Btos Cryptovirus - How to remove

Btos is a new ransomware threat. It can encrypt your files, making them impossible to open. And there’s no free decrypter except in some limited cases, so if you didn’t have a backup, your files could be lost. Btos is also dangerous in a few other ways – it can break your antivirus program, block some websites, hide Task Manager, and install a password-stealing trojan. Btos spreads on pirating sites, so anyone who downloads “free” programs and cracks risks getting this infection.

Short info on Btos:

How Btos cryptovirus infects computers	Downloaded with pirated programs.
Infection symptoms	File names are changed and now end with “.btos”, _readme.txt files show up, files don’t open and some programs don’t work, some websites won’t load, adware infects your computer, online accounts get hacked.
Restore your files	Restore your files from a backup, use a data recovery program, restore previous file versions, use the free decrypter.
Remove Btos cryptovirus	Delete malicious files and programs, fix the hosts file, use an antivirus program, like SpyHunter, to find and remove malware.

How Btos infects and encrypts computers

Gets downloaded with pirated programs. It’s true for all Djvu-type ransomware, including Topi, Reha, Kodc, and others. Infecting free, much-wanted programs, such as Office installers, Windows activators, and other pirated versions of expensive software has allowed Btos’ family to spread globally and infect tens of thousands of victims (according to Emsisoft, the number of estimated victims is 460,000 – and it’s growing every day).

Once Btos is on your computer, it tries to delete your antivirus updates to blind your security software. It might also hide your Task Manager and block security sites to prevent you from looking up what “Btos” is. Instead, it creates a bunch of “_readme.txt” files that hold the ransom note with demands for money (from $490 to $980).

Btos tries to download a unique encryption key from the criminals’ server. Then it starts encrypting your files with that unique key. If it couldn’t download it, it uses a non-unique encryption key and still locks your files. That is to say, disconnecting your computer from the internet doesn’t stop Btos. You need to shut down your machine to do that.

Not that it would help, as Btos is relatively fast and encrypts hundreds of Gigabytes in a few minutes. Your computer does start chugging at the time and to throw off your suspicion, Btos may display a fake Windows Update pop-up.

After all is done, Btos has encrypted many of your files: documents, presentations, spreadsheets various text files, movies, songs, and more. It leaves Windows alone, so you can still start the computer. It’s just that many of the files on it do not open and many of your programs can’t start anymore. The encrypted files are labeled with the “.btos” extension, but even without it, they are broken.

File encryption isn’t universally evil or criminal, in fact, it can be used to protect sensitive information. But ransomware like Btos uses encryption for criminal purposes and, depending on your situation, you might have cause to contact law enforcement about the attack.

In addition to Btos, some additional malware was probably installed on your machine. Like the Azorult trojan, which can steal passwords from your online applications and download more malware.

How to get rid of Btos and restore your files

First, you need to get rid of the malware: the files that infected your computer in the first place must be deleted, and Btos and Azorult need to be removed. You can use any competent anti-malware program, such as SpyHunter, as long as you have the newest updates installed. With such a new infection like Btos, antivirus vendors need to quickly update their programs to make them effective.

Getting rid of Btos won’t fix your files, though. It’s not clear if they can even be fixed. Check your _readme files or the C:\SystemID\PersonalID.txt file. If Btos failed to download the unique encryption key, your ID would probably end with “t1”. The offline key is the same for all victims of Btos, so if one gets the decryption key for the offline key, it’s good for all the victims affected by the offline key. Emsisoft has taken up the task of managing this, here’s the link to their decrypter. They may or may not get the Btos offline key in the future, there’s no way to know.

Other ways to get Btos files back, if you don’t have backups, is to recover from shadow volume copies (though Btos probably deleted those), use data recovery (but this only works for hard disks), or try to hunt down your files from email attachments, online folders, etc. Also, you might be able to recover some audio, video, archive, and other big files because Btos only encrypts portions and leaves large chunks unencrypted.

Don’t fall for scammers that offer to fix all of your files for money. Btos’ encryption is quite secure and there’s no miracle cure for it. If there was, ransomware researchers would have found it by now.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Btos Cryptovirus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Btos has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Btos Cryptovirus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Btos. You can check other tools here.  

Step 3. Restore Btos Cryptovirus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Btos tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Btos Cryptovirus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.