GANDCRAB Ransom Ware

up vote
-2
down vote

favorite

Today my whole drive got affected by GandCrab Ransom Ware .

All file extensions got converted to .IREVY

Files which are already zipped didn't get affected but the files which were not zipped got encrypted.

I tried https://www.nomoreransom.org/en/index.html and downloaded tool for GANDCRAB. But it didn't work.

https://www.nomoreransom.org/en/index.html

They left this file on my system:

**---= GANDCRAB V5.0.4 =---
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .IREVY

The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/4ca90b3581afa92

| 4. Follow the instructions on this page

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAAEGn3d2/CCa67HCRwo7I7EVTBaFS6agkhyUAM/WBL9R6MTvbbr+8IvWMghubwDpx25hyijP0FQkyOp64qlSo2GUTqPu+LrPCFeZOodC24avQ/SDC9A0+QlSGjNGSoRPlx9tiTeAMM5A3BxlDMjuQ+cUFnkhD33x/O0hWLxtS3rXxi2B5voas6b9ITAQWrSY87UrkJ72fO1QOBpI8/JdA+A6nZEhdfFKTScJQhicW88RR2ZKyslZ0e5io7ucVT30Xn0Vcyf+zaW7gDyxoH8NiHRzn+YEd8uVk9SHEMdiGmv5GdDqmApp6d01jmjbClzGdmpX7AYFOPXgSpmK+odyxY1GAtieuCHsHzk76ZNmlm2IZqYFpKojMyjdYqw5rlCeicHL3mvsU2qNfrhzDbwQH8cxNfCFf5zGjzBCcrmbnHsuuQknSSq3OrIdtnwC7pjmJRwIgdtmdvFrVOyGbl9qRDyvfA1Iy7mAd0mZKXiPq2TertDnlzIz4h6NVprmYXuiIAaGOBy+eUO+rjDUB33NvHowIo1NE8EtrXvKeGWCwHChpGSzx8CpFFw9mR22zdnAq4QT9ybndAH5KOZNxoJHtB5CvxKyxriFbdTe8w/GLGZCu98msBQzvGLtYwnnEkkpg/CfXdw2v0YG7cYqxnOjY9zb57jQBiZDO3znkwmOWS9orjdriRzS0l94RX4FXpY1zgpSzWtU+rWs6NMHAtMWI6PJnnQZYn63E3MNMBVnzmKCES71Dkb0KuCnIJ1lBPOAmJX2Dfx2sW26/61kAm5IhKHtx8rcc4dcuVzDRWKWAWLPKDv1n4eOqRlPxmvftt5QLG4lzWSlm60lywokz2/RKOIARu3sIcRRwELvWez5YEZwziDzB+OYU4QjuIEuqd7Xbvp/1NNL5hb5Utp4Mk+GVzSPS2P5sTsDZtYCOcoQ5zt9va64s9CfDlTsRjPdSLkjQ3bnLO21tpkjzFlVPaB4ldbQNS59OUkTs55PmbvEF5eo9t1m58Ai+UuwBzYNHK4ArNTBOMPGpWhVCVwsmY3pgDNtw6qC+9KF/Osnqr+iMhZy9wsIjPZ7re6S7vR+I8aO3XGDyM4eJCODSxdKS/ta6rzxw0nV/2RtAj6SIEzN+ug5FSuWa4j79WXh51NnM58QuImI7S4aKN7i3KXbpwRHL9XJkMgHL5Cw+JJSujgBVyVIl313omdnucXOJWPSLD7WOOwW6fizUw1bc4kj1NK4nRTFRKphe23F+1SB2bNHfuhdmKlBQnuMPhXFj+0zXvYt4PXFwSIHyp8Mf5ca3sUi61I0D5EEmAr/6JWaocyWI2nWW3WlCaC2tmvmu+J6xZ09XxwLe44hVoMPZMSDIsIjajgdvGGEyH9gqRTwxOukpie+DJ8adM0k+9IDu0S7hKXJxMLeZORpcZztfk8+SASAywHDdj2y9oWc3JGzzCkX07oNoyraLa2jcfWUdUuzrLW8dH6br24p6KfHnqBhADKmOrJuU+LRmGtm6z7Gv4jMvABrcUqlW4SYE6DWmtevWjkQshnNlHpYlXRB8/Hfb/AHKIo+TS4jjUDpLXovPAd4oFyHHjPxRhkrnUwH6r0xPIDfuaPk/vndWcy/pdCSyt6GhCqM99cZTZH2AayEz+pTeq3ttvBHfTD8BTaaapKItCsIVXmmqjVDn18X2zFsf4Gr1+S1IRNKmgW+0zg29TznSe6iNbzv+YsZr1h6HSx6abL29nGozT4eL3XG17qqYoze830AXdVw9fnD4PMthoExulGslp5CLA4dnhLuHmsLztfZeNHPT2EG4xADy1k7Xn6QHOYahudEG9Gzabtkmj6tY0oZTxVz+ye7zemjopcM9lntu97NjK98H9lRybBytIqGrYQgUBEGthbJezoDeXmVzSOZab9n8hiQs4Qu5+nzcvxJkHnf841s4VqmANqaYnQGxeZ5ey/1HYoOHamLpYnJdENzqbHFdDRlCxsKHTZy7TRgJJrWUPzvEG7ysTnwoy9XPW3oBmxX0qsEYo/72FglWChgo9xDYsz7jU/N6K9k5mDr9l/0ihEuvW/6dmEVHRE+Ns+fPjltP76HQoZ7a7y0izRcLU86iOCZDwtF/uhlRlQDXH5KjTaksMNVc5eJwlACZr+fpPeiNY86PSCjE4CFkJCU8SAZsdk8P2bjLb5Wp7G76g2QvCUhtTMvEfmX5ORsT77Gudigj7L4m+tGHyzByEpW8ieB7VeT5n4056eJnrMiqMMIem6c=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U6KxHVakOW3tzzwmOrT1y1YWvOiWMx5GYaRdvZZTTpJRrXYU7mxWqrfFTAyH8B4vBM/zqtM175z6DEHBDDniDpJO89rFN//AmFuoI5B0Lo+j+Pxp2XHxFJKzioGhekSJAvkAmrZdOLuXzbnHbX0kenQSbYaWrMDgYZxYUqSExoEpBo4u2+2ASFK2ZBVV5gOWuUvcNSI72MeMGUP9MLYP1IpiLFWTDpxFmtYoHXY9P/E/VvrQ1vhziTbkjcVAG3g9l8xnYN0/CA8xcA7dDNcr8n0pSirFDw+8kc4tJdipqcqnsrro569iurExkR3B9uL7/yU2fut0GoJYKFqOBm/tqxHSEc8b4ydD4oe4eKa+Y5ZyBoz62S+izJQfTTwqP1O2JIIJ8ZFrwNcoDBPJnP4+XO4OALafj2Egg/RrfA29xANKsw79ZlnpcBEl3oDLRebG1w4ZNHQURlCKeDnV1lfgc38ImUDfnCztQU1nm7Ipls2w6nIPVY/pdDf2fBQcdMB/PwJNiH8gQwjCs6Y3EpftQ0itBYlMbZH0HpoOeL/IRdEPo4l4V6Lu4LPXzMf9OnYNh88z7+xARfltWv/dbj3WveITXoxeRtQh9DRhQ1K12stg5mm1LVEzkQsHfmT5GGFWiT4EzLIDT7PbFgFtKdv/zjNodH03tG4Hfa6U6HJgLfW8XB0SXd0DTdZUjV7f9grrwlAu/MUpmILgy4rzOn5tEit9DjBIpBtOYBkCubxHZkgy9ssXO8Sla0/SrrBOko8yQ7zD0+7y46TluS3x3JlhaPmM57A13srCV8oJlhUuifzd1CiGDvHvQ/HVl/8FCAMHecXqvqf8L+rB/rNmvTYDBl3tZoRd4k6ZPvpOeJ3TC/Ar+TrIgK28PLDNA/HEVpU=
---END PC DATA---**

edited Nov 18 at 12:02

asked Nov 18 at 11:50

jack_07

6311

1

You do take regular backups, don't you?
– rossum
Nov 18 at 12:46

2

Sorry for your loss but this is not a programming question and thus is off-topic.
– James K Polk
Nov 18 at 14:44

I do, but it's in my external hard drive. And at some extent it also get affected. But I formatted my PC and removed the Virus. @rossum
– jack_07
Nov 19 at 1:36

add a comment |

up vote
-2
down vote

favorite

Today my whole drive got affected by GandCrab Ransom Ware .

All file extensions got converted to .IREVY

Files which are already zipped didn't get affected but the files which were not zipped got encrypted.

I tried https://www.nomoreransom.org/en/index.html and downloaded tool for GANDCRAB. But it didn't work.

https://www.nomoreransom.org/en/index.html

They left this file on my system:

The server with your key is in a closed network TOR. You can get there by the following ways:

| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/4ca90b3581afa92

| 4. Follow the instructions on this page

edited Nov 18 at 12:02

asked Nov 18 at 11:50

jack_07

6311

1

You do take regular backups, don't you?
– rossum
Nov 18 at 12:46

2

Sorry for your loss but this is not a programming question and thus is off-topic.
– James K Polk
Nov 18 at 14:44

I do, but it's in my external hard drive. And at some extent it also get affected. But I formatted my PC and removed the Virus. @rossum
– jack_07
Nov 19 at 1:36

add a comment |

up vote
-2
down vote

favorite

Today my whole drive got affected by GandCrab Ransom Ware .

All file extensions got converted to .IREVY

Files which are already zipped didn't get affected but the files which were not zipped got encrypted.

I tried https://www.nomoreransom.org/en/index.html and downloaded tool for GANDCRAB. But it didn't work.

https://www.nomoreransom.org/en/index.html

They left this file on my system:

The server with your key is in a closed network TOR. You can get there by the following ways:

| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/4ca90b3581afa92

| 4. Follow the instructions on this page

edited Nov 18 at 12:02

asked Nov 18 at 11:50

jack_07

6311

Today my whole drive got affected by GandCrab Ransom Ware .

All file extensions got converted to .IREVY

Files which are already zipped didn't get affected but the files which were not zipped got encrypted.

I tried https://www.nomoreransom.org/en/index.html and downloaded tool for GANDCRAB. But it didn't work.

https://www.nomoreransom.org/en/index.html

They left this file on my system:

The server with your key is in a closed network TOR. You can get there by the following ways:

| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/4ca90b3581afa92

| 4. Follow the instructions on this page

encryption

edited Nov 18 at 12:02

asked Nov 18 at 11:50

jack_07

6311

edited Nov 18 at 12:02

asked Nov 18 at 11:50

jack_07

6311

edited Nov 18 at 12:02

asked Nov 18 at 11:50

jack_07

6311

asked Nov 18 at 11:50

jack_07

6311

asked Nov 18 at 11:50

jack_07

6311

1

You do take regular backups, don't you?
– rossum
Nov 18 at 12:46

2

Sorry for your loss but this is not a programming question and thus is off-topic.
– James K Polk
Nov 18 at 14:44

I do, but it's in my external hard drive. And at some extent it also get affected. But I formatted my PC and removed the Virus. @rossum
– jack_07
Nov 19 at 1:36

add a comment |

1

You do take regular backups, don't you?
– rossum
Nov 18 at 12:46

2

Sorry for your loss but this is not a programming question and thus is off-topic.
– James K Polk
Nov 18 at 14:44

I do, but it's in my external hard drive. And at some extent it also get affected. But I formatted my PC and removed the Virus. @rossum
– jack_07
Nov 19 at 1:36

You do take regular backups, don't you?
– rossum
Nov 18 at 12:46

Sorry for your loss but this is not a programming question and thus is off-topic.
– James K Polk
Nov 18 at 14:44

I do, but it's in my external hard drive. And at some extent it also get affected. But I formatted my PC and removed the Virus. @rossum
– jack_07
Nov 19 at 1:36

add a comment |

active

oldest

votes

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53360533%2fgandcrab-ransom-ware%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

active

oldest

votes

draft saved

draft discarded

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Argthtjtr