recommendations and tips while removing the virus.

When it comes to ransomware attacks on companies and institutions, you should also rely on professional help from anti-malware programs or even security experts that can make sure Rontok ransomware is terminated and protect your system from any future attacks.

Hacking tools can be used to spread crypto malware and other threats

Ransomware threats can be spread using various methods since the internet gives more possibilities to infect computers quickly. Hacking through the unprotected RDP configuration, exploiting vulnerabilities and security flaws or distributing malicious attachments via spam email can be considered the most used techniques in cryptovirus distribution.

You should always use the reputable antivirus program to keep the system virus-free and clear from unwanted programs. Also, these tools can block malicious content. If you continue browsing online, downloading suspicious files or email attachments, you may get cyber infections on the system without notice.

If you get the email without expecting to get one, pay close attention to the content especially when the notification also has attached files in the format of Word or Excel document or PDF. Microsoft documents considered to be a method used to deliver malicious macros which infect the system with a malware script immediately after downloading and opening the infected file.

Get rid fo Borontok ransomware without risking to get your data damaged

Make sure to remove Borontok ransomware from your device as soon as possible, so your system is not significantly affected or damaged yet. This is the best tip we can give you since this is one of the most dangerous cyber threats. Also, you should employ professional anti-malware tools to help you fight this intruder.

Use FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes for the best Borontok ransomware removal results and clean the device completely from any cyber intruder. These programs can check the entire system of your machine and detect malicious programs or anything that may create problems with your computer.