Solved! Files getting Gandcrabbed what should I do?

[Usman Aly]

(For moderators: If I posted this in wrong section can you please move this thread to a proper section?)

Hi guys,
Going through the worst nightmare. Recently I started seeing a file named IVRGVHQ-DECRYPT.txt in my folders. Mostly in my projects folder I didn't bother because I thought maybe it's related to software until recently I started seeing this file everywhere on my PC.

Now the issue is a lot of my projects are encrypted with this ransomware there is one notepad file which states install tor & go to the link (Which is in that text file I mentioned earlier) other than that there is a Gandcrab key at the end. I don't see my system locked out or any notification of time to pay ransom of anything else. Let me know what I can do to recover those files.

The worst part is that it kept growing in background & it also infected my backup because I didn't realise until today. When I wanted to restore some stuff from my backup. I see the date created (of encryption text file) as today on most files but the earliest I found is two to three months old. Need your help & fast so it doesn't spread more than it have already.

Update: Unable to download Gandcarb decrypt tool mentioned by bitdefender. Gets stuck at 99%.
Update 02: Tried using bit defender & Avast decryptor but they didn't decrypt the files. Maybe the decrypt key file is missing?
Does anyone have idea where the decrypt file is stored or how can I make sure that the ransomware if not active on my pc anymore?

 

[Ralston18]

Download and run Malwarebytes free - it may be able to clean out some infection.

Check Task Manager: There may be some application launching in startup that is causing the encryptions.

Would not click or go to any links with "remedy" instructions: i.e., "install tor and go to link".

Think that doing so may make things worse via some other nasty download.

Do remember that there are other available anti-encryption tools to be found. E.g.:

https/success.trendmicro.com/solution/1114221-downloading-and-using-the-trend-micro-ransomware-file-decryptor

 

[Usman Aly]

Download and run Malwarebytes free - it may be able to clean out some infection.

Check Task Manager: There may be some application launching in startup that is causing the encryptions.

Would not click or go to any links with "remedy" instructions: i.e., "install tor and go to link".

Think that doing so may make things worse via some other nasty download.

Do remember that there are other available anti-encryption tools to be found. E.g.:

https/success.trendmicro.com/solution/1114221-downloading-and-using-the-trend-micro-ransomware-file-decryptor

Already done Malwarebytes didn't catch anything. Bitdefender didn't catch anything. Avast's decryptor found 2.1k files encrypted.

Can't find anything fishy already gone through everything.

Yeah I know there is a reason they asked me to use tor.

Trendmicro doesn't have Gandcrab in it's list. I went through the list of supported anti-encryption methods it supports.
Link to the supported Ransomware:
https/success.trendmicro.com/solution/1114221-downloading-and-using-the-trend-micro-ransomware-file-decryptor

 

[Ralston18]

Most likely all you can do is keep hammering at it.

Not sure about the details of what you have done or not done per se.

Link with additional background and information:

https/malwaretips.com/blogs/remove-gandcrab-v5-0-4-ransomware/

Malware bytes - nothing caught. Try other AV tools.

Two objectives:

1) Stop/block further file encryptions. Both on the infected computer and other connected computers.

2) Unencrypt the currently encrypted files. May not be possible now but perhaps in the future...

Start planning and preparing to restore as best you can from older backups.

Do protect those backup files by copying them to media and then restore from that media. Do not risk connecting infected devices to uninfected devices.

In any case, something may work out. If not you will know that you gave it a good try....