How to Eliminate Blue Eagle Ransomware (Crypto-Malware/Ransomware)

What is Blue Eagle ransomware? And how does it execute its attack?

Blue Eagle ransomware is a new file-encrypting threat capable of taking victim’s files as hostage in exchange for a ransom. This new ransomware was first observed in the final weeks of October 2017. According to researchers, Blue Eagle seems to be created by an independent group of hackers. After its successful infiltration, Blue Eagle ransomware scans all the directories in the affected computer looking for files to encrypt. It seems to target files with the following file extensions:
.aif, .apk, .arj, .asp, .bat, .bin, .cab, .cda, .cer, .cfg, .cfm, .cpl, .css, .csv, .cur, .dat, .deb, .dmg, .dmp, .doc, .docx, .drv, .gif, .htm, .html, .icns, .iso, .jar, .jpeg, .jpg, .jsp, .log, .mid, .mp3, .mp4, .mpa, .odp, .ods, .odt, .ogg,.part, .pdf, .php, .pkg, .png, .ppt, .pptx, .psd, .rar, .rpm, .rss, .rtf, .sql, .svg, .tar.gz, .tex, .tif, .tiff, .toast, .txt, .vcd, .wav, .wks, .wma, .wpd, .wpl, .wps, .wsf, .xlr, .xls, .xlsx, .zip.
The ransomware then starts its attack by encrypting the files using the AES encryption algorithm and appends the .SaherBlueEagleRansomware extension on each of the files. Once it is done with the encryption, Blue Eagle opens a program window that displays the following text:
“Blue Eagle Ransomware
tills rderboonivare was LUtleti try loaner woe eagle) So to sum up [All of your usable files have been encrypted safely].
######################################
How do i set my files free?
######################################
You can use Decrypt in this Program,simply But it will ask you for a password , So to get the password you have to pay me at bitcoin and don’t close internet connection , because closing internet connection will lead you to lose Connection to AI (“Verci”) because every PC has it’s own signature , so if you don’t follow the steps you will lose your files forever .
######################################
How do I get password ?
######################################
Just we told you Step #1 : Never Stop Internet connection (you will be at risk)
Step #2 : Pay Bitcoin (1.25) and the AI will send you the Password (Once you receive password Decrypt and reinstall new windows version).
Payment
My Bitcoin : Sorry Man This is a Massive Destruction Test
[Check for Payment|BUTTON]
File Extensions
[Decrypt my files|BUTTON]”
As you can see, its ransom note states that the encrypted files can only be recovered using a special tool and a unique decryption key that will only be given to you if you pay 1.25 Bitcoins which is approximately $7070. This is actually an absurd amount and you should not even consider paying these crooks – not even a cent as it does not really guarantee that they will hold their end of the bargain and give you the decryption key or special tool to decrypt your files. The best thing you can try to do to recover your files is to use the Windows
Previous version feature. This is a really good alternative you can try for as long as the ransomware hasn’t deleted the shadow volume copies of the encrypted files.
How does Blue Eagle ransomware proliferate?
According to Usunwirusa.pl technicians, this ransowmare proliferate using illegal and rogue downloads found on malicious websites. Aside from that, the crooks behind this ransomware also utilize spam email attachments where they attach a corrupted file in the email responsible in installing Blue Eagle ransomware in the system. Moreover, it can also spread through Remote Desktop Protocol or RDP connection by taking advantage of poor security in the system which is why it is recommended that you always keep your system updated to avoid such occurrences.
Step1. Open the Task Manager by simply tapping Ctrl + Shift + Esc keys on your keyboard.
Step2. Under the Task Manager, go to the Processes tab and look for any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to Blue Eagle ransomware.

Step3. After that, close the Task Manager.
Step4. Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step5. Under the list of installed programs, look for Blue Eagle ransowmare or anything similar and then uninstall it.

Step6. Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step7. Navigate to the following locations below and look for Blue Eagle ransomware’s malicious components such as SaherBlueEagleVirus.exe and shadowdeleter.exe as well as other suspicious files and then delete all of them.

%TEMP%
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step8. Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then by all means go on to the next steps.
Step9. Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step10. Navigate to the following path:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Step11. Delete the registry keys and sub-keys created by Blue Eagle ransomware.
Step12. Close the Registry Editor and empty your Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if Blue Eagle ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

It is important to make sure that nothing is left behind and that Blue Eagle ransomware is completely removed use the following antivirus program. To use it, refer to the instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOSscreen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Optionuse the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Boxwill show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. Installation will start automatically once download is done.