Ransomware

[Duckie]

Hello,

I got a Ransomware, Gandcrab V2.0 , on my laptop.  I used Malwarebytes premium to scan my laptop, but I can still not open my documents.

Please have some one an answer?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[nikhils]

Moving this topic to the Malware removal section.

One of our Experts will help you with this issue.

Thank you.

[Aura]

Hi Duckie  

Can you upload an encrypted file to ID-Ransomware, and copy/paste the report URL here?

https://id-ransomware.malwarehunterteam.com/

[Duckie]

Hi Aura,

It say:  This ransomware had no known way of decrypting data at this time.

( GandCrabv2 )

[Aura]

Sadly, as stated by ID-Ransomware, there's nothing that can be done for your encrypted files, unless you can restore them from a recent back up that you have. The best thing you can do at the moment is store them somewhere safe and hope that a free decryption solution will be released in the future.

[Duckie]

Is it enough to delete the infected documents or must I installed a clean windows 10 again. I run it several times with malware bytes premium.

[Aura]

Your documents aren't infected, just encrypted. They aren't a threat to your system. And there's no need to reinstall Windows 10 again. GandCrab deleted itself once it finished encrypting your files.

[Aura]

Hi Duckie,

Was there any other issues to address, or that was it?

[Aura]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks