Backdata@qq.com Ransomware

What is Backdata@qq.com Ransomware?

Recently we have encountered a lot of Crysis/Dharma Ransomware clones, and in this report, we will discuss one of the latest additions to the family, called Backdata@qq.com Ransomware. It works same as the threats before it, but it uses a slightly different extension to mark its files and there is a new email address for contacting the hackers behind this malicious application. As always, it is said the price depends on how fast the victim puts up with the cybercriminals demands. Same as with other malware alike there are no guarantees the message’s authors will hold on to their end of the bargain. It means you may not get what you pay for and, in the end, you could lose not just your files, but also your money. This is why we recommend not to pay the ransom, and if you do not mean to do so, we encourage you to erase Backdata@qq.com Ransomware. It can be done with a reliable antimalware tool or the instructions available below.

Where does Backdata@qq.com Ransomware come from?

The malicious program might slip in when launching an infected email attachment, installer, or another suspicious file coming from unreliable sources. Therefore, to protect the computer from threats, such as Backdata@qq.com Ransomware, it is crucial not to visit sites that could contain harmful material and watch out for questionable email attachments coming with Spam. Users should also keep in mind that a malicious file does not have to be necessarily executable, as some of them are disguised so they would not raises suspicion. This is why it is so vital to determine if the source where the file is coming from can be trusted. If you cannot decide for yourself, you can always scan suspected data with a legitimate antimalware tool of your choice.

How does Backdata@qq.com Ransomware work?

Backdata@qq.com Ransomware settles in by creating quite a few files on the system. Many of the malware’s files are its installer’s copies or copies of the data that opens a ransom note. Some of them are placed in specific locations to make the infected computer launch the threat and its note, after the system restarts. For this reason, we do not recommend leaving the malicious application unattended, as it is possible it could encrypt newly created files each time you restart the computer. It is crucial to realize encrypted data becomes worthless without decryption tools since the user cannot open it.

This threat marks enciphered files with an extension that should look similar to this one: .id-B9757725.[backdata@qq.com].qwex extension. The first part showing an ID number should be unique for each victim, so the letters and numbers can vary. Soon after the encryption process is over, Backdata@qq.com Ransomware is supposed to open a ransom note. It ought to say you have to contact the hackers if you wish to learn how to pay for decryption tools. The reason we would not recommend emailing the cybercriminals is that there are no reassurances they will do as they say.

How to eliminate Backdata@qq.com Ransomware?

As we said earlier, it might be dangerous to leave Backdata@qq.com Ransomware on the computer, so if you have no intentions on paying the ransom, we would advise removing the malware. To eliminate it manually you should follow the instructions provided at the end of this paragraph. Also, the threat can be removed with a legitimate antimalware tool. If you prefer this option, you should do a full system scan and click the given deletion button to get rid of all detections at once.

Erase Backdata@qq.com Ransomware

1. Click Ctrl+Alt+Delete.
2. Pick Task Manager and select Processes.
3. Locate a process belonging to the threat.
4. Select it and click End Task.
5. Exit Task Manager.
6. Click Windows key+E.
7. Locate these paths:
   %TEMP%
   %USERPROFILE%\Downloads
   %USERPROFILE%\Desktop
8. Locate the malicious application’s launcher.
9. Right-click it and select Delete.
10. Navigate to these locations:
    %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
    %WINDIR%\System32
    %APPDATA%
11. Find files called Info.hta, right-click them and select Delete.
12. Locate these folders:
    %HOMEDRIVE%
    %PUBLIC%\Desktop
    %USERPROFILE%\Desktop
13. Search for text files named FILES ENCRYPTED.txt, right-click them and select Delete.
14. Navigate to these specific Startup directories:
    %WINDIR%\System32
    %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
    %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
15. Identify suspicious executable files, for example, file.exe; right-click them and choose Delete.
16. Exit File Explorer.
17. Press Windows key+R.
18. Insert Regedit and click Enter.
19. Locate the given directory: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
20. Identify a value name dropped by the threat, for example, file.exe.
21. Right-click this value name and press Delete.
22. Find two more value names in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run location.
23. For example, mshta.exe, right-click malicious value names and select Delete.
24. Exit Registry Editor.
25. Empty your Recycle Bin.
26. Restart the computer. Download Removal Tool100% FREE spyware scan and
    tested removal of Backdata@qq.com Ransomware*