Blower@india.com ransomware virus (Decrypt, Restore encrypted files)

If your personal files does not open normally, .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut, .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promorad, .promok, .promorad2, .kroput, .kroput1, .charck, .pulsar1, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden or .drume file extension added at the end of their name then your machine is infected with malicious software called Blower@india.com ransomware from a family of file-encrypting ransomware. Once started, it have encrypted all personal files stored on a computer drives and attached network drives.

The Blower@india.com ransomware is a variant of crypto viruses. It affects all current versions of Windows OS like the Windows 10, Windows 8, Windows 7, Windows Vista and Windows XP. This ransomware virus uses strong encryption method to eliminate the possibility of brute force a key that will allow to decrypt encrypted documents, photos and music. The Blower@india.com ransomware virus encrypts almost of files, including common as:

wallet, .xls, .dazip, .xy3, .p12, .3fr, .svg, .wps, .mrwref, .accdb, .ptx, .wpw, .wm, .mddata, .cr2, .z3d, .asset, .xyw, .iwd, .py, .pak, .x, .esm, .ods, .ff, .txt, .sb, .menu, .m2, .3ds, .t13, .wmv, .x3f, .psk, .fpk, .cdr, .wmo, .pkpass, .odm, .pst, .fsh, .rofl, .pdf, .odp, .ybk, .ppt, .vdf, .indd, .p7b, .rgss3a, .wmf, .wp4, .xlsx, .m3u, .mdf, .y, .docx, .srw, .csv, .ws, .pem, .vpk, .dba, .wpa, .xpm, .webp, .ysp, .wpg, .xlsm, .raf, .eps, .rar, .wbk, .wpt, .js, .xdl, .zif, .mpqge, .mcmeta, .hvpl, .sidn, .pfx, .kdb, .wire, .hkx, .xmind, .wri, .itm, .wbc, .db0, .vpp_pc, .odb, .forge, .lbf, .orf, .dbf, .xlk, .sis, .ai, .icxs, .xlsm, .ncf, .xlsb, .pptx, .wsc, .mef, .psd, .rim, .wp6, .wpb, .ibank, .kdc, .3dm, .xml, .zabw, .dng, .itdb, .arw, .pptm, .gho, .rb, .xar, .1, .sid, .dcr, .jpeg, .x3d, .wp7, .arch00, .cfr, .jpg, .wb2, .xbplate, .sav, .w3x, .p7c, .lvl, .bay, .nrw, .sql, .mp4, .docm, .wsd, .wma, .wdb, .png, .vcf, .xyp, .css, .xdb, .jpe, .xls, .xll, .wdp, .wot, .slm, .pef, .apk, .layout, .r3d, .wav, .xwp, .wbd, .xlsx, .sidd, .ztmp, .rwl, .kf, .rtf, .dxg, .wpd, .doc, .tor, .upk, .bc7, .sr2, .big, .rw2, .wmd, .zdc, .sie, .bik, .t12, .zw, .syncdb, .1st, .xx, .bkp, .vfs0, .wn, .erf, .zip, .hplg, .wps, .wbz, .0, .desc, .das, .crt, .fos, .wpd, .raw, .lrf, .wbmp, .yml, .xbdoc, .itl, .wp5, .avi, .crw, .wotreplay, .wgz, .bkf, .tax, .mdbackup, .m4a, .odt, .zdb, .zi, .mdb, .ltx, .webdoc, .wpl, .bc6, .xxx, .vtf, .zip, .blob, .der, .dwg, .dmp, .wp, .cas, .wma, .2bp, .yal, .snx, .xld, .ntl, .7z, .re4, .bar, .cer, .pdd, .epk, .xlgc, .wpe, .bsa, .litemod, .gdb, .wsh, .odc, .sum, .xmmap, .flv, .iwi, .map, .mov, .wcf, .srf, .z, .wbm, .wmv

When the virus encrypts a file, it will add the .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut, .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promorad, .promok, .promorad2, .kroput, .kroput1, .charck, .pulsar1, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden or .drume file extension to every encrypted file. Once the ransomware finished enciphering of all files, it will drop a file called _openme.txt, _readme.txt, or _open_.txt with ransom demanding message on how to decrypt all documents, photos and music. You can see an one of variants of ransom demanding message above.

Instructions that is shown below, will help you to remove Blower@india.com ransomware as well as restore (decrypt) encrypted files stored on your computer drives.

Table of contents

1. How to remove Blower@india.com ransomware virus
2. How to decrypt files encrypted by Blower@india.com ransomware
3. Use STOPDecrypter to decrypt Blower@india.com ransomware
4. How to restore files encrypted by Blower@india.com ransomware
5. How to protect your personal computer from Blower@india.com ransomware virus?
6. To sum up

How to remove Blower@india.com ransomware virus

The following instructions will help you to remove Blower@india.com ransomware and other malicious software. Before doing it, you need to know that starting to remove ransomware, you may block the ability to decrypt documents, photos and music by paying developers of the virus requested ransom. Zemana Anti-malware, Kaspersky virus removal tool and Malwarebytes Anti-malware can detect different types of active ransomwares and easily remove it from your computer, but they can not recover encrypted photos, documents and music.

Remove Blower@india.com ransomware with Zemana Anti-malware

We recommend using the Zemana Anti-malware. You can download and install Zemana Anti-malware to detect and remove Blower@india.com ransomware virus from your machine. When installed and updated, the malware remover will automatically scan and detect all threats present on the system.

Installing the Zemana Anti-Malware (ZAM) is simple. First you’ll need to download Zemana AntiMalware (ZAM) on your Windows Desktop from the link below.

After the downloading process is finished, run it and follow the prompts. Once installed, the Zemana Free will try to update itself and when this process is complete, press the “Scan” button to perform a system scan with this utility for the Blower@india.com ransomware and other security threats.

A scan can take anywhere from 10 to 30 minutes, depending on the number of files on your system and the speed of your personal computer. While the Zemana AntiMalware (ZAM) program is scanning, you can see how many objects it has identified as threat. In order to remove all threats, simply press “Next” button.

The Zemana Anti Malware (ZAM) will remove Blower@india.com ransomware and other security threats and move threats to the program’s quarantine.

Use MalwareBytes Anti Malware (MBAM) to remove Blower@india.com ransomware

Manual Blower@india.com ransomware removal requires some computer skills. Some files and registry entries that created by ransomware can be not fully removed. We recommend that run the MalwareBytes Anti-Malware that are completely free your PC system of virus. Moreover, this free program will allow you to delete malicious software, trojans, worms, adware that your computer can be infected too.

Please go to the following link to download MalwareBytes AntiMalware. Save it on your Microsoft Windows desktop or in any other place.

When the download is finished, close all programs and windows on your personal computer. Open a directory in which you saved it. Double-click on the icon that’s named mb3-setup like below.

When the install begins, you’ll see the “Setup wizard” that will help you set up Malwarebytes on your personal computer.

Once installation is finished, you’ll see window as shown on the image below.

Now click the “Scan Now” button . MalwareBytes utility will start scanning the whole system to find out Blower@india.com ransomware virus and other malware. This process can take quite a while, so please be patient. While the tool is checking, you can see how many objects and files has already scanned.

Once MalwareBytes Anti Malware has finished scanning your PC system, MalwareBytes will produce a list of malicious software. You may remove threats (move to Quarantine) by simply press “Quarantine Selected” button.

The Malwarebytes will now start to delete Blower@india.com ransomware and other malicious software. When that process is finished, you may be prompted to reboot your PC system.

The following video explains steps on how to delete browser hijacker infection, adware software and other malicious software with MalwareBytes Anti-Malware.

Run KVRT to delete Blower@india.com ransomware from the personal computer

If MalwareBytes anti-malware or Zemana anti malware cannot remove this ransomware virus, then we advises to run the KVRT. KVRT is a free removal utility for ransomware, trojans, worms and other malicious software.

Download Kaspersky virus removal tool (KVRT) on your Microsoft Windows Desktop by clicking on the following link.

Once the downloading process is finished, double-click on the Kaspersky virus removal tool icon. Once initialization procedure is finished, you will see the KVRT screen as shown on the screen below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next press Start scan button to find Blower@india.com ransomware virus . A scan may take anywhere from 10 to 30 minutes, depending on the count of files on your PC system and the speed of your computer. When a malware is found, the count of the security threats will change accordingly. Wait until the the scanning is done.

As the scanning ends, KVRT will open a scan report as displayed on the image below.

You may delete threats (move to Quarantine) by simply click on Continue to begin a cleaning task.

How to decrypt files encrypted by Blower@india.com ransomware

The Blower@india.com ransomware virus uses strong encryption mode. What does it mean to decrypt the files is impossible without the private key. Use a “brute forcing” is also not a way because of the big length of the key. Therefore, unfortunately, the only payment to the makers of the Blower@india.com ransomware entire amount requested – the only method to try to get the decryption key and decrypt all your files.

If your documents, photos and music have been locked by the Blower@india.com ransomware virus, We suggests: do not to pay the ransom. If this malware make money for its authors, then your payment will only increase attacks against you. Of course, decryption without the private key is not possible, but that does not mean that the Blower@india.com ransomware must seriously disrupt your live.

With some variants of Kroput Ransomware, it is possible to decrypt or restore encrypted files using free tools such as STOPDecrypter, ShadowExplorer and PhotoRec.

Use STOPDecrypter to decrypt Blower@india.com ransomware

Michael Gillespie (@) released a free decryption tool named STOPDecrypter (download from download.bleepingcomputer.com/demonslay335/STOPDecrypter.zip).

STOPDecrypter has been updated to include decryption support for the following .djvu* variants (.djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut, .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promorad, .promok, .promorad2, .kroput, .kroput1, .charck, .pulsar1, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden or .drume). STOPDecrypter will work for any extension of the Djvu* variants including new extensions.

Please check the twitter post for more info.

How to restore files encrypted by Blower@india.com ransomware

In some cases, you can restore files encrypted by Blower@india.com ransomware virus. Try both methods. Important to understand that we cannot guarantee that you will be able to restore all encrypted documents, photos and music.

Restore encrypted files with ShadowExplorer

If automated backup (System Restore) is enabled, then you can use it to restore all files encrypted by Blower@india.com ransomware to previous versions.

Installing the ShadowExplorer is simple. First you’ll need to download ShadowExplorer by clicking on the link below.

Once downloading is finished, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as displayed on the image below.

Run the ShadowExplorer utility and then select the disk (1) and the date (2) that you want to recover the shadow copy of file(s) encrypted by the Blower@india.com ransomware virus as on the image below.

Now navigate to the file or folder that you wish to restore. When ready right-click on it and click ‘Export’ button as shown below.

Recover encrypted files with PhotoRec

Before a file is encrypted, the Blower@india.com ransomware virus makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to restore your files using file recover programs like PhotoRec.

Download PhotoRec by clicking on the link below. Save it to your Desktop so that you can access the file easily.

When downloading is finished, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as displayed in the figure below.

Double click on qphotorec_win to run PhotoRec for Microsoft Windows. It will open a screen as shown on the image below.

Choose a drive to recover like below.

You will see a list of available partitions. Choose a partition that holds encrypted files as shown below.

Click File Formats button and select file types to restore. You can to enable or disable the recovery of certain file types. When this is finished, click OK button.

Next, press Browse button to choose where recovered documents, photos and music should be written, then click Search.

Count of recovered files is updated in real time. All restored documents, photos and music are written in a folder that you have chosen on the previous step. You can to access the files even if the recovery process is not finished.

When the restore is finished, click on Quit button. Next, open the directory where recovered documents, photos and music are stored. You will see a contents as shown in the following example.

All restored personal files are written in recup_dir.1, recup_dir.2 … sub-directories. If you are looking for a specific file, then you can to sort your recovered files by extension and/or date/time.

How to protect your personal computer from Blower@india.com ransomware virus?

Most antivirus programs already have built-in protection system against the ransomware. Therefore, if your computer does not have an antivirus program, make sure you install it. As an extra protection, use the HitmanPro.Alert.

Use HitmanPro.Alert to protect your personal computer from Blower@india.com ransomware

All-in-all, HitmanPro.Alert is a fantastic tool to protect your personal computer from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of Microsoft Windows OS from MS Windows XP to Windows 10.

Installing the HitmanPro.Alert is simple. First you will need to download HitmanPro.Alert on your system from the following link.

Once the download is complete, open the directory in which you saved it. You will see an icon like below.

Double click the HitmanPro.Alert desktop icon. Once the utility is opened, you will be displayed a window where you can select a level of protection, as displayed in the following example.

Now click the Install button to activate the protection.

To sum up

After completing the steps above, your computer should be clean from Blower@india.com ransomware virus and other malicious software. Your PC will no longer encrypt your documents, photos and music. Unfortunately, if the tutorial does not help you, then you have caught a new ransomware, and then the best way – ask for help here.