A new iteration of the well-known Jigsaw ransomware has been detected by security researchers, and it is known to append the .Bitconnect extension to encrypted files. As reported by researcher Michael Gillespie, the ransomware is using a new extortion method where it demands the victim to take a photo of himself/herself and post it on Instagram. This article will help you to remove the .Bitconnect file virus (Jigsaw ransomware) from your system.
|Name||.Bitconnect File Virus|
|Short Description||The ransomware encrypts files and appends the .Bitconnect extension to them.|
|Symptoms||Files on the system are encrypted.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by .Bitconnect File Virus |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .Bitconnect File Virus.|
.Bitconnect File Virus – Distribution
Jigsaw ransomware and its .Bitconnect iteration could infect computers using different methods for spreading itself to victims. Spam e-mails are most likely distributing its payload dropper. These types of emails will try to convince the potential victim that something important is attached as a file where in fact the attachment is a file containing a malicious script. Upon opening the file, the payload of the ransomware is typically launched.
An analysis of one such file carrying the .Bitconnect file virus is available on VirusTotal .
Also, keep in mind that the .Bitconnect iteration of the Jigsaw ransomware might be using other methods for distribution, like using file-sharing websites and social media to further spread the payload file dropper. Freeware applications could also be hiding the malicious files of this ransomware.
To stay protected, be extra cautious when opening files after you download them, especially if they come from unverified sources and unknown senders. You may want to scan such files with a security tool, and also make sure to check their sizes and signatures for anything that seems out of the ordinary. More ransomware preventing tips are available in our forum.
.Bitconnect File Virus (Jigsaw Ransomware) – Technical Details
The Jigsaw ransomware ransomware keeps on appearing on the radar of malware researchers, as its coders continue to release new iterations. Many of these iterations are themed with the Jigsaw character from the movie series “SAW”.
Typically, when the Jigsaw file virus (in this case the .Bitconnect iteration) is executed, it will modify an existing entry in the Windows Registry or create a new one to achieve persistence. That registry entry makes the malware to automatically execute with each boot of the system.
In particular, the .Bitconnect file virus is using a new extortion method where it demands the victim to take a photo of himself/herself and post it on Instagram.
A Jigsaw decrypter was developed by security researcher Michael Gillespie for victims to get their files back without paying the ransom. However, keep in mind that the ransomware has many iterations, and this decrypter does not work on all of them. In case you are not able to decrypt your files, you may want to try alternative methods of file restoration.
.Bitconnect File Virus (Jigsaw Ransomware) – Removal
If your computer got infected with the .Bitconnect iteration of the Jigsaw ransomware, it is highly recommended to get rid of this ransomware as quickly as possible before it gets the chance to spread further and infect other computers. Instructions on how to remove the ransomware are provided below. Depending on your own experience in malware removal, you can either remove it manually or rely on an anti-malware program to do it for you.
In addition, there are alternative methods for file recovery that exclude ransom payment. You can find them in the second part of the guide below.