An infection with the dangerous XiaoBa Ransomware leads to serious security issues. Victims can restore and protect their computers by following our complete removal guide.
Remove XiaoBa Ransomware and Restore PC
Manual Removal Guide
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Distribution of XiaoBa Ransomware
The XiaoBa Ransomware is a malware threat which at the moment has been spotted in a very limited attack wave. Due to the yet unknown criminals behind its launch the security experts cannot deduce which is the primary distribution method. As such we suspect that the most popular strategies are going to be employed.
One of them relies on creating email messages in an automated way which all deliver the XiaoBa Ransomware to the targets. A common way of doing this is by attaching the strains directly to the messages. This is one of the easiest way for the criminals to attempt the infection. However a lot of email hosting providers usually capture the signatures of the virus and as such discard such messages or label them as dangerous or spam. Other infection methods related to this one is the option of inserting hyperlinks in the body content of the messages. The links are usually labeled as leading to a familiar website or a file of user interest. Redirects can redirect to hacker-controlled sites, infected payloads or other instances that can lead to an XiaoBa Ransomware infection.
The computer criminals behind the malware can create malicious sites or download portals which distribute malware of different kinds, including the XiaoBa Ransomware. A popular option is the use of infected documents which may be of different types ‒ spreadsheets, rich text documents, presentations and databases. They are modified to initiate the virus once the built-in scripts are run. Usually when the files are opened a notification will ask the users to run the macros (scripts). If this is done the infection follows.
The hacker-controlled sites are specialist portals that have been created either manually or automatically by the criminals behind the XiaoBa Ransomware. They can either directly distribute the threat by initiating various scripts or automated operations or link to such instances. Redirects are usually caused by email interaction, ad networks or other browsing activity. However one of the main sources is the availability of browser hijackers. They are malicious addons made for the most popular web browsers ‒ Mozilla Firefox, Google Chrome, Internet Explorer, Opera, Microsoft Edge and Safari. Once installed they not only infect the users with the malware, but also redirect the victims to a hacker-controlled site. Depending on the configuration the browser hijackers can also steal sensitive information such as any stored passwords, account credentials, history, bookmarks, form data and settings.
Impact of XiaoBa Ransomware
The XiaoBa ransomware is a hybrid virus which has been spotted by security analysts as a new threat to computer users worldwide. At this moment there has been only a limited amount of captured samples which doesn’t give out the exact way of infecting victims. There is no information available on the hackers identity. The criminal or the hacker collective have probably used original code in XiaoBa ransomware’s design as the initial code analysis did not show a correlation between the identified samples and any of the famous malware families.
XiaoBa ransomware at the moment contains only a basic encryption engine. Depending on the way it has been programmed it can be further modified to include other features and additions. Advanced viruses include modules such as the following:
- Trojan Module ‒ The criminals behind the XiaoBa ransomware can use this module to spy on the compromised machines at all times.
- Data Theft ‒ The dangerous instances can be used to hijack files before they are encrypted by the ransomware engine.
- Remote Control ‒ The hackers can take over control of the victim machine at any given time.
The analysis shows that the XiaoBa ransomware is capable of causing a wide range of modifications to the Microsoft Windows operating system. This includes a block of the startup repair ‒ this prevents users or applications from automatically recovering the default startup state. As a result the XiaoBa ransomware can disable important processes that can interfere with system services, cause performance issues and disable certain functionality. The ransomware engine can delete the volume snapshots of the computers. They are used to recover the files using the built-in information made by the operating system. Access controls to victim files is modified to reflect the specific hacker scenario. This is done by both modifying the file attributes and meddling with the UAC security options. If required the XiaoBa ransomware can launch processes on its own as well. The infection module hijacks important information from the victim machine ‒ the computer name, the unique cryptographic machine ID and various user-related information and settings values. They are used to generate strings used during the encryption process to create the unique infection ID.
A characteristic feature is the ability to modify the auto-execution settings by manipulating the Windows registry. System information is harvested both from the system log files and base details including the Windows Management Instrumentation Commandline (WMIC) interface. Other important features include the following:
- Mutant Creation ‒ The XiaoBa ransomware is capable of creatin mutex copies on the infected computers.
- Shell Commands Execution ‒ The virus code is able to execute commands either automatically or when instructed by the hackers.
- Windows Files Modification ‒ XiaoBa ransomware is capable of modifying files in the Windows folder.
Once all preliminary tasks have been complete the encryption process is initiated. Like all popular threats it uses a built-in list of target file type extensions which are encrypted using a strong cipher. Examples of affected files include: images, videos, music, documents, archives, configuration files, backups and etc. As a result all files are renamed using a random sequential numbering extension from .XiaoBa1 to .XiaoBa34 .
Two files are created on the victims computer which hold the ransomware message:
- _@XiaoBa@_.bmp ‒ The wallpaper image which is used to modify the desktop background.
- _@Explanation@_.hta ‒ The ransomware message itself.
The message is written in Chinese:
Ooops, your important files have been encrypted!
！—— 重要加密 —— ！
你柏所有文件已被 RSA-2048 AES-128 算法進行了加密
請硕縦破解 , 因為您無 眷破解文件可能導致文壊 這可能會損害他們
只有我們的解密辦捕解密您的文件
如果您看到這個壁紙卻看不到 “XiaoBa” 窗口 , 那麼就是您的防病毒軟件
刪除了此解密軟件或葡恣從計算機中刪除了它
如果您需要您的文件I必須運行解密軟件
請找到解密軟件或從防病毒軟件隔雜區還原
運行解密軟件 , 並按照說明進行操作
請向指定地址發送約1200元人民幣=180.81$的比特幣
比特幣錢包：1GoD72v5gDyWxgPuBph7zQwvR6bFZyZnrB
想獲取更多信息請點擊桌面的 _@Explanation@_.hta
E-mail:[email protected]
An automated English-based translation reads the following:
! —— Important encryption ——!
All your files have been encrypted by the RSA-2048 AES-128 algorithm
Please master the crack, because you have no dependencies to crack the file may cause essays which may harm them
Only our decryption does not capture and decrypt your files
If you see this wallpaper but can not see the “XiaoBa” window, then your anti-virus software
Removed this decryption software or removed it from the computer
If you need your file I must run decryption software
Please find decryption software or restore from anti-virus software glitches
Run the decryption software and follow the instructions
Please send Bitcoin of about 1200 RMB = 180.81 $ to the designated address
Bitcoin wallet: 1GoD72v5gDyWxgPuBph7zQwvR6bFZyZnrB
For more information, click on the desktop’s _ @ Explanation @_. Hta
E-mail: [email protected]
The image itself contains another message type in English which reads the following:
Unlock method:
To unlock your computer, you need to purchase this software
How to Buy: Send bitcoins of about 250 RMB = 37.696 $ to the specified address
Bitcoin Address: 1NodpehhyEnJZUE3vsGXHm8RYLfydMZkv4
After payment send e-mail to the specified e-mail address
E-mail address: [email protected]
Mail title: Important information
E-mail content: Your ID + your payment information
After sending you will get a reply, reply to the message contains
the Key, please enter in the box next to.After entering, press [Enter] key to confirm, the program will unlock your computer.
Victims of the threat should not interact with the hackers in any way. The only effective solution to restore the affected data and delete the active infections. Follow our guide below for detailed instructions.
Remove XiaoBa Ransomware and Restore PC
WARNING! Manual removal of the XiaoBa Ransomware requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
XiaoBa Ransomware – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Remove XiaoBa from Windows
Here’s a way to remove the program. This method will work regardless if you’re on Windows 10, 8, 7, Vista or XP. Simply selecting the program and pressing delete won’t work, as it’ll leave a lot of small files. That’s bad because these leftovers can linger on and cause all sorts of problems. The best way to delete a program is to uninstall it. Here’s how you can do that:
1. Hold the “Windows” button (It’s between CTRL and Alt on most keyboards) and press “R”. You’ll see a pop-up window.
2. In the textbox, type “appwiz.cpl”, then press“ Enter ”.
3. The “Programs and features” menu should now appear. It’s a list of all the programs installed on the PC. Here you can find the program, select it, and press “Uninstall“.
Remove XiaoBa Virus From Your Browser
Before resetting your browser’s settings, you should know that this action will wipe out all your recorded usernames, passwords, and other types of data. Make sure to save them in some way.
-
1. Start Mozilla Firefox. In the upper right corner, click on the Open menu icon and select “Add-ons“.
2. Inside the Add-ons Manager select “Extensions“. Search the list of extensions for suspicious entries. If you find any, select them and click “Remove“.
3. Click again on the Open menu icon, then click “Options“.
4. In the Options window, under “General” tab, click “Restore to Default“.
5. Select “Search” in the left menu, mark the unknown search engine and press “Remove”.
-
1. Start Google Chrome. On the upper-right corner, there a “Customize and Control” menu icon. Click on it, then click on “Settings“.
2. Click “Extensions” in the left menu. Then click on the trash bin icon to remove the suspicious extension.
3. Again in the left menu, under Chrome, Click on “Settings“. Go under “On Startup” and set a new page.
4. Afterward, scroll down to “Search“, click on “Manage search engines“.
5. In the default search settings list, find the unknown search engine and click on “X“. Then select your search engine of choice and click “Make default“. When you are ready click “Done” button in the right bottom corner.
2. In the “Manage add-ons” window, bellow “Add-on Types“, select “Toolbars and Extensions“. If you see a suspicious toolbar, select it and click “Remove“.
3. Then again in the “Manage Add-ons” window, in “Add-on Types“, Select “Search Providers“. Chose a search engine and click “Set as default“. Select the unknown search engine and click “Remove and Close”.
4. Open the Tools menu, select “Internet Options”.
5. In the “General” tab, in “Home page”, enter your preferred page. Click “Apply” and “OK”.
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
