GhostCrypt Ransomware

GhostCrypt Ransomware tries to scare their victims into paying the ransom of 2 Bitcoins, which is more than nine hundred US dollars. Not everyone would pay such amount of money, and since someone uploaded a working decryptor on the Internet, you may not have to. At any case, paying the ransom might be a bad idea. Our researchers noticed that essential information is missing in the note left by the malware’s originators. It makes us doubt whether they plan on keeping their promises. If you want to learn more about GhostCrypt Ransomware, you should continue reading the article. Afterward, you can get rid of the malware with the instructions provided at the bottom of this page.

Like other similar threats, GhostCrypt Ransomware is spread through malicious executable files. Mostly, such data is distributed through email attachments, e.g. fake PDF, Microsoft Word files, and so on. Also, you could infect your system through fictitious update installers. Usually, malware settles in when users launch such files. However, in this case, GhostCrypt Ransomware does not install itself. Thus, if you want to remove the malware, you will only need to delete the infected file that you downloaded yourself.

The encryption process might take some time, based on the amount of data you have on your computer. Eventually, you will notice that all your files have strange extensions, e.g. .Z81928819 or .CWall4. Also, GhostCrypt Ransomware will leave a text document called "READ_THIS_FILE.txt" on your Desktop. The message will tell you how much you should pay or where you must transfer the ransom. The strange part is that it does not say what your unique ID number is or how to contact the malware’s developers. If you read it carefully, you can see that the note does not specify how you will receive this decryption key either. It raises a question whether ransomware’s creators do plan to unlock your encrypted files in the first place.

If you want to decrypt your data, you could consider paying the ransom, but there is a risk of losing a rather substantial sum. In such situation, it is better to look for other options. For instance, our researchers determined that someone had shared a decryptor that can unlock files encrypted by GhostCrypt Ransomware. We cannot guarantee that it will decrypt your data, but you have nothing to lose, so you may as well try it. If the malware caught you off-guard, you should make sure that you will be prepared the next time. Firstly, you should think of the most suitable backup solution for your data. It is also important to avoid suspicious content on the Internet, including unreliable file-sharing sites, spam email, suspicious pop-ups, and so on. If you think that it might be too difficult, you can simply download a trustworthy security tool that will protect your system from malware.

It was mentioned above, that if you want to remove GhostCrypt Ransomware, you should delete a malicious file that launched the malware. It must have been a file that you opened right before your data was encrypted. If you remember its title and know where you saved it, the removal part will be rather easy. Users who do not know where they saved this malicious file, should look for it in the Downloads folder as it is a common location to save the files from the Internet. If you choose the location yourself every time downloading any data, you should check the most commonly used directories, e.g. Desktop.

There is also an automatic removal option that should be easier for the inexperienced users, but it requires to download and install an antimalware software. The security tool should have a scanning feature that could locate the malware and help you erase it automatically. As a result, you will get rid of the ransomware and even other threats that could be on your system. Also, you will have a reliable tool that can ensure your system’s safety.

Erase GhostCrypt Ransomware

1. Press Windows key+E to launch the Windows Explorer.
2. Search for the malicious file in the Desktop or Downloads directories, and all other locations where you might have saved the file.
3. Right-click the malicious file and click Delete.
4. Remove the READ_THIS_FILE.txt file from your Desktop.
5. Close the Explorer.
6. Empty Recycle bin.