.bip File Extension

If you find the .bip file extension appended to some or all of your personal files, it is likely that you can also find an unfamiliar file close to them. According to our research team, this file is called “Info.hta” (in %APPDATA% and %WINDIR%\System32\) or “FILES ENCRYPTED.txt” (on Desktop), and the message represented via it instructs to send a message to Beamsell@qq.com. If this is what you are currently dealing with, there is no doubt that Dharma Ransomware has invaded your operating system. There are several different versions of this malicious infection, but the one we are discussing in this report adds a very unique extension: “.id-[unique number].[Beamsell@qq.com].bip”. The “[unique number]” part in the extension represents the ID number that is also represented via the ransom note. Unfortunately, you cannot just remove .bip file extension to recover the files that are affected, and that is because they are encrypted using a complicated algorithm. In fact, it is unlikely that it is possible to decrypt files at all.

We cannot say how exactly Dharma Ransomware slithered into your operating system, but if we had to guess, it is most likely that the launcher was concealed as a regular file that might have been sent to you via spam email or introduced to you via a malicious downloader. Once executed, the original launcher creates two copies in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and %WINDIR%\System32. Both copies have the same name as the original launcher, which should make it easier for you to delete the threat if you choose to do it manually. The second copy file – as well as the ransom note file – also has a point of execution in the Windows Registry (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN). Once all elements are in place, the ransomware encrypts files and attaches the .bip file extension to their names. If a file is encrypted, you will not be able to open it unless you apply a decryption key. You cannot go around this by deleting .bip file extension or erasing the ransomware altogether.

The information in the Info.hta suggests that victims of Dharma Ransomware need to send the ID number to Beamsell@qq.com to get a decryption tool back, but cyber criminals CANNOT be trusted. The “Attention” section within the message warns against renaming files, decrypting data, or using third-party decryptors. Speaking of these tools, at the time of research, a legitimate decryptor that would restore files with the .bip file extension did not exist. The ransom note delivered using the FILES ENCRYPTED.txt file is much shorter, and it simply asks to email the same address. If you get a message like that, you are in a good position only if your files are backed up. System backups will not work in this case because the ransomware uses the “vssadmin delete shadows /all /quiet” command to delete shadow copies. On the other hand, if your backups are stored on external drives or cloud storage, you are good. In this case, remove .bip file extension-related malware ASAP. If backups do not exist, it is unlikely that there is anything else you can do besides prepping yourself and your operating system to face malware in the future.

Whether or not you manage to restore files that were encrypted and whose names were changed to include the .bip file extension, you need to do two things. First and foremost, you must delete Dharma Ransomware, and you need to choose how to do it. Some users will be able to follow the manual removal instructions available below. Others will choose to install automated anti-malware software. We suggest taking this path because the right software can automatically remove the ransomware, and, most important, ensure reliable protection. Protecting your operating system against malware is the second thing you need to do. You also need to back up your files (new ones if you are unable to salvage any of the encrypted ones) to ensure that they are safe even if malware strikes again. Remember that you will be able to prevent malware from slithering in only if you take appropriate security measures.

If you still have questions that need answering, add them to the comments section, and our research team will review them as soon as possible. You should definitely add questions if you still have questions about the removal of .bip file extension-related ransomware.

.bip file extension Removal

1. Find and Delete the {random name}.exe file that launched Dharma Ransomware.
2. Simultaneously tap Win+E to launch Explorer.
3. Enter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup into the bar at the top.
4. Delete the copy of the malicious file erased in step 1.
5. Enter %WINDIR%\System32 into the bar at the top.
6. Delete the copy of the malicious file erased in step 1.
7. Enter %APPDATA% into the bar at the top.
8. Delete the ransom note file called Info.hta
9. Enter %WINDIR%\System32\ into the bar at the top.
10. Delete the ransom note file called Info.hta.
11. Move to the Desktop.
12. Delete the ransom note file called FILES ENCRYPTED.txt.
13. Simultaneously tap Win+R to launch RUN.
14. Enter regedit.exe into the field to access Registry Editor.
15. Move to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN.
16. Delete two {random name} values that represent the malicious .exe file and the ransom note file.
17. Empty Recycle Bin to get rid of these components.
18. Install a trusted malware scanner and then immediately perform a full system scan.