Boooam Ransomware - How to remove

Boooam is a file-locking virus named after the email address given by it — [email protected]. The victims of Boooam have had their files corrupted, and they’re encouraged by the criminal to pay for a decryptor. Cyber extortion is a lucrative and criminal business which claims new victims every day.

Boooam was discovered earlier this week and doesn’t seem to be part of any existing ransomware family. Still, its behavior is very similar to other file-locking viruses, like Alilibat, Litra, or Truke.

How Boooam works

Distribution

Typically, ransomware is distributed by hacking a RDP connection. If your remove desktop is enabled, doesn’t require a VPN to connect, and the name and password aren’t very complex, a criminal might just break into your computer and install malware there — Boooam, some spyware, a crypto miner…

Spam emails are still one of the main ways for ransomware to spread. If you found Boooam after getitng an email with a mysterious attachment, maybe one that asked you to enable macros, then that’s how Boooam got on your computer.

Malicious ads, programs which hide viruses inside, and falsely labeled free programs can also infect computers with ransomware, but these strategies aren’t used as often.

File locking

After Boooam has infected your computer, it starts gong though files and assigning the “.boooam@cock_li” extension to them. It won’t encrypt ystem fies becaus ethat would break the operating system, but it will lock documents, text files, spreadsheets, pictures, audio files, videos, even archives,

Like most ransomware viruses, Boooam leaves a ransom note in which its developers demand money and boast of how unbreakable their encryption is.

Your computer has been attacked by virus-encoder.

All your files are now encrypted using cryptographicalli strong aslgorithm. Without the original key recovery is impossible. TO GET YOUR DECODER AND THE ORIGINAL KEY TO DECRYPT YOUR FILES YOU NEED TO EMAIL US AT: [email protected] It is in your interest to respond as soon as possible to ensure the restoration of your files.

They’re probably right that the files can’t be decrypted — the decryption key, which is necessary to unlock the files, is stored with the criminals (most cryptoviruses use a combination of symmetric and asymmetric encryption).

How to remove Boooam

Boooam is a virus because it causes harm to your computer. Thus, it should be removed as quickly as possible. That way, it won’t be able to start again and encrypt any new files.

Most serious antivius programs should be able to catch Boooam: VirusTotal report. If your installed antivirus program doesn’t work, try Spyhunter, or another tool.

Can the files be restored?

Though the files are encrypted, there is some hope to get them back without paying the ransom. If you look at the below guide, you’ll see a few things that you can try and possibly recover some of the files. Back up your encrypted data on some device so that you don’t lose it and start experimenting.

Although there are cases where people understandably decide to pay cyber extortionists to restore their files, that should always be the absolute last resort. There are a few reasons why people are so vehemently against paying the ransom:

• It’s financing criminal activity. Spreading Boooam, locking files, and demanding money for fixing them — that’s genuinely criminal and Boooam’s creator could, if ever caught, have problems with law enforcement. The amount of harm caused to people by taking away their photos, drawings, writings, music creations is heartbreaking, and paying Boooam’s developer the ransom only encourages this “business”.
• The chance of fixing the Boooam-encrypted files is actually low (around 60%). A significant portion of those who give money to cyber extortionists end up ignored, or sent the wrong key, or the decryption only working on some files, but not others, or more money is demanded of them. People call these extortionists “scammers”.
• Ransoms are expensive. Most cost between a few hundred and a few thousand dollars and target individual people or small businesses. Money is the motivation behind ransomware, after all. Some extortionists take payment and then demand more money, and since they generally use Bitcoin, the money can’t be recalled or refunded.

Automatic Malware removal tools

How to recover Boooam Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Boooam Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Boooam Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Boooam Ransomware. You can check other tools here.  

Step 3. Restore Boooam Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Boooam Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Boooam Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.