Black Feather ransomware - How to remove

A new variant of crypto-ransomware virus has been recently spotted with a rather elegant title. Black Feather is the name that represents the newly discovered infection. Maybe crooks with a more sophisticated palette crafted this disease but its name definitely should not overshadow the main function that ransomware viruses perform: they encrypt files and make them unavailable for usage. Black Feather virus is created according to the HiddenTear open-source project and fits right in among other fellows. It demands a seemingly reasonable amount of money of 0.3 Bitcoins (approximately 183.18 US Dollars). Think again before actually transferring the required fee as you will only be financially supporting crooks to create more ransomware viruses. And, as you might have notice, the number of these infections is constantly growing.

About Black Feather Ransomware

After this Black Feather virus slips into your device in a form of an ordinary executable, its payload initiates a number of modifications that are focused on successfully encrypting files without getting detected. First, it modifies Windows Registry Keys so this executable would be secretively ran every time users restart their devices. Actually, the course of actions are pretty similar to other infections and does not seem to be modeled in a significantly new way. After getting automatically launched, Black Feather virus starts a scan to find files that could be suitable for encryption. It might be that this virus is going to choose completely randomly or according to criteria of some sort. It can single out data that is regularly ran or pick the ones with appropriate extensions. Either way, after the encryption is concluded and found files are encrypted with AES algorithm for encryption, users won’t be able to run those files. Every corrupted piece of data is going to have to embrace an additional extension: .blackfeather. After encoding is completed, Black Feather virus will also place a letter with instructions. This is file can be spotted with a name BLACK_FEATHER.txt. The content of this file is pretty plain and indicates the account to send bitcoins to. However, it has been noted that this ransomware does not transfer information about the infected users to its creators. This basically means that this ransomware automatically encrypts files and does not care about informing its founders about a new caught rabbit. This means that even if you the pay the demanded sum, crooks are only going to be excited about their balance getting bigger. This is pretty solid argument not to pay the required sum of money.

How is Black Feather Ransomware Distributed?

Black Feather virus is probably distributed the same way all ransomware viruses are found to be spread. First possibility for distribution is that their executables are placed as attachments to bizarre email letters. That is why users so frequently find odd messages in their inboxes. Before opening such letter, make sure that it is actually intended to be sent to you with best wishes. If so it happens that crooks have somehow gotten your email address, then your account is going to regularly receive similar content. On the other hand, drive-by download is also found responsible for distribution of ransomware viruses. If you want to dodge the bullets from such infections, make sure to always visit only reputable domains. In addition to that, never respond to bizarre pop-ups, suggesting to lead you to intriguing domains.

How to Decrypt Files Encrypted by Black Feather Ransomware?

Never choose to give in to the crooks. Sending the demanded sum of money (0.3Bitcoins) is like throwing this sum in the river. If you are eager to spend money, give it to charity instead of shady programmers that are not going to provide you with a functional key for decryption. This factor is very straight-cut when it comes to the Black Feather virus. Since its creators do not receive the necessary information, there is no way for them to posses the required key for decryption. Attempt to revive your files back to life with universal file-recovery tools and hope for the best. You can find information about decryption in the section below. However, for the future, remember that storing your files in backup storages is a fashionable thing to do now. Furthermore, before trying to restore your files, eliminate the Black Feather ransomware with appropriate and sophisticated anti-malware tools like Spyhunter or Malwarebytes.

How to recover Black Feather ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Black Feather ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Black Feather ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Black Feather ransomware. You can check other tools here.  

Step 3. Restore Black Feather ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Black Feather ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Black Feather ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.