Remove .BadNews Files Virus (LockCrypt Ransomware) + Restore Data

Remove .BadNews Files Virus (LockCrypt Ransomware) + Restore Data

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

How To Decode Files hta BadNews ransomware ransom note sensorstechforum

This article gives insight into .BadNews files virus infection process. Additionally, you will find a thorough removal guide and alternative data recovery approaches.

A ransomware named after its associated extension .BadNews has been spotted in the wild. Security researchers identified that is belongs to the LockCrypt ransomware family. An infection with this threat leads to the corruption of valuable data and essential system settings. Corrupted files could be recognized by the specific extension .BadNews which is appended to their names.

Threat Summary

Name.BadNews files virus
TypeRansomware, Cryptovirus
Short DescriptionA data locker ransomware that encrypts target files stored on the infected computer and then demands a ransom for thier decryption.
SymptomsImportant files are locked and renamed with .BadNews extension. A ransom message extorts payment for a decryptor possesed by hackers.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by .BadNews files virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .BadNews files virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.BadNews Files Virus – Methods of Distribution

For an infection with .BadNews files virus its payload needs to be executed on a target host. This could happen with the help of several methods known to be used for ransomware distribution. The most probable one is considered to be malspam. Malspam is a technique that enables hackers to launch massive email spam campaigns against online users worldwide. Such emails are usually designed in a similar way and some of their traits are counterfeit sender and email address. However, the tricky part is that in an attempt to make users more prone to infect run the malware code on their devices, cyber criminals often use the names of well-known companies, trustworthy websites, and governmental institutions. As of the messages presented by these emails they could provoke a sense of urgency which is needed for the successful compromise of the system. Where the malicious code usually hides is in file attachments of common file types and in the code of corrupted web pages, the URLs of which are directly posted in the email message. And in case that you take the bite you fall victim to .BadNews files virus as any interaction with these components grants the ransomware access to your system.

.BadNews Files Virus – Overview

The so-called .BadNews files virus is an iteration of LockCrypt ransomware. The analysis of its samples reveals that it has a complex code that enables it to implement various malicious activities and eventually plague the whole system.

In order to fulfil the attack .BadNews ransomware first needs to establish its malicious files on the system. And there are several common folders used by malware of this kind to store its files:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%
  • %Windows%

The infection itself begins when the ransomware payload is started on the system. It is designed to access essential system resources and this way to attain the needed persistence. Some of its malicious files are likely to enter the Registry Editor as some of the keys stored there have the perfect functionalities that could support many of the malicious activities. So in case that your system has been compromised by this LockCrypt ransomware variant you definitely need to check all registry entries and eliminate all traits of malicious misuses.

At its final stage .BadNews files virus needs to request the display of its ransom note on the PC screen. For this purpose, it may set specific values under the Run or RunOnce registry sub-key and which will cause the automatic appearance of the note on the display. It is also possible that you will see an image generated by .BadNews on your desktop:

How To Decode Files.hta .BadNews ransomware ransom note sensorstechforum

The ransom note file is named How To Decode Files.hta and all it reads is:

Your ID ***********
To get the decryptor you should:
Send 1 test image or text file to
In the letter include your personal ID (look at the beginning of this document).
We will give you the decrypted files and say price fordecryption all files after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have thedecoder.
Only can decryptyour files
Do not trust anyone
Attempts to self-decrypting files will result in the loss ofyour data
Decoders for other IDs are not compatible with your ID data, because each user’s unique encryption key

The amount of the demanded ransom remains unknown but it is likely that hackers will want it to be in Bitcoin. For the sake of your security, you should avoid its payment and attempt to restore files with the help of available alternative data recovery methods. More about them is revealed in the removal guide at the end.

.BadNews Files Virus – Encryption Process

As a version of LockCrypt ransomware .BadNews crypto virus is believed to utilize the same combination of highly sophisticated cipher algorithms to encrypt target files. These ciphers may be the AES-256 and RSA-2048. Once applied to the original code of target files they transform it in a way that restricts your access to the information they store. Target types of files are predefined:

→.incpas, .mp4, .pab, .st6, .sas7bdat, .wmv, .backup, .drf, .ibank, .3ds, .odg, .cer, .tif, .cs, .dotx, .7z, .png, .bak, .ibz, .db3, .pbl, .3fr, .dxf, .nk2, .bkp, .mdf, .svg, .xlm, .3dm, .pct, .java, .pot, .sxi, .ibd, .sxw, .pspimage, .ppt, .kbx, .ppsm, .ndd, .txt, .pdb, .say, .backupdb, .fla, .swf, .asx, .accdt, .mp3, .ycbcra, .erf, .cr2, .pfx, .potx, .qby, .sqlite, .blend, .class, .pat, .odp, .gray, .qbw, .tib, .thm, .htm, .mos, .rm, .key, .std, .tlg, .lua, .pst, .sqlitedb, .grey, .cdr4, .dc2, .ce1, .ps, .tex, .eml, .xlam, .pages, .st8, .jar, .st7, .potm, .sdf, .db-journal, .pcd, .aspx, .rwl, .kpdx, .fmb, .xlr, .gry, .kc2, .oil, .moneywell, .xlk, .sti, .accdr, .oth, .c, .xml, .nd, .mdb, .pem, .erbsql, .bpw, .ffd, .ost, .pptm, .dwg, .zip, .qbm, .cdx, .des, .dng, .pdd, .cfp, .nyf, .cgm, .sldm, .xla, .odf, .raf, .crw, .mef, .raw, .x11, .nsd, .fff, .design, .dcs, .ptx, .al, .ns2, .bik, .back, .accdb, .nwb, .cpi, .ads, .odt, .sqlite3, .docm, .drw, .pl, .nx2, .fpx, .rdb, .otp, .msg, .accde, .agdl, .php, .csv, .py, .rtf, .ach, .sda, .ddd, .asf, .dotm, .cmt, .h, .hbk, .xlsx, .s3db, .tga, .wav, .iif, .dxb, .sql, .db, .sd0, .bgt, .djvu, .jpg, .doc, .craw, .mpg, .sxd, .kdc, .jpeg, .psafe3, .flac, .dtd, .act, .qba, .vob, .cdrw, .eps, .bkf, .mdc, .rar, .mov, .cdf, .m4v, .ab4, .bank, .pps, .cib, .dot, .dgc, .exf, .flv, .xlsb, .ddrw, .adb, .srw, .plc, .csh, .xls, .fxg, .otg, .pas, .xlt, .indd, .rwz, .xltx, .apj, .stw, .xltm, .orf, .ott, .qbb, .max, .cls, .obj, .docx, .dcr, .cdr3, .qbx, .pdf, .nef, .ots, .srt, .ddoc, .rat, .phtml, .m, .dbx, .nxl, .avi, .p12, .awg, .dbf, .ns3, .mmw, .prf, .wallet, .rw2, .jin, .odc, .qbr, .ppsx, .ns4, .wpd, .wps, .nsh, .dxg, .fhd, .dac, .wb2, .nrw, .odb, .ait, .jpe, .odm, .sldx, .fdb, .acr, .war, .oab, .sxc, .cpp, .r3d, .hpp, .asm, .st5, .stx, .xis, .dds, .xlsm, .p7c, .cdr5, .3g2, .mrw, .sr2, .html, .cdr, .idx, .st4, .bdb, .kdbx, .nsg, .der, .ods, .myd, .nop, .ppam, .pptx, .yuv, .xlw, .mfw, .nsf, .csl, .php5, .p7b, .crt, .asp, .srf, .jsp, .cdr6, .sxm, .iiq, .3gp, .ce2, .arw, .bay, .ai, .sxg, .psd, .3pr, .fh, .pef, .x3f, .sik, .bpp, .vmdk, .spi, .bup, .cvt, .bb, .fkc, .tjl, .dbk, .swp, .fb, .vib, .dtb, .bke, .old, .bkc, .jou, .rpb, .abk, .sav, .bkn, .tbk, .fbw, .vrb, .spf, .bk, .sbk, .umb, .ac, .vbk, .wbk, .mbk

After encryption corrupted files have the distinctive extension .BadNews appended to their names.

Remove .BadNews Files Virus and Restore Data

Below you could find how to remove .BadNews ransomware step by step. Beware that ransomware is a threat with highly complex code that plagues not only your files but your whole system. To remove the ransomware manually you need to have a bit of technical experience and ability to recognize traits of malware files. So as recommended by security researchers you need to utilize an advanced anti-malware tool for its complete removal. Such a tool will keep your system protected against devastating threats like .BadNews and other kinds of malware that endanger your online security.

After you remove the ransomware make sure to check the “Restore Files” step listed in the guide below. But before you take any further actions, don’t forget to back up all encrypted files to an external drive in order to prevent their irreversible loss.

Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for three years, researching malware and reporting on the latest infections.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share