How to Remove BitPaymer Ransomware

How to Remove BitPaymer Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED!
All files are encrypted. We accept only bitcoins to share the decryption software for your network.
Also, we have gathered all your private sensitive data.
So if you decide not to pay anytime soon, we would share…
***

BitPaymer is a newly-discover cyber threat. It belongs to the dreaded ransomware family. And, it’s an infection to be reckoned with. BitPaymer uses deception to invade your system. Then, takes over, and corrupts your files. Every single one you have, gets locked. The tool appends the “locked” extension at the end. So, your picture called “me.jpg” turns into “me.jpg.locked.” Once the extension is in place, you can no longer open your files. Moving or renaming them doesn’t help. The one way to regain control over them, is to pay up. Let’s elaborate. The infection leaves you a ransom note to explain your predicament. It claims you must pay “50 Bitcoin + 3 Bitcoin confirmation fee.” After you transfer the sum, it sends you a decryption key. Apply it, and your files are free. It seems like a swell promise. But, here’s the thing. Today, 1 Bitcoin equals 2536.24 US Dollars. So, 50 Bitcoin are about 126,812.25. And, that doesn’t even include the “confirmation fee.” That’s an outrageous price! No data is worth that amount of money. And, even if you deem it worthy, how about your privacy? Do you consider it worth it to throw it away? Yes, by paying up, you expose your private information to the extortionists. And, for what? The hope of receiving a key? Yes, hope. You have zero guarantees payment does the trick. The infection can double-cross you in a variety of different ways. It’s not a matter of whether you’ll win the fight against it. It’s a question of how much you’ll lose in the process of fighting it. The cyber criminals behind ransomware play tough. They rig the game in their favor. So, no matter what you do, you lose. It’s imperative to cut your losses. As harsh as it seems, be wise! Choose privacy over data. Do NOT pay these people! It’s not a justified gamble, and it will backfire. You won’t only lose a LARGE amount of money, but you’ll gain nothing. Say goodbye to your files, and move on.

How did I get infected with?

BitPaymer turns to the old but gold means of invasion. It sneaks into your system by preying on your carelessness. It provides the easiest way inside. The tool relies on your naivety, haste, and distraction to hold open the door for it. Don’t allow the infection to parade before your eyes. With you looking straight at it, but not seeing it. It may sound like an impossible feat, but the infection does it with great ease. One, of the most common invasive methods, is freeware. The program uses it as a front to slither past you, without you even realizing it. How come? Well, for reasons beyond comprehension, users are quite careless when dealing with freeware. They rush, and don’t even bother to read the terms and conditions. Instead, they agree to all. Not knowing what they consent to allow into their system. Vigilance is crucial every time you’re installing tools, updates, anything, off the web! It’s a dangerous place, and even a little extra attention can save you a lot of troubles. Don’t discard due diligence. Remember! Caution helps to keep infections away. Carelessness invites them in.

Why is BitPaymer dangerous?

Let’s delve deeper into why you must NOT pay the ransom. The people, behind BitPaymer, make it out like it’s a pretty straightforward exchange. Well, it’s not. There’s nothing simple about it. If you choose to pay the ransom, you’ll regret it. To transfer the sum, you have to provide personal and financial details. You leave private information for the cyber criminals to find. And, if you think, these people won’t exploit it, you’re mistaken. Don’t be naive. Anything they get from you, they will use for their agenda. Give them nothing! Nor ransom money, nor access to your private details! Do not contact them. Do not transfer the sum, they demanded. Do not reach out in any way. Do yourself a favor, and be smart. Discard your data. It’s not worth the hassle or the risks. Even if you comply to the fullest, odds are, you still lose. Say, you pay up. What’s next? You expect to get the decryption key, right? Well, what if the cyber kidnappers send you the wrong one? Or, not give you one at all? And, what if they send the correct one, and it works. But, two minutes after decryption, they strike once more. And, you’re back to square one. Have you considered that? The decryption key, you pay for, does nothing for the infection itself. It only removes the encryption. The BitPaymer program remains. Ready to activate once more, and get your files hostage. Do yourself a favor, and don’t play the ransomware’s game. You’re set up to lose. Accept defeat, and move on.

BitPaymer Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover BitPaymer Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with BitPaymer encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate BitPaymer encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.