Do you know what Grand_car@aol.com Ransomware is?
Grand_car@aol.com Ransomware is a dangerous computer infection that will definitely put you on edge. This malicious infection will encrypt your files thus successfully blocking you from accessing them. If you are reading this article, it means you are looking for ways to remove this program. Please scroll down for the manual removal instructions. However, we would like to encourage you to delete this program automatically with a licensed antispyware tool. After all, that would ensure you delete every single malicious file from your system, as there could as well be many other dangerous threats on-board.
Unlike some other malicious infections that remain hidden for a long time, Grand_car@aol.com Ransomware is not stealthy at all in that aspect. Right after the file encryption, the program changes your background and adorns your desktop with a message that says: “Your data is encrypted!!! To return the file to an email email grand_car@aol.com.” Albeit the message is delivered in butchered English, it is still possible to understand that you have to contact the criminals via the given email to get instructions on file decryption. Whether the decryption key works or not, that is already another question. However, we always agitate against paying any kind of ransom fee.
Grand_car@aol.com Ransomware screenshot
Scroll down for full removal instructions
As far as the technical aspects of this infection are concerned, Grand_car@aol.com Ransomware is based on the CrySIS Ransomware engine, so it means it comes from a family of similar infections, and it might also be a Ransome-as-a-Service program. It means that the person who infected you is not the original creator of the program, and they only bought or rented the malware to make some cash. Other programs in the same family include such names as Redshitline Ransomware, Ecovector3@aol.com Ransomware, Vegclass@aol.com Ransomware, Green_ray Ransomware, Alex.vlasov@aol.com Ransomware, and so on.
What’s more, Grand_car@aol.com Ransomware uses the RSA-2048 encryption key, which is one of the most complicated encryption algorithms out there. Perhaps it is no surprise then that there is no public decryption key available at the moment. But that should not discourage you from fighting this infection. You can always restore your files from a backup. That is also the reason computer security experts encourage users to back up their files regularly: you can never know when you have to fight the likes of Grand_car@aol.com Ransomware!
All the files that are encrypted by this program will have an additional extension added to their names. The extension will be .id-B4500913.grand_car@aol.com.xtbl. Take note that the B4500913 ID is our own unique ID we got when we infected one of our test computers in our laboratory. The ID ascribed to your computer might be different. Each infected computer gets a different ID because the hackers need to count just how many computers have been infected, and which decryption key has to be issued.
Once again, we do not recommend contacting the criminals. There is a good chance that even if you do pay the ransom fee (which is definitely going to be at least $500USD), the criminals will not send the decryption key back. Also, it is possible that the communication between the infection and the command and control center is not stable enough, so something might be lost in between (even the decryption key!).
Hence, follow the instructions below to delete everything associated with this infection from your system. If you feel that this might be too much of a task for you, you can always terminate Grand_car@aol.com Ransomware with a powerful antispyware tool. After all, there might be more dangerous programs installed on your system, so why should you remove them one by one manually? Automatic malware removal is more efficient, and you can be sure that your PC will be protected from similar threats in the future.
Also, if you have any questions about this infection or computer security aspects in general, you are always welcome to leave us a comment. Our team will be ready to assist you with anything you might need.
How to Remove Grand_car@aol.com Ransomware
- Press Win+R and type %APPDATA%. Click OK.
- Go to Microsoft\Windows\Start Menu\Programs\Startup.
- Delete the random name .exe file*.
- Press Win+R again and type %ALLUSERPROFILE%. Click OK.
- Go to Microsoft\Windows\Start Menu\Programs\Startup.
- Delete the random name .exe file*.
- Press Win+R and type %WINDIR%. Hit Enter.
- Open the Syswow64 folder and delete the random name .exe file*.
- Go back to the WINDOWS folder.
- Open the System32 folder and delete the random name .exe file*.
- Press Win+R and type regedit. Click OK.
- Go to HKEY_CURRENT_USER\Control Panel\Desktop.
- On the right-pane, right-click the Wallpaper value.
- Delete it or change the wallpaper path to another image.
- Go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers.
- On the right pane, delete the value BackgroundHistoryPath0 with the value data C:\Users\user\Decryption instructions.jpg.
- Go to HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run.
- On the right pane, right-click and delete the values with this value data:
%WINDIR%\Syswow64\*.exe
%WINDIR%\System32\*.exe
* The random name .exe file can have an absolutely random name, but sometimes it may start with “payload,” for example: Payload1.exe or Payload_c.exe.
In non-techie terms:
Grand_car@aol.com Ransomware is something you would not want to have on your computer, but if it happened to have infected you, it is time to do everything you can to get rid of it. The best way to remove this ransomware is to get yourself a good security application that would do the job for you. While nothing much can be done about your files, you can still get them back if you have them saved someplace else.