What is GandCrab ransomware
GandCrab ransomware is actively distributed right now and uses several different ways to infect computers. A user can get this ransomware downloaded after they open a PDF attachment in a spam email (which will open a Word document which will ask the user to enable editing). Or they may, for example, encounter the “HoeflerText’ font wasn’t found” scam page and download and run the offered file. GandCrab ransomware upends .GDCB extensions to the files it encrypts and dumps GDCB-DECRYPT.txt file with decryption instructions to every folder. At the time of writing GandCrab is still a new ransomware variant, and security specialists are not done researching it. So far no free GandCrab decryptor exists (and it is not guaranteed that it will be created – that might happen if researchers find some fault in the ransomware code that will allow them to obtain decryption keys, or, for example, if someone gets access to GandCrab’s Command & Control servers where the key are stored). However, there are some other ways to recover GandCrab encrypted files that may or may not work in each separate case.
Feb 28 Update: Bitdefender released a free decryptor for GandCrab. You can find it here.
How to Remove GandCrab Ransomware
If you have working backups of your encrypted files or you are not going to try and recover lost files, then scan your computer with one or several antivirus and anti-malware programs or reinstall the operatig system altogether.
Spyhunter by Enigma Software Group is a good anti-malware program against ransomware, spyware, rootkits and other types of malicious software.
However, if you want to try all possible ways of recovering encrypted files, including data recovery tools, then I suggest you use these tools first and scan with anti-malware later. Skip to the explanation
How to Recover Files Encrypted by GandCrab Ransomware
Once your files are encrypted by ransomware, you have several ways to possibly recover them:
Going further, we need to 1) stop ransomware from encrypting files that we recover, if malware is still active; 2) try not to overwrite files deleted by ransomware. The best way to do it is disconnect your hard drive and connect it to another computer. You will be able to browse all your folders, scan them with antivirus programs, use file recovery software or restore data from Shadow Volume Copies. Although it is better to download all tools you’ll need beforehand and disconnect the computer from the Internet before connecting the infected hard drive, just to be safe.
Disadvantages of this method:
- This might void your warranty.
- It’s harder to do with laptops, and you’ll need a special case (disk enclosure) to put a hard drive in before connecting it to another machine.
- It is possible to infect the other computer if you open a file from the infected drive before scanning the drive with AVs and removing all found malware; or if all AVs fail to find and delete the malware.
Another, easier, way is to load into Safe Mode and do all file recovery measures from there. However, that will mean using the hard drive and potentially overwriting some data. In this case it’s preferable to use only portable versions of recovery software (the ones that don’t require installation), download them onto an external device, and save any recovered files onto an external device too (external hard drive, thumb drive, CD, DVD, etc.).
Boot Into Safe Mode:
Windows XP, Windows Vista, Windows 7:
- Restart the computer.
- Once you see a boot screen tap F8 key continuously until a list of options appears.
- Using arrow keys, select Safe Mode with Networking.
- Press Enter.
Windows 8, Windows 8.1, Windows 10:
- Hold down Windows key and hit X key.
- Select Shut down or sign out.
- Press Shift key and click on Restart.
- When asked to choose an option, click on Advanced options => Startup Settings.
- Click Restart in the bottom right corner.
- After Windows reboots and offers you a list of options, press F5 to select Enable Safe Mode with Networking.
Back up Your Encrypted Files
It is alwayse advisable to create a copy of the encrypted files and put it away. That might help you if free ransomware decryptor becomes available in the future, or if you decide to pay and get the decryptor but something goes wrong and files get irreparably damaged in the process of decryption.
Use File Recovery Tools to Recover Files
Puran File Recovery (free for non-commercial use)
R-Undelete (free version allows recovery of files under 256KB in size for Windows)
Recover Encrypted Files From Shadow Copies.
The easiest way to access Shadow Volume Copies is by using a free tool called Shadow Explorer. Just download the latest version and install it (or download the portable version).
- Launch Shadow Explorer.
- On the top left part of the window you can select a disk (C:\, D:\, etc.) and a date when a snapshot of files was taken.
- To recover a file or a folder right-click on it and select Export….
- Choose where do you want to put the files.
Remove GandCrab Ransomware
Now that you have your recovered or still encrypted files on an external device, it is time to scan your computer with AV and anti-malware software or, better yet, reinstall the operating system, to fully get rid of possible ransomware traces. Remember to also scan your external device before putting files back on your computer!