I wrote this article to help you remove Battlefield Ransomware. This Battlefield Ransomware removal guide works for all Windows versions.

Battlefield belongs to the family of ransomware and it is very dangerous. In fact, the battle against it a really hard. It sneaks on your machine in complete silence just like all ransomware pieces. Usually, this type of infections use spam email messages and malicious attachments to get it. However, this is not the only method they use. On the contrary. There are many tactics. Like corrupted links and pages, fake updates, the help of Trojan horses, exploit kits, third-party ads, fake torrents, etc.

Protecting your machine from a ransomware pest requires vigilance. Extra vigilance. Battlefield relies on your distraction and carelessness to dupe you. It hides, it disguises itself and hopes that you will be too distracted to notice it. Well, we guess it was right. Do not make crooks job easier by being negligent. This way you are only making yourself an even easier target. Pay attention to what you open and what you give permission to. Delete emails and social media messages from unknown senders. Avoid shady pages and illegitimate download sources. The only way to spot the intruder in time and prevent it from entering is if you are extra cautious. Otherwise, it simply parades in without you realizing it.

As a classic ransomware, Battlefield does not surprise us with its way of operation. It enters and then encrypts all of your files with the AES-256 encryption algorithm. Everything you have stored on your PC gets locked. This includes pictures, videos, databases, music, files, documents, presentation, and so on and so forth. The infection locks everything and makes it inaccessible to you. It also adds another extension to your data. The “.locked” extension. If you see your files looking like this “[name].[original extension].locked”, know that the files locking process is over and nothing you do could help you open your data. Do not panic when you see this. Battlefield wants you to be scared and quite frankly, most users would be if they see their files like this. However, it is important to remain calm. Otherwise, you may act impulsively and make a horrible decision.

Once your data is encrypted, Battlefield proceeds to the most important step. The blackmailing. It changes your wallpaper and drops the “Battlefield-Decrypter.exe” and “READ_ME.txt” files. According to this messages, if you don’t pay the hackers 50 USD in Bitcoins, your files will stay locked forever. You are also given an email and Bitcoin address to make the payment. Ignore them. Paying will not bring your data back even though the crooks promise it will. They claim that once they receive the money, they will send you a decryptor. However, you should know better than to trust them. After all, they are the ones to encrypt your data in the first place which clearly means that your files are their last concern. They want your money but once they get it, they may not send you the decryption tool.

There are many cases in which once the payment is done, the cybercriminals disappear. Don’t be one of those cases. Realize that you cannot win this battle. Not by complying with their demands. And even if they do send you the tool and you free your data, you still lose. The decryptor doesn’t remove the ransomware itself. It only removes the encryption but what is the point if Battlefield is still there to relock everything hours later. If you want to safely recover your data you have to delete the infection first. Our removal guide below will help you do that in a few simple steps. Once Battlefield is gone for good, use the guide again to try and get your files back. Next time, don’t forget to make backup copies of your most important data. When it comes to ransomware, taking measures in advance is always the best option.

Battlefield Ransomware Removal

Method 1: Restore your encrypted files using ShadowExplorer
Usually, Battlefield Ransomware deletes all shadow copies, stored in your computer. Luckily, the ransomware is not always able to delete the shadow copies. So your first try should be restoring the original files from shadow copies.

1. Download ShadowExplorer from this link: http://www.shadowexplorer.com/downloads.html.
2. Install ShadowExplorer
3. Open ShadowExplorer and select C: drive on the left panel
4. Choose at least a month ago date from the date field
5. Navigate to the folder with encrypted files
6. Right-click on the encrypted file
7. Select “Export” and choose a destination for the original file

Method 2: Restore your encrypted files by using System Restore

1. Go to Start –> All programs –> Accessories –> System tools –> System restore
2. Click “Next“
3. Choose a restore point, at least a month ago
4. Click “Next“
5. Choose Disk C: (should be selected by default)
6. Click “Next“. Wait for a few minutes and the restore should be done.

Method 3: Restore your files using File Recovery Software
If none of the above method works, you should try to recover encrypted files by using File Recovery Software. Since Battlefield Ransomware first makes a copy of the original file, then encrypts it and deletes the original one, you can successfully restore the original, using a File Recovery Software. Here are a few free File Recovery Software programs:

1. Recuva
2. Puran File Recovery
3. Disk Drill
4. Glary Undelete