GandCrab4 Ransomware Removal Guide

As the name of GandCrab4 Ransomware shows, it is a new version of GandCrab Ransomware, which has already encrypted files on thousands of users’ computers. Just like its predecessor, GandCrab4 Ransomware encrypts files on affected computers, but it does not need to establish a communication with its Command and Control server before locking data on victims’ systems. In other words, unlike the initial version of GandCrab Ransomware, it can encrypt files on those computers that are not connected to the Internet too. This ransomware is used by cyber criminals for money extortion, so you will be asked to pay a ransom immediately after GandCrab4 Ransomware finishes encrypting your personal files. If you are going to purchase the decryptor, do this as soon as possible because its price will double soon. If you ask us, paying money to malicious software developers is the worst users can do. First, when they achieve their goal, i.e. get your money, they might decide not to bother decrypting a single file for you. Additionally, you might encounter new malicious software developed by the same creator yourself in the future.

GandCrab4 Ransomware locks files mercilessly, so if there is a security loophole and it successfully enters your system, you will surely find a bunch of files locked. It will lock your documents, music, images, and many other files you consider valuable. The file is surely locked if it has the .KRAB extension appended to it, so you do not need to check all files on your computer. If GandCrab4 Ransomware enters your system and locks your files, you will also locate a new file KRAB-DECRYPT.txt in various directories that contain encrypted data. This file is a ransom note that will explain to you why you can no longer access so many files on your computer. You will also find out instructions on how to get files back there. Users are first told to open the provided .onion link with the Tor browser they have to download from the web. If you are not going to pay money to cyber criminals, do not waste your time trying to access the link because you will only find information on how to make a payment there. GandCrab4 Ransomware demands 800 USD in Bitcoin from users, but the price of the decryptor doubles after some time. It might seem that it is the only way to get files back, but you should not forget that there are no guarantees that cyber criminals will unlock files for you after you make a payment. Do not expect to get your money back in case they cannot or do not want to help you.

You may wonder how you can unlock your files for free, but, to be frank, there is not much we can say to you because free decryption software that could unlock files encrypted with the Salsa20 encryption algorithm is not available, or it would take a very long time to get files back. The only thing you can do is to restore your files from a backup. Before you do this, you must delete the ransomware infection from your system fully.

Even though ransomware infections are usually distributed via malicious email attachments, it seems that the majority of users who encounter GandCrab4 Ransomware download it from some kind of P2P website as pirated software or a crack. They find out that they have allowed malware to enter their computers instead only when they discover their files encrypted, i.e. when it is impossible to change anything. Do not let new malware to infiltrate your computer – be careful with all your downloads. Additionally, you should also install a security application to ensure the system’s overall protection against malware.

None of your personal files will be unlocked if you delete GandCrab4 Ransomware from your computer, but it does not mean that it is a good idea to keep this malicious application installed on the system. Its removal will be quick and easy if you follow our step-by-step instructions. You will have to delete only two files associated with GandCrab4 Ransomware: KRAB-DECRYPT.txt and the malicious file launched. If you have other stuff to do and cannot spend much time on wiping malware from your PC, you should use an automated malware remover instead.

Remove GandCrab4 Ransomware

1. Find the malicious .exe file you have recently launched on your computer (it should be located in the Downloads folder).
2. Remove it.
3. Delete KRAB-DECRYPT.txt.
4. Right-click on your Recycle Bin and click Empty Recycle Bin.