Windows 10: GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV

Am I doing everything correctly? I am unsure. Help please!


Hi,

I want to share with you what has happened and ask you for any comments, tips, suggestions and questions that might help me or tell me if I am doing something wrong.


I was infected at 11:20 am on December 26, 2018 with GandCrab 5.0.4 with extension QXFCEHV. Many files are encrypted and some files are not. I cleaned/killed the virus with scans from Malwarebytes and Avast, however, I notice that there appears to be something, remnants or something that tends to return with every restart or boot because I have removed the same file over and over again and now I notice I am not removing it, but I haven’t restarted either. Right now I am going through every file to see and a QXFCEHV-DECRYPT.txt file or the ransom note. Prior to understanding this crap a little better, I attempted to reinstall my OS and guess what? I could not as it stated things such as my user profile was missing. I tried to boot into safe mode and I couldn’t it kept giving me a wrong password message when I would go into safe mode and sign in. So, right now at this moment, I am trying to recover anything that I can recover. My first recovery run was sort of a test run to see if I could do it since it seems that there are things I cannot do. I used Disk Drill once and now I am using EaseUS recovery once. I am going to get an external drive and recover all I can to this drive to hold. Afterward, I am going to contact the PC manufacturer–talk to them–then I’m taking it to be professionally wiped clean and have the OS reinstalled since I cannot do it. I am praying for a new decryptor soon and until then I have kept those encrypted files so I can decrypt them later. One thing I do know is, no matter how bad something is, there is always someone that can find something to defeat that bad something. Nothing is original, better manipulated and mixed up, but not original. A working decryptor will be released. Reply with anything you’d like to tell me or add. Thanks so much!



P.S: I kept all encrypted files and I kept the ransome notes. I did manipulate one file to see what it does and what would happened. It was an encrypted .jpg file of some weeds in a garden I didn't mean to take..I changed the extensions back and forth. It still not a normal .jpg file and I cannot see the thumbnail but when I open the file I can see the picture just as it was.

:)

 

Fixing GandCrab V5.0.4 Ransomware Virus And Decrypting all the affected files.

That's correct....

"Marcelo Rivero (Malware Intelligence Analyst) has reported that the new
GandCrab V5.0.5 breaks the BitDefender decryption tool so it will not work. Some victims have reported this new version is still being called V5.0.4."

>
https://www.bleepingcomputer.com/forums/t/669484/gandcrab-ransomware-help-support-topic-gdcb-crab-crab-decrypttxt/page-22#entry4608061

Suggest reading also all the most recent posts in:
https://www.bleepingcomputer.com/forums/t/669484/gandcrab-ransomware-help-support-topic-gdcb-crab-crab-decrypttxt/

and reading/doing

• https://support.emsisoft.com/topic/29386-first-steps-when-dealing-with-ransomware/
• https://blog.emsisoft.com/en/26164/how-to-remove-ransomware-the-right-way-a-step-by-step-guide/
• Ransomware: Q&A
• How crypto ransomware spreads... is it decryptable...should I pay the ransom
  

 

Free decryption tool released for multiple GandCrab ransomware version

Source: Free decryption tool released for multiple GandCrab ransomware versions | ZDNet

 

Repeated Crashes and Boot Errors Apparently Caused by Driver Updates


The chkdsk /f /r report displayed that there were corrections made in the volume bitmap.

Run these commands and post images and then continue with the prior steps:
There was a command for disk 1 but the command for disk 0 seems to have been skipped (steps 24 and 25) for the partition information. These are some additional commands.

1) diskpart
2) list disk
3) select disk 0
4) list volume
5) list partition
6) select partition 1
7) detail partition
8) select partition 2
9) detail partition
10) select partition 3
11) detail partition
12) select partition 4
13) detail partition
14) if there are any other partitions on disk 0 continue in the same fashion
15) exit
16) continue with prior steps