Balbaz ransomware - How to remove

Just like Defray or MoonCrypter ransomware, Balbaz ransomware is a virus from Hidden Tear ransomware family. It can cause you a lot of damage – your files might be lost for ever. So if you have encountered this infection on your computer, just stick with us and learn the best possible solutions for this particular problem.

First of all, you should know how this infection operates. Since it is listed as ransomware, it is looking to encrypt your files and then ask for the ransom in order to retrieve them. Unfortunately, most of the time paying the ransom is the only way to get a shot at getting your files back.

Balbaz ransomware uses a strong AES encryption that is extremely difficult to decrypt. Once inside of the computer, it will scan all of your files and detect what can be encrypted. This virus is capable of encrypting most of file types, including but not limited to pictures, audio and video files, text documents and even .exe files. The encryption is done silently, you can not notice it. However, you will notice that something is wrong immediately afterwards. Every single encrypted file will feature a .WAmarlocked extension and from that point, you won’t be able to open or use it in any other way. So if you had a file called ‘name.png’, now it will appear as ‘name.png.WAmarlocked’.

In addition to that, you will notice 2 new files on your desktop. Balbaz infection will create Read_IT.txt and Ransomware BALBAZ 1.00 program window and place them on your desktop. It is so called ransom note – all information about payment of the ransom is inside of those 2 files. Original text from  Ransomware BALBAZ 1.00 program window:

YOUR PERSONAL DATA ARE ENCRYPTED!

OooPs, Your Important Files Are Encrypted

If you see this text. but don’t see “Balbaz DecryptOr” window your Antivirus removed the Decryptor software or you deleted it from your computer.

If you need your files you have to run the Decryptor software.
Please find an application named “@[email protected]” in any folder or restore from Antivirus quarantine.

Run and follow the instructions !!

The second message in Read_IT.txt file:

This computer has been hacked
Your personal files have been ecrypted. Send me BTC or food to get decryption passcode.
After that, you’ll be able to see your beloved files again.
With love… Hidden Tear Project :’)

As you can see, cyber criminals want you to run the decryptor and pay the ransom in order to retrieve your files. They are asking for $200 worth of Bitcoins for a decryption key. Even though it might look like a good deal to you, we suggest not to pay the ransom. We have seen in the past how crooks instantly forget about their victims after the ransom is paid, so it can leave you with more losses as a final result.

Sometimes the best solution against ransomware like this is to remove the virus from computer and restore files from a backup. However, in this case it might be impossible to do because the same as Globe Ransomware, Balbaz infection automatically runs a command line vssadmin.exe delete shadows /all /Quiet to deleta all shadow volume copies, so the user could not restore files from there. File restore might be possible if you have stored a valid backup on a an external drive or cloud and back up file is not corrupted or deleted.

Nevertheless, you should still eliminate this infection from your computer. The best way to do that, is to get yourself a decent anti-malware application, such as Spyhunter or . Either of those programs should detect and remove this Balbaz virus in minutes.

How to recover Balbaz ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Balbaz ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Balbaz ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Balbaz ransomware. You can check other tools here.  

Step 3. Restore Balbaz ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Balbaz ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Balbaz ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.

Manual removal