.BWNG Virus Files Removal + Recovery Guide

BWNG Virus Files – How to Remove + Restore Files

This is an article that provides specific details on .BWNG virus infection as well as a step-by-step removal followed by alternative data recovery approaches.

remove BWNG virus ransomware restore BWNG files stf

BWNG Virus Files

When your files are locked with a few extensions the last of which is .BWNG your computer system is infected with Matrix ransomware. This new strain dubbed BWNG virus is developed to alter essential system settings and misuse system functionalities with the primary goal to encrypt personal files without being detected by any active security measures. The encryption is realized with the help of a highly sophisticated encryption technique that leaves files completely inaccessible. The long string of specific extensions [billwong73@yahoo.com].{random letters and numbers}-{again random letters and numbers}.BWNG appears after the original names of encrypted files. Finally, the threat drops a ransom message to extort a ransom payment.

Threat Summary

NameBWNG virus
TypeRansomware, Cryptovirus
Extensions[billwong73@yahoo.com].<8 random chars>–<8 random chars>.BWNG
Short DescriptionA data locker ransomware designed to damage computer systems and encrypt valuable personal fles.
SymptomsImportant files are locked and renamed with a string of a few extensions. The last extension is .BWNG
Ransom message insists on a ransom payment
Ransom Note!BWNG_INFO!.rtf
Distribution MethodSpam Emails, Email Attachments, Corrupted Software Installers, Hacked Websites
Detection Tool See If Your System Has Been Affected by BWNG virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss BWNG virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

BWNG Virus (Matrix Ransomware) – Distribution and Impact

The .BWNG viurs files is called to a new strain of Matrix ransomware. This ransomware is currently lurking across the web. Security researchers cannot say which the primary distribution method is. Based on our experience of researching and reporting malicious software we guess that the BWNG virus is spread via well-known techniques like malspam, malvertising, freeware installers, fake software update notifications, and corrupted web pages. Malspam is likely to be the most preferred one. It is realized via email spam messages that attempt to deliver malicious code on targeted PCs. E-mails used for malicious purposes usually contain one or more of the following components:

  • A link that lands on compromised web page set to download and execute the infection file directly on the PC.
  • A malicious file attachment masked as a legitimate document and uploaded in a .rar or .zip archive. Such a file could be set to evade detection and this way tricks you into allowing the ransomware to start on your PC.

As a typical data locker ransomware BWNG virus primarily aims to corrupt predefined types of files stored on infected PCs. Before the threat can reach the encryption stage it needs to establish additional malicious files that will support the entire infection process.

Once all malicious files are established on the system the ransomware initiates a long sequence of system modifications by which it becomes able to misuse the functionalities of main system processes. As a result, the BWNG virus files start automatically every time you start the infected system. To prevent the ransomware from loading automatically you need to clean malicious values from system registry by accessing the Registry Editor. This may be a hard task for less experienced computer users. The good news is that there are specific tools that can help you complete this process without causing permanent system damage.

For the encryption stage, BWNG virus activates a special module that scans all system drives for certain types of files that are likely to store valuable personal data. Whenever the ransomware detects a target file, it transforms its code by utilizing a strong cipher algorithm. Changes leave encrypted files inaccessible until their code is reverted back to its original state. Unfortunately, you may not be able to view the information stored by the following files of yours:

  • Audio files
  • Video files
  • Document files
  • Image files
  • Backup files
  • Banking credentials, etc

One way to recognize an encrypted file is by the extension .BWNG appended to its name. Additionally, you could see the email address billwong73@yahoo.com, as well as two extensions – 8 random alphanumeric combinations each, appended as file extensions. This email address is associated with cybercriminals who stand behind BWNG ransomware attacks. It could be also noticed in the ransom message that appears at the end of the infection process !BWNG_INFO!.rtf

ransom note !BWNG_INFO!.rtf BWNG virus files stf

Here is what it states:


Yоur filеs wеrе еnсrуptеd with strоng сrуptо аlgоrithms.
* Plеаsе nоtе thаt thеrе is nо wау tо dесrуpt уоur filеs withоut uniquе dесrуptiоn kеу аnd spесiаl sоftwаrе. Yоur uniquе dесrуptiоn kеу is sесurеlу stоrеd оn оur sеrvеr.
* Tо dесrуpt уоur dаtа уоu nееd оur spесifiс аutоmаtiс dесrуptiоn tооl аnd уоur uniquе dесrуptiоn kеу.
* Аll уоur filеs wеrе rеnаmеd but аftеr dесrуptiоn prосеss filеnаmеs will bе rесоvеrеd tо оriginаl stаtе. Dаtа struсturе will nоt сhаngе.
* Plеаsе bе surе thаt аll thе аttеmpts tо rесоvеr уоur filеs bу уоursеlf оr using third pаrtу tооls саn rеsult in irrеvосаblе lоss оf уоur dаtа!

First оf аll уоu hаvе tо writе us bу е-mаil:
Оur first е-mаil: billwong73@yahoo.com
Оur sесоnd е-mаil: billwong73@protonmail.com
Оur third е-mаil: billwong73@aol.com

If уоu wаnt tо rесоvеr уоur dаtа plеаsе writе us tо аll оur е-mаil аdrеssеs!
It is rеаllу impоrtаnt bесаusе оf dеlivеrу prоblеms with sоmе mаil sеrviсеs!
Plеаsе bе surе wе аrе аlwауs in tоuсh аnd rеаdу tо hеlp уоu!
If уоu will nоt rесеivе оur аnswеr in 24 hоurs, plеаsе rеsеnd уоur mеssаgе!
Plеаsе аlwауs сhесk SPАM fоldеr!
* Writе оn English оr usе prоfеssiоnаl trаnslаtоr

In subjесt linе writе уоur pеrsоnаl ID:

Fоr уоur аssurаnсе уоu саn аttасh up tо 3 smаll еnсrуptеd filеs tо уоur mеssаgе. Wе will dесrуpt аnd sеnd уоu dесrуptеd filеs fоr frее.
* Plеаsе nоtе thаt filеs must nоt соntаin аnу vаluаblе infоrmаtiоn аnd thеir tоtаl sizе must bе lеss thаn 5Mb.

Plеаsе dоn’t wоrrу!
Bе surе thаt уоur dаtа саn bе RESTОRED TОDАY!
Wе аrе in tоuсh 24/7 аnd rеаdу tо hеlp уоu!
If уоu nоt rесеivеd оur аnswеr plеаsе rеsеnd уоur mеssаgе tо аll е-mаil аdrеssеs!

We know that you need to restore encrypted files but we recommend that you refrain from transferring money to cybercriminals. Otherwise, you risk losing both your valuable files and money. For the sake of your security, it is advisable to clean your infected computer from present malicious files and consider the help of alternative data recovery methods.

Remove BWNG Virus Files (Matrix Ransomware)

The so-called BWNG virus which is a strain of Matrix ransomware is a threat with highly complex code that causes damage to both essential system settings and valuable data. Hence, the only way to use your infected computer in a secure manner again is to remove all malicious files and objects created by the ransomware. For the purpose, you can follow our step-by-step ransomware removal guide.

In the event that you want to attempt to restore .BWNG files with the help of alternative data recovery methods, do check the step – Try to Restore files encrypted by BWNG virus. We remind you to back up all encrypted files to an external drive before the recovery process.

Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for four years, researching malware and reporting on the latest infections.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share