How to restore files encrypted by GandCrab 5?

by Julie Splinters - -
12

Question

Issue: How to restore files encrypted by GandCrab 5?

Hello, my computer recently got infected with GandCrab 5 ransomware, and all files are encrypted! Hackers demand to pay the ransom. Although, I'm not willing to support ransomware attacks and pay the money. Are there any other ways how to restore files encrypted by GandCrab 5? I would really appreciate your help. Thank you. 

Solved Answer

GandCrab 5 is a new variant of the infamous GandCrab ransomware virus[1]. Even though the original version of the malware was discovered only in January 2018, it already has numerous new versions. This particular variant is also extremely dangerous and can encrypt all files stored on the system.

According to the researchers, GandCrab 5 encrypts data using Salsa20 and RSA 2048[2] ciphers. Encoded files are appended with a randomly generated extension of five letters. It is essential to understand that once the files are encrypted, they become unusable unless decrypted. 

Victims receive [randomly_generated_extension]-DECRYPT.html ransom note which includes information about GandCrab 5 ransomware attack. As usual, criminals demand to pay a specific ransom, but users must first contact them via TOR browser[3]. Such actions help hackers remain anonymous. 

Gandcrab 5 decryption

However, as any IT experts would say, you should NEVER pay the ransom. If you follow the demands of the crooks, you only finance and support future cyber attacks. We know it might seem that there is no other possible way to decrypt files encrypted by GandCrab 5 ransomware. 

Luckily, our cybersecurity experts have prepared an easy step-by-step guide showing how to restore files encrypted by GandCrab 5 virus. You can find it at the end of this article. Note that the instructions consist of multiple methods, so try them all for the best results. 

Ways to restore files encrypted by GandCrab 5

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

After you remove GandCrab 5 ransomware with a reliable antivirus software, we recommend scanning your system with Reimage. This system optimization tool is designed to help ransomware victims repair the virus damage and improve computer's performance. 

Method 1. Restore files using backups

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

If you have backups stored on an external device, make sure that GandCrab 5 is removed from the computer before plugging it in. Otherwise, the malware will encrypt data on the external device as well. 

  1. Plug in your external flash drive or another device;
  2. Once it is detected, select all files by pressing Ctrl + A;
  3. Click Ctrl + C to copy the data and paste it using Ctrl + V. 

Method 2. Get Data Recovery Pro software

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.
  1. Download and install Data Recovery Pro;
    Recover files encoded by Gandcrab 5
  2. Open the application and select Full Scan;
  3. Click Start Scan;
  4. Once it is finished, press the Recover button.

Method 3. Get your files back with Windows Previous Versions feature

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

Note that this method only works if you have enabled System Restore function before GandCrab 5 ransomware attack.

  1. Find an encrypted file and right-click on it;
  2. Select Properties and then go to the Previous Versions tab;
  3. Find the version before the attack and click Restore.

Method 4. Retrieve data with ShadowExplorer

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

Before you start, check if GandCrab 5 hasn't deleted Shadow Volume Copies from your system.

  1. Download and install ShadowExplorer;
    Gandcrab 5 recovery
  2. Open the application and find your drive;
  3. Select it and choose a location to export restored files;
  4. Click Export. 

Recover files and other system components automatically

To recover your files and other system components, you can use free guides by ugetfix.com experts. However, if you feel that you are not experienced enough to implement the whole recovery process yourself, we recommend using recovery solutions listed below. We have tested each of these programs and their effectiveness for you, so all you need to do is to let these tools do all the work.

Offer
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software you agree to our privacy policy and agreement of use.
do it now!
Download
recovery software Happiness
Guarantee
do it now!
Download
recovery software Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
Do you have any trouble?
If you are having problems related to Reimage, you can reach our tech experts to ask them for help. The more details you provide, the better solution they will provide you.
Reimage - a patented specialized Windows repair program. It will diagnose your damaged PC. It will scan all System Files, DLLs and Registry Keys that have been damaged by security threats.Reimage - a patented specialized Mac OS X repair program. It will diagnose your damaged computer. It will scan all System Files and Registry Keys that have been damaged by security threats.
This patented repair process uses a database of 25 million components that can replace any damaged or missing file on user's computer.
To repair damaged system, you have to purchase the licensed version of Reimage malware removal tool.
Press mentions on Reimage

About the author

Julie Splinters - Computer optimization specialist

When it comes to computer optimization, Julie Splinters is the expert. Whether it is a slow smartphone, Windows, Mac or Linux operating system, she will find a solution within minutes.

Contact Julie Splinters
About the company Esolutions

References

What you can add more about the problem: "How to restore files encrypted by GandCrab 5?"