Blood Jaws Virus - How to remove

Blood Jaws or BloodJaws is a ransomware infection. It can cause detrimental damage to your system – possibly ruining all of your personal files, making them unusable. The one and only goal of this computer virus is to make money by infecting computers, locking up files stored there and then asking for a ransom to be paid.

As most of the ransomware infections, Blood Jaws employs same old, yet effective scheme – it gets distributed through malspam, infiltrates into systems, employs strong to encrypt files and then demands a ransom from an owner of the infected machine.

The best way to defend against viruses like this is adequate, which should stop malicious files on the go. However, if it’s already too late for prevention and your computer is infected, we have some answers how to deal with this kind of situation.

Proceed reading the article and learn how to decrypt or restore files encrypted by Blood Jaws as well as remove this infection itself.

How Blood Jaws Virus Infects Computers

Developers of Blood Jaws must drop a payload file to the system, so the virus could start operating and encrypting files. In order to do that, they send millions of emails to random email addresses. Sometimes they simply buy databases with emails from corrupt people.

Usually, emails distributing malware are well-crafted and look like legitimate letters sent by various official companies or institutions. The text in the letter warns users about some kind of problem and suggest to urgently get more information which is in the attached file.

It’s not enough to just open such email to get infected – you have to open and download the attached file, which contains all malicious files. After that, the payload is dropped to the system and all processes begin.

It’s arguably the most common distribution technique, employed by ransomware viruses like Omerta, Sequre, and KingOurobos virus.

How Blood Jaws Ransomware Operates on Computer

We have already mentioned that this ransomware virus is using strong cryptography to encrypt files. To be more specific, it’s AES (advanced encryption standard) cryptography which is extremely difficult to decrypt.

When all malicious files of BloodJaws are uploaded to the computer, it automatically starts scanning the system for files that could be encrypted. Unfortunately, it is capable of encrypting most of the files – from images to text documents, so it’s possible that all your personal files will be locked.

Usually, ransomware infections add a specific extension to the encrypted files, such as “.locked” or something similar. It’s rather odd, but Blood Jaws doesn’t do that. It might be that the virus is still in a beta mode, waiting for the update. Nonetheless, your files will be successfully encrypted.

Immediately after that, your desktop will be changed to this image with the specific message:

It will also create a file called “readme.txt” and drop it on your desktop. It contains further instructions:

Blood Jaws ransomware
Blood Jaws is ransomware!
Run at your own risk. Run ‘runme.exe’ if you really want to kill your PC.
I am not responsible for any damage done.
Tested on Windows 10 (64)
Virus made by Virus Express.
Encryption Used:
AES 256 Bit Encryption used with the password: bloodjawsencryptionl23!@:

After this information, there’s almost no doubt that Blood Jaws is still in the development phase as they do not ask you to pay the ransom yet and provides a free decryption tool. There are two possible explanations for this – either they are testing the code and will update the ransomware, so users who failed to removed Blood Jaws will be forced to pay the ransom, or they simply do it for fun and no payment for decryptor will be ever required.

How to Decrypt Files and Remove the Virus

It’s a very rare case when decryption is this simple – you can do that with the decryption tool provided by the infection itself. All you have to do is to detect “bloodjaws.exe” file somewhere on your desktop and run it. That’s it, after several minutes, all your files should be decrypted and back to normal.

However, it’s still very important to remove the virus itself, because it might cause other damage in the future. It can be done pretty easily as well if you have the right tools for the job. Scan your system with Spyhunter and it should automatically detect and then remove Blood Jaws virus. If you want more consequent removal guide, please scroll down below this article and take a look at step-by-step instructions.

Automatic Malware removal tools

How to recover Blood Jaws Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Blood Jaws Virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Blood Jaws Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Blood Jaws Virus. You can check other tools here.  

Step 3. Restore Blood Jaws Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Blood Jaws Virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Blood Jaws Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.