The cybercriminals would point out that BBBR ransomware has encrypted the entire data contained in the victim’s computer with the use of very strong and complex key that can’t be bypassed. Therefore, there is no alternative than to pay certain amount of money to the cybercriminals as ransom so they could provide decryption services to the victim. To facilitate further discussion, two email addresses will be attached for the victim to respond accordingly. The emails are: support@sysmail.ch and helpsupportmanager@airmail.cc. They will also attach their decryption service prices and the terms of payment associated with it. According to them, the victim should write to them within 72 hours, i.e. 3 days after being notified and comply with their demands so they could be liable to a 50% discount. In other words, they would now have to pay only $490 instead of $980. However, failure to meet up within the deadline means they would have to pay the full amount. If the victim responds to them, they will reel out more conditions. For instance, they will state that only payments made with cryptocurrency worth the exact ransom fee would be acceptable and to that effect, they make their wallet address available. The obvious reason why they usually chose this medium is because of the anonymity it offers them. Other channels of payment would put them at significant risk of being tracked down and arrested. To assure the victim about their expertise, they may request for samples of the encrypted files to be sent to them for test decryption. However, they will be quick to add that such excerpt must not contain information that could be perceived as important. Our cybersecurity experts advise victims to always follow FBI recommendations as regards to ransom payments, and it SAYS NO TO RANSOM PAYMENTS! Here is the reason why we all agree that ransom shouldn’t be paid to cybercriminals:

There is no guarantee of file/data recovery even after paying ransomPaying ransom to them would only encourage them to continue in their criminal activitiesPaying ransom would help them to expand their activities, thereby leading to more victimsYou could put yourself at further risk because they could give you Trojans like AZORULT or VIDAR disguised as decryptors (they could be used to steal vital information such as account login details, cryptocurrency wallets, browsing history, banking details, and passwords etc.)

If your computer is already infected with any variant of STOP/DJVU malware, you’re advised to remove BBBR ransomware virus as quickly as possible. The best way to go about it is to boot your computer using Safe Mode with Networking option, then run a genuine antivirus on it. Our team recommends using INTEGO Antivirus (you can read its review here). Additionally, we recommend you to download RESTORO to try and repair virus damage on Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques everyone should be wary of

The most common way STOP/DJVU ransomware variants including BBBR virus are distributed is through downloading of malicious torrents. Cybercriminals often load them in pirated software contents and they become activated once users download them in their various computers. Most of the so-called key generators and “cracks” as well as other popular but cloned software contents are the ones mostly exploited by them. Studies and aggregate data from victims show that the most common ones are:

VMware Workstation;Fifa 20;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;Adobe Photoshop;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;KMSPico (illegal Windows activation tool).

For those that indulge in the habit of visiting online software torrents, you’re hereby advised to desist from it. You could fall victim to cybercriminals at any moment and the consequences would be unpalatable. At the moment, it may appear cheap to source for activators, game versions and other contents at little or no cost, but what you could eventually lose to cybercriminals would be massive. Also note that copyright infringement is subject to prosecution in the law court. Instead of putting yourself through all these, it is better to obtain them legally through the legitimate channels. By so doing, you will be helping the industry to grow. Another major way of spreading ransomware is through malicious email attachments, whereby cybercriminals would compose carefully scripted messages using formats such as XLS, DOCX and PDF or any similar one that support macro functions or JavaScript. In this way, they can successfully download the payload and also trigger it indiscriminately in other computers. In recent times, it has become increasingly difficult to easily decipher if a particular email is genuine or having malicious intents. Cybercriminals are now impersonating other people or even notable brands which can take unsuspecting people unawares. In their desperation, they now caption their emails with terms such as Invoice, Tracking details, Order Summary and other similar names in order to throw their victims off-guard. Sometimes, they may decide to use email spoofing gimmicks to hide the actual sender’s address. Whatever be the case, we advise people to always trust their instincts; if something doesn’t look right about an email, then you should consider not opening it. Victims of STOP/DJVU ransomware should not loose guard while thinking that the worst has been done. On the contrary, you should continue being vigilant and avoid suspicious websites that claim to provide decryption solutions. Such solutions hardly exist and most of the websites advertising them are shady and have dubious aims. They are notorious for distributing other ransomware variants and Trojans like ZORAB which they camouflage as STOP/DJVU decryptors. Your files could end up doubly encrypted when you download them.

More details you need to know about the infection

We will be discussing about the technical aspect of the infection. So, here is what happens during BBBR ransomware attack. Firstly, the malware arrives in an executable file named with 4 random characters, for example, 1GB8.exe and will launch what is known as build.exe or build2.exe executables and also winupdate.exe. After that, it will connect to https[:]//api.2ip.ua/geo.json and would save the result in geo.json file. The malware then gathers necessary detail about the computer such as its zip code, time zone, latitude and longitude, geolocation, etc. and forwards them to the central control server. Displayed in the image below are two examples of the geo.json file. The virus also collects various details about the computer, including hardware specifics, installed software list and active processes into information.txt file as shown below. It then compares the information gathered about the computer against a list of countries they designated as encryption forbidden nations. They include Belarus, Russia, Tajikistan, Uzbekistan, Syria, Kazachstan, Ukraine, Kyrgyzstan and Armenia. If it indicates that the computer is domiciled in any of these countries, it will immediately stop any further action. However, if it doesn’t, the ransomware will proceed by fetching online encryption key from their central server and will combine it with the victim’s ID and would save them in the bowsakkdestx.txt file and to PersonalID.txt file. Examples of these files are shown below. In situations whereby the virus couldn’t fetch any online encryption ID, it will resort to the use of offline encryption ID. What sets the two ID’s apart is that online encryption ID is uniquely created for each victim while offline ID is a one-size-fits-all. The use of offline ID means there is a high chance that the encrypted files could be decrypted someday unlike the online ID. You can detect if offline ID was used if there is presence of t1 characters at the end of the personal ID. Check this article for more details about it. Afterwards, the ransomware would fully commence data encryption process by scanning the folders while encrypting every file using Salsa20, then makes use of RSA-2048 to lock the encryption key. While this is still going on, the files will be marked with additional extension (.bbbr). Displayed in the screenshot below is _readme.txt ransom note the malware typically drops in all folders. At this point, the malware would leverage a Command Prompt task to delete Volume Shadow Copies, example of it is shown here: vssadmin.exe Delete Shadows /All /Quiet Before concluding the process, the virus would add a number of domains to the Windows HOSTS file, and then forwards them to the local host IP. It does this in order to preempt any possible attempt by the victim to seek help online. If peradventure the victim tries to access any of the blacklisted domains, an error message will appear on the screen in this format: DNS_PROBE_FINISHED_NXDOMAIN. The obvious reason why the cybercriminals does this is to frustrate the victim and make them helpless.As stated earlier, additional malware would be dropped by the ransomware in the form of Trojans like AZORULT or VIDAR.

Remove BBBR Ransomware Virus and Recover Your Files

For those that are victims already, it would be in your best interest to report the cybercrime attack to local law enforcement agency to handle such incidents. You should also remove BBBR ransomware virus from your computer as quickly as possible. Please go through the guidelines provided below for more details. However, before making use of the antivirus in removing the malware, it is important to boot your computer in the Safe Mode with Networking. This sets up the computer with limited functions thus enabling the antivirus to work at its optimal capacity. If you’re not sure of any reliable antivirus you can make use of, then you go for INTEGO Antivirus because it is tested and trusted. Please go through these recommendations as outlined by our team:

Remove the virus as quickly as possible from the compromised computer;Report to any government agency responsible for handling such issues within your locality.Now is time to make use of your backup devices to restore your lost data but ensure that the antivirus was able to remove the malware completely before plugging any external storage device.Learn about the possibility of repairing/decrypting files that were infected with STOP/DJVU variants.Urgently change all passwords that were used on the computer.Download RESTORO to repair all Windows OS files damaged by malware.

Whether you’re a victim of any STOP/DJVU ransomware variant or you’ve never experienced any cyber-attack before, it is still necessary to be on guard at all times. OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove BBBR Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove BBBR Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt BBBR files

Fix and open large BBBR files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. BBBR Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt BBBR files, follow the given tutorial.

Meanings of decryptor’s messages

The BBBR decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your BBBR extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of BBBR Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.