.KRAB Files Virus

.KRAB Files Virus is a malicious computer infection that will turn your day into hell. The program enters the target system surreptitiously, encrypts all the personal files, and then demands that user pay an insanely high ransom for the decryption tool. However, there is no guarantee that this program would issue the decryption tool in the first place; hence, it is necessary to remove .KRAB Files Virus as soon as possible. There might be other ways to get your files back, and you should explore them once you get rid of this infection. However, please bear in mind that sometimes it is not possible to retrieve the affected files 100%.

This is not the first time we see this program. According to our research, .KRAB Files Virus comes as a new version of the GandCrab ransomware infection. There have been three versions so far, and .KRAB Files Virus seems to be the fourth. Just like its predecessors, .KRAB Files Virus also drops a ransom note that says users need to pay a ransom in order to receive a decryption tool. If you do not pay, you will not be able to access your files again. Perhaps the only good think about it is that this infection is very straightforward. Here’s what it says:

We are sorry, but your files have been encrypted!
Don’t worry, we can help you to return all of your files!
Files decryptor’s price is 1600 USD
If payment isn’t made until [date] the cost of decrypting files will be doubled
Amount was doubled!

Aside from requiring an insane amount of money, .KRAB Files Virus also expects you to install the Tor browser and access the link given in the ransom note. From there, you should receive a new set of instructions that would show you how to receive the decryption tool. However, where would you get 1600 USD for that? Worse, our latest tests show that the ransom amount was raised up to 4000 USD. How on earth regular users should pay something like that?

Our guess is that this program mostly targets small businesses as they are more likely to find the money for the ransom fee. Also, small businesses might have several computers connected to the same network, so if one system gets infected with .KRAB Files Virus, the infection spreads through all the hard drives mapped on the network. As a result, a small company might lose most of their files in a blink. And they might also be more willingly to pay the ransom if they do not have a file backup.

Does paying the ransom help though? That is highly unlikely. It is far more common for ransomware programs to receive the payment and then scram, without even issuing the decryption key. What’s more, the servers that issue decryption keys might go offline very often because ransomware developers often use third-party services to keep their databases online, and those third-party services are seldom reliable. Therefore, the entire “business” plan is devised to help these criminals take your money with no questions asked.

The good news is that it is not complicated to remove .KRAB Files Virus on your own. This program does not drop any additional files, so you will only have to remove the file that launched the infection, and the ransom note file. On the other hand, the experience might be too stressful to even think about the manual removal, so you can always rely on an antispyware tool that will help you remove all the malicious files and applications. After all, there is a good chance, that you have more threats on-board, too.

As for your files, there is no public decryption tool available at the moment, so you need to look for other ways to restore them. If you regularly back up your files in an external hard drive, you can simply remove the encrypted data and transfer the healthy copies into your computer AFTER you have removed the infection.

Also, you might have quite a lot of files saved on your mobile device or a cloud drive. We leave our files in various places a lot more often than we think. Hence, you should check out all of your options before permanently giving up on your files.

How to Delete .KRAB Files Virus

1. Remove the KRAB-DECRYPT.txt ransom note.
2. Open your Downloads folder.
3. Delete the most recently downloaded files.
4. Run a full system scan with SpyHunter.