Blammo@cock.li Ransomware

Blammo@cock.li Ransomware is known to be the newest Dharma Ransomware variant. It has been recently detected by our researchers, so it is not a prevalent threat yet. Of course, it does not mean that you can act carelessly because it might become a popular infection in the near future and thus infiltrate your computer unnoticed. Ransomware infections, like other malicious applications, infiltrates computers without the users’ knowledge, but it does not mean that they manage to stay unnoticed – users soon realize that they can no longer open almost all their files and they have a strange new extension appended to them all. Have you found malicious software installed on your computer too? If this is the reason you are reading this article, you must delete Blammo@cock.li Ransomware from your computer as soon as possible because the presence of the ransomware infection might result in more encrypted files in no time. Crypto-malware is considered a serious type of malicious software, so you will not remove it as easily as an ordinary application, but we are sure you will still manage to get rid of it yourself if you read this report first and then delete malware from your computer using our step-by-step manual removal guide that is provided below the report.

It was not hard at all to find out how Blammo@cock.li Ransomware acts because it does not differ much from Dharma Ransomware. After successfully infiltrating users’ computers, it goes to lock files on victims’ computers. According to researchers working at pcthreat.com, this ransomware infection will mercilessly lock almost all personal files found on the affected computer, including documents, pictures, music, and more. In this case, all encrypted files will get the .[Blammo@cock.li].arrow filename extension appended to them. Unfortunately, it cannot be removed, meaning that it will not be easy to decrypt files. To be frank, the chances are high that only a special decryption tool cyber criminals have could unlock them. Users are not told that they need to purchase it from them at first, but we are sure you will be told that it is not free software if you write an email to Blammo@cock.li, i.e. contact cyber criminals behind this ransomware infection. Since the ransom note dropped (FILES ENCRYPTED.txt) does not contain any other information about the decryption of users’ personal files, it means that there is no other way to unlock files. It might be impossible to unlock files in a different way, but you should still not pay money to ransomware developers because they might not even send you the decryption tool. You could not do anything to get it from them in this case. Of course, we leave the final decision for you.

It is hard to say how Blammo@cock.li Ransomware has infiltrated your computer because, at the time of research, it was not a popular infection and, because of this, it was too early to make any conclusions about its distribution. According to our experienced specialists, if cyber criminals start distributing it actively, it should also be spread via spam emails primarily. As has been observed by malware researchers, ransomware infections usually look like ordinary documents. Because of this, users open them and allow malicious software to enter their computers themselves. Spam emails are not the only ones that might contain malware. Dubious websites you visit might also promote malicious applications. Therefore, you should not download software from suspicious pages. We do not expect you to stop downloading applications from the web completely, so we highly recommend keeping security software enabled on the system 24/7. If you overlook harmful threats, it will detect them for you and then will prevent them from entering your system.

We are sure you will delete Blammo@cock.li Ransomware from your computer manually with our help, but, unfortunately, your files will stay as they are. That is, they will not be decrypted. They will not be unlocked even if you decide to erase the ransomware infection from your computer automatically. Since free decryption software is not available, it means that you could only restore your files for free from a backup if you are not going to purchase the special decryptor from cyber criminals. It should be repeated again – it is a bad idea to send money to crooks.

Delete Blammo@cock.li Ransomware

1. Press Win+R on your keyboard.
2. Type regedit and click OK.
3. Move to HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN.
4. Locate the Value representing the ransomware infection.
5. Right-click it and select Delete.
6. Close Registry Editor and open Windows Explorer.
7. Delete two executable files named randomly from %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup and %WINDIR%\System32\.
8. Delete the ransom note (FILES ENCRYPTED.txt) from %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup.
9. Remove FILES ENCRYPTED.txt from your Desktop.
10. Delete suspicious recently downloaded files from the Downloads folder (%USERPROFILE%\Downloads).
11. Empty Recycle bin.