Emsisoft Decrypter for BigBobRoss allows for the decryption of files encrypted by the BigBobRoss ransomware.

BigBobRoss is written in C++ using QT and uses AES-128 ECB to encrypt your files, and adds the extension ".obfuscated." There are also some variants that prepend the victim ID to the filename. The ransom note "Read Me.txt" asks the victim to contact a specific bigbobross@ email address.

Make sure you remove the malware from your system first. Otherwise, it will repeatedly lock your system or encrypt files. The decrypter requires access to a ransom note left by the malware.

To use Emsisoft Decrypter for BigBobRoss follow the steps:

Download the decrypter from the same site that provided this “How To” document.
Run the decrypter, and select a ransom note as requested. Then click the “Start” button
The decrypter will display the reconstructed encryption details once the recovery process has
finished.

We have also zipped the PDF help file along with the decrypter.

Below is an example of a BigBobRoss ransom note:

Hello, dear friend!
=================================================
1- [All your files have been ENCRYPTED!]
Your files are NOT damaged! Your files are modified only.
The only way to decrypt your files is to receive the decryption program.
your files can not be decrypted without the special program we made it for your computer.
=================================================
2- [ HOW TO RETURN FILES? ]
To receive the decryption program Write to our email "BigBobRoss@computer4u DOT com"
and tell us your unique ID
=================================================
3- [ FREE DECRYPTION! ]
Free decryption as guarantee.
We guarantee the receipt of the decryption program after payment.
To believe, you can give us 1 file that must be less than 1MB and we decrypt it for free.
File should not be important to you! databases, backups, large excel sheets, etc.
=================================================
4- [ Instruction ]
the easiest way to buy bitcoins is LocalBitcoins site. you have to register, click "buy bitcoins"
and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
=================================================
CAUTION!
please do not change the name of files or file extension if your files are important to you!
Your unique ID : [ID]