Grand_car@aol.com Ransomware

Posted by Max Lehmann on August 25, 2016

What is Grand_car@aol.com Ransomware?

Grand_car@aol.com Ransomware will severely affect your computer by encrypting your files. That is the main weapon of ransomware programs, and they use it quite well. Thus, quite a few individual and corporate victims of this and other similar infections often fall into despair and end up spending a lot of money in hopes of restoring their files. Computer security experts always encourage users to refrain from paying the ransom because that does not guarantee the problem will be solved. What you really have to do is remove Grand_car@aol.com Ransomware from the infected system, and then look for other ways to decrypt your files. test test

Where does Grand_car@aol.com Ransomware come from?

This ransomware comes from a big family of similar infections. Our research team has listed a few other programs that are very similar to Grand_car@aol.com Ransomware. The list includes such names as Alex.vlasov@aol.com Ransomware, Meldonii@india.com ransomware, Radxlove7@india.com ransomware, Saraswati Ransomware, and a few others. This shows that the people who use these programs to infect innocent users either create them all based on the same source code or they buy or rent programs from their developers, thus supporting the Ransomware-as-a-Service scheme.

Either way, as far as user security is concerned, your biggest task is to avoid getting infected with such programs. Grand_car@aol.com Ransomware and related infections are known to be distributed via spam emails. The spam email campaigns that deliver these ransomware programs do not look like your usual spam messages that advertise drugs or adult services. Ransomware spam campaigns are really elaborate, and the messages often look like mails from financial institutions and online stores. So the attachments that come with those messages might seem to be invoices, or important documents users have to download and open.

This is where ransomware manages to slither into target computer. Users download and open these attachments thinking they need to sign a document or check something, but instead they infect their systems with dangerous threats.

What does Grand_car@aol.com Ransomware do?

The payload of this infection is not something unusual. We know that Grand_car@aol.com Ransomware uses the RSA-2048 encryption to lock your files. It is easy to see which files were affected by the infection because the encrypted files get a new extension. In our case, it was .id-B4500913.grand_car@aol.com.xtbl. It is very likely that different computers affected by this infection will have different extensions attached to encrypted files because every single infection has a unique ID. This ID is necessary for the cyber criminals so that they would know how to identify each and every affected computer.

Aside from encrypting your files, this program also displays “decryption instructions,” both on your screen and in a .txt file that is dropped on your desktop. It simply states the fact that your files have been encrypted and to get them back you have to write an email to grand_car@aol.com. Technically, after you send that, you should receive further instructions on what you are supposed to do. It will definitely involve paying a big amount of money for the decryption key.

Albeit there are reports that some ransomware programs do issue working decryption keys, no one can guarantee that Grand_car@aol.com Ransomware would do the same. There is a bigger chance you might lose your money for good here. Thus, rather than succumbing to the demands of these cyber criminals, you should look for a way to get rid of the infection.

How do I remove Grand_car@aol.com Ransomware?

Luckily, this ransomware program does not lock your screen, so you can access your system files and system utilities without any difficulty. This also means you can remove Grand_car@aol.com Ransomware from your computer manually if you follow the instructions we have posted below this description.

The instructions are long and might seem complicated if you do not work with Registry Editor on a daily basis. That is why; the most efficient way to delete a ransomware program is to use a licensed antispyware tool that would do everything automatically. At the same time, the security program of your choice would terminate other malicious files and applications that might have entered your system while you were browsing the Internet.

As for your files, there is no public decryptor available at the moment. However, you can restore them from an external backup (if you have one), when you remove Grand_car@aol.com Ransomware for good. Do not transfer any file while the infection is still on your computer!

Manual Grand_car@aol.com Ransomware Removal

Press Win+R and the Run prompt will open.
Type %APPDATA% into the Open box and click OK.
Navigate to Microsoft\Windows\Start Menu\Programs\Startup.
Delete the random name .exe file.
Press Win+R again and type %ALLUSERPROFILE%. Click OK.
Go to Microsoft\Windows\Start Menu\Programs\Startup.
Remove the random name .exe file.
Press Win+R again and type %WINDIR%. Press the OK button.
Go to the Syswow64 folder and delete the random name .exe file.
Navigate back to the WINDOWS folder.
Go to the System32 folder and delete the random name .exe file.
Press Win+R once more and type regedit. Hit Enter.
Navigate to HKEY_CURRENT_USER\Control Panel\Desktop.
Right-click the Wallpaper value on the right.
Remove it or change your wallpaper’s path. Click OK.
Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers.
Right-click and delete the value with the value data C:\Users\user\Decryption instructions.jpg.
Navigate to HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run.
On the right, right-click and delete the values with this value data:
%WINDIR%\Syswow64\*.exe
%WINDIR%\System32\*.exe
Run a full system scan with a licensed antispyware tool.