Guster Ransomware

No one wants to deal with the likes of Guster Ransomware. This malicious infection is terribly annoying and our security experts say that users should remove it from their systems the moment they notice this application. It goes without saying that this program enters your computer with the intention to steal your money by pushing you into paying the ransom fee. However, spending your money on this application is out of question. You should never succumb to the threats from cyber criminals, especially when you know that by paying the ransom fee, you would allow them to continue their illegal practice.

If you have encountered ransomware programs before, you will know that they usually travel around in spam email attachments and Guster Ransomware is no exception. It spreads around via malicious spam email attachments that users download without even realizing it. The problem with such distribution method is that it is very successful, and users often do not understand that they are about to install a malicious application because they think the file offered is an invoice from some online store, or perhaps it is a report from their financial institution. Although most of the spam email messages get filtered into the Junk folder, more often than not the messages that carry malicious programs manage to land in the main Inbox folder. Consequently, users are compelled to open those messages and files that come with them because they think the data is reliable.

Needless to say, this conviction is false, and the moment you launch a malicious file, you get infected with the likes of Guster Ransomware. When that happens, the program will lock your screen with the ransom note that will require you to send a particular sum of money to the given address. Do you really have to pay? Of course not. Who would want to give their money away to cyber criminals?

Therefore, you should not feel intimidated when the text appears on your screen and says the following:

!!! PAY ATTENTION!!!

All of your files (documents, videos, photos, music, pdfs, etc) have been encrypted with a strong military cryptography.
The only way you have to get your files back to you, is paying a fee of 0.4 bitcoins, which worth something about 300,00 USD.

This program also gives you limited time to pay the ransom. If you fail to transfer the fee, Guster Ransomware threatens to delete your files, and you will not be able to retrieve them. On top of that, the malicious ransomware file also plays a text-to-speech audio on a really high volume, and the audio reads out the first line in the ransom note. If you have your speakers on and this message plays, it can definitely sound very intimidating.

The files that get encrypted by this program all have the “.locked” extension added to their filename. We also see familiar patters in this infection, and that is probably because the program is based on the HiddenTear open source ransomware. It means that the program’s creators took the source code from the HiddenTear ransomware and then modified to make it into Guster Ransomware. Since these two programs are related, they share the same encryption algorithm: AES-256. Unfortunately, it is not possible to decrypt the infected files without the original decryption key, but you can delete the infected files and then transfer healthy copies back if you have a file backup.

Or, maybe you keep your files someplace else than the %USERPROFILE% directory? It is the default directory where most of your files are saved, but some users choose to create an entire new directory, especially when they have a partitioned hard drive. Either way, if that is the case, then there is a chance that Guster Ransomware would not be able to touch your files.

Either way, the main point is that you have to remove Guster Ransomware from your system immediately, and only then will you be able to restore your data. You will find the manual removal instructions right below this description, but if you are not certain of your software skills, you should rely on a powerful security tool that will scan your system and help you get rid of all the potential threats. It is important to understand that this ransomware program might be just one of the many threats on-board.

How to Delete Guster Ransomware

1. Reboot the system and let your computer load.
2. Go to your Downloads folder.
3. Locate the most recently downloaded files.
4. Remove those files and run a full system scan.