XXX Virus Files of Ransomware — How to remove BADJERRY virus?

The Xxx (BADJERRY) virus is a member of the GlobeImposter ransomware family. This ransomware encrypts all data on the user’s PC, including photos, documents, Excel tables, music, videos, and more. During the process, it appends a specific extension to each encrypted file and creates the how_to_back_files.html file in every folder that contains encrypted files.

It is better to prevent, than repair and repent!

When we talk about the intrusion of unfamiliar programs into your computer’s work, the proverb “Forewarned is forearmed” describes the situation as accurately as possible. Gridinsoft Anti-Malware is exactly the tool that is always useful to have in your armory: fast, efficient, up-to-date. It is appropriate to use it as an emergency help at the slightest suspicion of infection.

DOWNLOAD NOW

Gridinsoft Anti-Malware 6-day trial available.
EULA | Privacy Policy | 10% Off Coupon

Subscribe to our Telegram channel to be the first to know about news and our exclusive materials on information security.

What is “Xxx” aka BADJERRY?

BADJERRY can be correctly identify as a ransomware-type infection.

The Xxx ransomware adds its specific “.xxx” extension to the name of each file it encrypts. For example, a photo named “my_photo.jpeg” will be transformed into “my_photo.jpeg.xxx“, and an Excel report named “report.xlsx” will become “report.xlsx.xxx“. This extension change signifies that the file has been encrypted and is inaccessible without the decryption key.

In addition, the ransomware creates a file, aka ransom note how_to_back_files.html, in every folder with encrypted files. It provides information on contacting the Xxx ransomware developers and includes instructions for purchasing the decryption tool. To obtain the decryption tool, victims must contact the ransomware developers via email at [email protected] or [email protected].

Here is a summary for the Xxx virus:

The how_to_back_files.html file by the Xxx ransomware states the following frustrating information:

ENGLISH
YOUR FILES ARE ENCRYPTED!
ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.

To recover data you need decryptor.
To get the decryptor you should:
Send 1 test image or text file

[email protected]
[email protected]

In the letter include your personal ID (look at the beginning of this document).
We will give you the decrypted file and assign the price for decryption all files
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.
Attention!

Only [email protected] and [email protected] can decrypt your files
Do not trust anyone [email protected] and [email protected]
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders other users are not compatible with your data, because each user\'s unique encryption key

The image below gives a clear vision of how the files with “.xxx” extension look like:

Example of encrypted .xxx files

How did I get Xxx ransomware on my computer?

That was a huge number of different ways of ransomware injection.

However, nowadays, there are only two ways of Xxx virus injection – email spam and trojans. You may see a lot of messages in your email stating that you need to pay different bills or to get your parcel from the local FedEx department. But all such messages are sent from unknown email addresses, not from regular official emails of these companies. Moreover, all such letters contain the attached file used as a ransomware carrier. If you open this file – your system will get infected by Xxx virus.

In case of trojan’s presence, scammers will offer you a download and installation of ransomware on your PC. They can disguise it as something legitimate, such as a Chrome update or an update for the software stored on your computer. Sometimes, trojan viruses mask as legit programs and offer to download ransomware as a critical update or a big pack of extensions essential for proper program functioning.

There is also a third way of ransomware injection. However, it has become less and less popular day-to-day. I am talking about peering networks, such as torrents or eMule. No one can control which files are packed in the seeding, so you can discover a vast pack of malware after downloading. If circumstances force you to download something from peering networks – scan every downloaded folder or archive with antivirus software.

How to remove Xxx virus?

In addition to encode a victim’s files, the Xxx infection has also started to install the Azorult Spyware on PC to steal account credentials, cryptocurrency wallets, desktop files, and more.

To ensure the user that ransomware distributors have the decryption tool, they may offer to decrypt several encrypted files. And they are the single owners of this decryption program: Xxx ransomware is an entirely new type, so there is no legit program from anti-malware vendors that can decrypt your files. But such a situation is in momentum: decryption tools update monthly.

However, paying the ransom is a wrong decision, too. There is no guarantee that Xxx ransomware developers will send you the decryption tool and a proper key. And there are a lot of cases when ransomware distributors deceive their victims, sending the wrong key or even nothing. In most cases, you can recover your files for free. Search for available backups, and restore your system using it. Of course, there is a chance that the backup you found is too old and does not contain many files you need. But at least you will be sure that your system has no malware. However, to ensure no malicious programs are in your system after the backup, you need to scan your PC with anti-malware software.

Differences between Xxx virus and congeners

Xxx ransomware is not unique. There is more ransomware of this type: F0x, Howareyou, Agho. These examples of ransomware act in a similar way:

• Encrypting your files
• Adding a specific extension
• Leaving a significant number of ransom notes in every folder

But two things make a difference between this ransomware – the cryptography algorithm used for file encryption and the ransom amount. Victims can sometimes decrypt their files without any payments, using free solutions produced by several anti-malware vendors or even with the decryption tool ransomware creators offer. The last scenario is possible when ransomware distributors have typed your decryption key inside a ransom note. However, as you can already guess, such luck is rare. Ransomware is created for monetary gain, not for jokes or scaring.

Reasons why I would recommend GridinSoft²

The is an excellent way to deal with recognizing and removing threats – using Gridinsoft Anti-Malware. This program will scan your PC, find and neutralize all suspicious processes³.

Download Removal Tool.

You can download GridinSoft Anti-Malware by clicking the button below:

Run the setup file.

When setup file has finished downloading, double-click on the setup-antimalware-fix.exe file to install GridinSoft Anti-Malware on your system.

An User Account Control asking you about to allow GridinSoft Anti-Malware to make changes to your device. So, you should click “Yes” to continue with the installation.

Press “Install” button.

Once installed, Anti-Malware will automatically run.

Wait for the Anti-Malware scan to complete.

GridinSoft Anti-Malware will automatically start scanning your system for Xxx infections and other malicious programs. This process can take a 20-30 minutes, so I suggest you periodically check on the status of the scan process.

Click on “Clean Now”.

When the scan has completed, you will see the list of infections that GridinSoft Anti-Malware has detected. To remove them click on the “Clean Now” button in right corner.

Frequently Asked Questions

How сan I avoid ransomware attack?

Xxx virus doesn’t have a superpower.

You can easily protect yourself from its injection in several easy steps :

• Ignore all emails from unknown mailboxes with a strange unknown address, or with content that has likely no connection to something you are waiting for (can you win in a lottery without taking part in it?). If the email subject is likely something you are waiting for, check carefully all elements of the suspicious letter. A fake email will surely contain a mistake.
• Do not use cracked or untrusted programs. Usually, Trojans distributes as a part of cracked software, possibly under the guise of “patch” which prevents the license check. But untrusted programs are very hard to distinguish from trustworthy software, because trojans may also have the functionality you need. You can try to find information about this program on the anti-malware forums, but the best solution is not to use such programs.
• And to be sure about the safety of the files you downloaded, use GridinSoft Anti-Malware. This program will surely be a perfect shield for your personal computer.

1. My files are encrypted by ransomware, what should I do now?
2. GridinSoft Anti-Malware Review from HowToFix site: https://howtofix.guide/gridinsoft-anti-malware/
3. More information about GridinSoft products: https://gridinsoft.com/comparison