Windows 10: GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV

Discus and support GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV in AntiVirus, Firewalls and System Security to solve the problem; Am I doing everything correctly? I am unsure. Help please! Hi, I want to share with you what has happened and ask you for any comments, tips,... Discussion in 'AntiVirus, Firewalls and System Security' started by Xoyn Z Nikay, Dec 28, 2018.

  1. GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV


    Am I doing everything correctly? I am unsure. Help please!


    Hi,

    I want to share with you what has happened and ask you for any comments, tips, suggestions and questions that might help me or tell me if I am doing something wrong.


    I was infected at 11:20 am on December 26, 2018 with GandCrab 5.0.4 with extension QXFCEHV. Many files are encrypted and some files are not. I cleaned/killed the virus with scans from Malwarebytes and Avast, however, I notice that there appears to be something, remnants or something that tends to return with every restart or boot because I have removed the same file over and over again and now I notice I am not removing it, but I haven’t restarted either. Right now I am going through every file to see and a QXFCEHV-DECRYPT.txt file or the ransom note. Prior to understanding this crap a little better, I attempted to reinstall my OS and guess what? I could not as it stated things such as my user profile was missing. I tried to boot into safe mode and I couldn’t it kept giving me a wrong password message when I would go into safe mode and sign in. So, right now at this moment, I am trying to recover anything that I can recover. My first recovery run was sort of a test run to see if I could do it since it seems that there are things I cannot do. I used Disk Drill once and now I am using EaseUS recovery once. I am going to get an external drive and recover all I can to this drive to hold. Afterward, I am going to contact the PC manufacturer–talk to them–then I’m taking it to be professionally wiped clean and have the OS reinstalled since I cannot do it. I am praying for a new decryptor soon and until then I have kept those encrypted files so I can decrypt them later. One thing I do know is, no matter how bad something is, there is always someone that can find something to defeat that bad something. Nothing is original, better manipulated and mixed up, but not original. A working decryptor will be released. Reply with anything you’d like to tell me or add. Thanks so much!



    P.S: I kept all encrypted files and I kept the ransome notes. I did manipulate one file to see what it does and what would happened. It was an encrypted .jpg file of some weeds in a garden I didn't mean to take..I changed the extensions back and forth. It still not a normal .jpg file and I cannot see the thumbnail but when I open the file I can see the picture just as it was.

    :)
     
    Xoyn Z Nikay, Dec 28, 2018
    #1
  2. Smeed Win User

    Fixing GandCrab V5.0.4 Ransomware Virus And Decrypting all the affected files.

    That's correct....

    "Marcelo Rivero (Malware Intelligence Analyst) has reported that the new
    GandCrab V5.0.5 breaks the BitDefender decryption tool
    so it will not work. Some victims have reported this new version is still being called V5.0.4.
    "

    >
    https://www.bleepingcomputer.com/forums/t/669484/gandcrab-ransomware-help-support-topic-gdcb-crab-crab-decrypttxt/page-22#entry4608061


    Suggest reading also all the most recent posts in:
    https://www.bleepingcomputer.com/forums/t/669484/gandcrab-ransomware-help-support-topic-gdcb-crab-crab-decrypttxt/


    and reading/doing

     
    Smeed, Dec 28, 2018
    #2
  3. Borg 386 Win User
    Free decryption tool released for multiple GandCrab ransomware version


    Source: Free decryption tool released for multiple GandCrab ransomware versions | ZDNet
     
    Borg 386, Dec 28, 2018
    #3
  4. zbook Win User

    GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV

    Repeated Crashes and Boot Errors Apparently Caused by Driver Updates


    The chkdsk /f /r report displayed that there were corrections made in the volume bitmap.

    Run these commands and post images and then continue with the prior steps:
    There was a command for disk 1 but the command for disk 0 seems to have been skipped (steps 24 and 25) for the partition information. These are some additional commands.

    1) diskpart
    2) list disk
    3) select disk 0
    4) list volume
    5) list partition
    6) select partition 1
    7) detail partition
    8) select partition 2
    9) detail partition
    10) select partition 3
    11) detail partition
    12) select partition 4
    13) detail partition
    14) if there are any other partitions on disk 0 continue in the same fashion
    15) exit
    16) continue with prior steps
     
    zbook, Dec 28, 2018
    #4
Thema:

GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV

Loading...
  1. GandCrab 5.0.4 ... 7 random letter extension of .QXFCEHV - Similar Threads - GandCrab random letter

  2. Ransom:Win32/Gandcrab

    in Windows 10 Gaming
    Ransom:Win32/Gandcrab: I can't delete virus : Ransom:Win32/Gandcrab in win 10 via microsoft defender. Kindly ask your advice. Thanks https://answers.microsoft.com/en-us/windows/forum/all/ransomwin32gandcrab/b1a0af0f-e3c2-40bf-95c8-c1b8a033d43c
  3. Ransom:Win32/Gandcrab

    in Windows 10 Software and Apps
    Ransom:Win32/Gandcrab: I can't delete virus : Ransom:Win32/Gandcrab in win 10 via microsoft defender. Kindly ask your advice. Thanks https://answers.microsoft.com/en-us/windows/forum/all/ransomwin32gandcrab/b1a0af0f-e3c2-40bf-95c8-c1b8a033d43c
  4. Ransom:Win32/Gandcrab

    in AntiVirus, Firewalls and System Security
    Ransom:Win32/Gandcrab: I can't delete virus : Ransom:Win32/Gandcrab in win 10 via microsoft defender. Kindly ask your advice. Thanks https://answers.microsoft.com/en-us/windows/forum/all/ransomwin32gandcrab/b1a0af0f-e3c2-40bf-95c8-c1b8a033d43c
  5. Disk 0 partition 5 becomes drive D: after drive C: extension

    in Windows 10 Network and Sharing
    Disk 0 partition 5 becomes drive D: after drive C: extension: I wanted to extend my C: drive, so I shrunk my D: and used AOMEI Partition Assistant to move the unallocated partition from D: beside C: and merge them. So far everything has worked well, except for the fact that disk 0 partition 5, whose position I moved using AOMEI in order...
  6. Letters randomly disappear

    in Windows 10 Support
    Letters randomly disappear: Hi all, Since a day or two I noticed that letters or whole pages full of content disappear randomly. I updated my Windows and ran Malwarebytes multiple times but I can't seem to find anything. See images: https://gyazo.com/52d590764b025ad770006c29899eb964...
  7. Gandcrab

    in AntiVirus, Firewalls and System Security
    Gandcrab: We have Ransomeware protection in the form of folder protection is that right. The Forum seems littered with pleas for help for Gandcrab. Could one of our Wisemen explain please https://answers.microsoft.com/en-us/protect/forum/all/gandcrab/41fcafc3-c6d5-4be3-8569-f44d3e0243d4
  8. Ransomware GandCrab V5.1

    in AntiVirus, Firewalls and System Security
    Ransomware GandCrab V5.1: Split from this thread. Hello: Every folder on my computer has been encrypted, but it appeared to only the text files (.txt). Every folder has the following txt file in it, IYSVYEN-DECRYPT.txt . The content of it is below: ---= GANDCRAB V5.1 =---...
  9. Gandcrab v5.1 Ransomware .haznspmwlw Extension

    in AntiVirus, Firewalls and System Security
    Gandcrab v5.1 Ransomware .haznspmwlw Extension: Split from this thread. same here my laptop is infected with a ransomware called Gandcrab v5.1 file extention : haznspmwlw I need help removing it plz if anyone knows anything regarding it thanx...
  10. USB\DEVICE_DESCRIPTOR_FAILURE on USB\VID_0000&PID_0002\5&B0E09D9&0&7

    in Windows 10 Drivers and Hardware
    USB\DEVICE_DESCRIPTOR_FAILURE on USB\VID_0000&PID_0002\5&B0E09D9&0&7: Hello everyone, on my Predator PH317-51 I can't use USB or Bluetooth (the option is simply gone). I have an unknown USB device in my device manager. I tried uninstalling the drivers and restarting and I tried the Windows Troubleshooting. Neither helped....