How to Remove GandCrab2 Ransomware and decrypt .CRAB files

What is GandCrab2 ransomware

GandCrab2 is a new notorious ransomware, that is distributed quite largely around the world. This virus is encrypting all the personal and sensitive files, which means a victim can’t open or access them anymore until the files are decrypted. Once the files are encrypted, GandCrab2 Ransomware will demand to pay ransom in order to decrypt files, this is stated in ransom note CRAB-DECRYPT.txt. The cost of it is really large. Warning! If your files are encrypted by GandCrab2 ransomware, we recommend not to waste your time and money – do not pay for decryption, because cyber criminals are not going to help anyone. Still, you may remove GandCrab2 ransomware and decrypt .GandCrab2 files without paying anything.

The way this ransomware works is quite simple – first of all, GandCrab2 breaks through your system, then starts encrypting procedure with AES encryption algorithm. GandCrab2 ransomware adds .CRAB extension to the name of all the encrypted files. For example, video.mp4 file turns into video.mp4.CRAB file. Once all the data is encrypted, the ransomware drops CRAB-DECRYPT.txt on your desktop. You may find demands of cyber criminals in it, here is GandCrab2 ransom note:

—= GANDCRAB =—

Attention!

All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB

The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

1. Download Tor browser – hxxps://www.torproject.org/

2. Install Tor browser

3. Open Tor Browser

4. Open link in tor browser: hxxp://gdcbmuveqjsli57x.onion/113737081e857d00

5. Follow the instructions on this page

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.

If you can’t download TOR and use it, or in your country TOR blocked, read it:
1. Visit hxxps://tox.chat/download.html
2. Download and install qTOX on your PC.
3. Open it, click “New Profile” and create profile.
4. Search our contact – 6C5AD4057E594E090E0C987B3089F74335DA75F04B7403E0575663C26134956917D193B195A5
5. In message please write your ID and wait our answer: 113737081e857d00

DANGEROUS!

Do not try to modify files or use your own private key – this will result in the loss of your data forever!

There are two solutions of this problem. First is to use special Removal Tool. Removal Tools delete all instances of malware by few clicks and help user to save time. Or you can use Manual Removal Guide, but you should know that it might be very difficult to remove GandCrab2 ransomware manually without specialist’s help.

GandCrab2 Removal Guide

1. Download GandCrab2 Removal Tool.
2. Remove GandCrab2 from Windows (7, 8, 8.1, Vista, XP, 10) or Mac OS (Run system in Safe Mode).
3. How to restore files
4. How to protect PC from future infections.

How to remove GandCrab2 ransomware automatically:

Download Norton Security This removal tool can help you to get rid of this nasty virus and clean up your system. In case you need a proper and reliable solution, we recommend you to download and try it. This anti-ransomware removal tool is able to detect and remove GandCrab2 ransomware from your system.

Manual GandCrab2 Removal Guide

Here is step-by-step instructions on how to remove GandCrab2 from Windows and Mac computers. Follow this steps carefully and remove files and folders belonging to GandCrab2. First of all, you need to run system in a Safe Mode. Then find and remove needed files and folders.

Uninstall GandCrab2 from Windows or Mac

Here you may find the list of confirmed related to the ransomware files and registry keys. You should delete them in order to remove virus, however it would be easier to do it with our automatic removal tool. The list:

CRAB-DECRYPT.txt
GandCrab2.exe
igkphg.exe
wruoud.exe
r.exe
%APPDATA%\Microsoft\igkphg.exe
%APPDATA%\Microsoft\wruoud.exe

Windows 7/Vista:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to GandCrab2 by using Removal Tool;
5. Delete found files;

Windows 8/8.1:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to GandCrab2 by using Removal Tool;
5. Delete found files;

Windows 10:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to GandCrab2 by using Removal Tool;
5. Delete found files;

Windows XP:

1. Restart the computer;
2. Press Settings button;
3. Choose Safe Mode;
4. Find programs or files potentially related to GandCrab2 by using Removal Tool;
5. Delete found files;

Mac OS:

1. Restart the computer;
2. Press and Hold Shift button, before system will be loaded;
3. Release Shift button, when Apple logo appears;
4. Find programs or files potentially related to GandCrab2 by using Removal Tool;
5. Delete found files;

How to restore encrypted files

If you can’t decrypt your files or just don’t want to use those instructions, you can try to restore your files with special tools. You may find these tools below in this section.

Restore data with Stellar Data Recovery

This program can restore the encrypted files, it is easy to use and very helpful.

1. Download and install Stellar Data Recovery
2. Choose drives and folders with your data, then press Scan.
3. Select all the files in a folder, then click on Restore button.
4. Manage export location. That’s it!

Download Stellar Data Recovery

Restore encrypted files using Recuva

There is an alternative program, that may help you to recover files – Recuva.

1. Run the Recuva;
2. Follow instructions and wait until scan process ends;
3. Find needed files, mark them and Press Recover button;

How to prevent ransomware infection?

It is always rewarding to prevent ransomware infection because of the consequences it may bring. There are a lot of difficulties in resolving issues with encoders viruses, that’s why it is very vital to keep a proper and reliable anti-ransomware software on your computer. In case you don’t have any, here you may find some of the best offers in order to protect your PC from disastrous viruses.

Malwarebytes

Download Norton Security

SpyHunter is a reliable antimalware removal tool application, that is able to protect your PC and prevent the infection from the start. The program is designed to be user-friendly and multi-functional.

In case this instruction would not help, you can always contact us via our email – submit@securitystronghold.com. We can help you to decrypt your files.