Remove GandCrab Ransomware encryption virus from PC with automatic help

GandCrab Ransomware is another ransomware virus disseminated utilizing RigEK toolbox. Once invaded, encodes the greater part of put away information and includes the “.GDCB” augmentation to the name of each traded off document. It utilizes record scrambling plan to keep casualties from getting to their reports, databases, recordings, pictures, and other key information. At that point it makes new startup key with name GandCrab Ransomware  and esteem GandCrab.exe. You can likewise discover it in your procedures list with name GandCrab.exe or GandCrab Ransomware. Additionally, it can make organizer with name GandCrab Ransomware under C:\Program Files\ or C:\PROGRAMDATA. The risk is esteemed as a nonexclusive crypto-danger that does not seem to have associations with ventures like HiddenTear, Cerber and Locky. The GandCrab Ransomware appears like crafted by an autonomous group that chose to advance on the crypto-danger showcase.

The GandCrab Ransomware showed up on January 27th, 2018, and its name is gotten from the way that it supposedly ran as ‘GandCrab.exe’ on traded off machines out of the blue. The current ransomware is known to apply a custom AES-256 figure to information compartments and include the ‘.GDCB’ document marker. For instance, ‘justin_bieber.mp3’ is renamed to ‘justin_bieber.mp3.GDCB.’

The ransom caution is produced as ‘GDCB-DECRYPT.txt,’ which might be spared to the work area and the Documents library in Windows. The payoff alarms are as per the following:



All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB

The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.

The server with your key is in a closed network TOR. You can get there by the following ways:

  1. Download Tor browser – h[tt]ps://www.torproject[.]org/
  2. Install Tor browser
  3. Open Tor Browser
  4. Open link in tor browser: h[tt]ps://gdcbghvjyqy7jclk[.]onion/6361f798c4ba3647
  5. Follow the instructions on this page

If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:


  1. h[tt]ps://gdcbghvjyqy7jclk.onion[.]casa/6361f798c4ba3647
  2. h[tt]ps://gdcbghvjyqy7jclk.onion[.]guide/6361f798c4ba3647
  3. h[tt]ps://gdcbghvjyqy7jclk.onion[.]rip/6361f798c4ba3647
  4. h[tt]ps://gdcbghvjyqy7jclk.onion[.]plus/6361f798c4ba3647

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.


Do not try to modify files or use your own private key – this will result in the loss of your data forever!’

Infected users who visit gdcbghvjyqy7jclk[.]onion[.]top domain are shown the following text:







PC User

Pc Name

PC Group

PC Lang.


Date of encrypt

Amount of your files

Volume of your files


But don’t worry, you can return all your files! We can help you!

Below you can choose one of your encrypted file from your PC and decrypt him, it is test decryptor for you.

But we can decrypt only 1 file for free.


ATTENTION! Don’t try use third-party decryptor tools! Because this will destroy yourr files!


What do you need?

You need GandCrab Decryptor. This software will decrypt all your encrypted files and will delete GandCrab from your PC. For purchase you need crypto-currency DASH (1 DASH = 760.567$). How to buy this currency you can read it here.

How much money you need to pay? Below we are specified amount and our wallet for payment

Price: 1.5 DASH (1200 USD)’

It is basic that utilizations are misled by ransomware producer. In the vast majority of cases, clients pay loads of cash to purchase the supposed decryptor yet the programmer simply take the cash and vanish. We comprehend that the scrambled documents are critical to you, yet it does not regard make an exchange with programmer, who are criminal. What’s more, there is another hazard, that is the programmer will have opportunity to hack your ledger in the event that you send cash to them. Rather than paying cash utilize backups and reestablish your records and utilize anti-malware tool to remove GandCrab Ransomware from Windows PC.

Download SpyHunter 4 to remove, eradicate, delete, uninstall, eliminate GandCrab Ransomware from Computer.

How to reset DNS server infected by GandCrab Ransomware?

Most of the Infections like GandCrab Ransomware can disturb your Computer’s internet configuration or DNS server settings located inside Control Panel. In those conditions, you need to beware that you won’t be able to stop receiving malicious pop-ups and redirection of browser’s webpages. To avoid it, it is recommended to fix it as soon as possible.

For Windows 8/8.1/10 users:

  • Right click on the Windows icon located on the left below of the screen.
  • Click on control panel options and then double click on Network Connection.
  • Please right click on the active connection.
  • Then, click on properties option.

For Windows Vista/XP/7 users:

  • Click on Windows Start menu.
  • Go to Control Panel Option.
  • Click on Network and Sharing Center.
  • Then Click on your Connection Type (Local Area Connection).
  • Click on Properties Button, it will take you to a new window.
  • Click on Internet Protocol (TCP/IP).
  • Click on Properties button.
  • Make sure that you have Obtain IP address automatically and Option DNS server automatically selected. This would let your machine acquire the settings straight from your modem/router.

Now, change the DNS server setting to default:

  • Click on Start menu>>Control Panel>> Network and Sharing Center or Network Option.

dns reset1

  • Click “Change Adapter Settings” in the left bar.

dns reset2

  • Right click on your network device and choose properties. In my case this was Local Area Connection, but it could also be a wireless adapter or named something else.

dns reset3

  • Choose the IP version you would like to set the DNS settings for and click “properties”. I will be choosing IPv4 for this guide, but the steps are basically identical for IPv6.

dns reset4

  • In the window that pops up, click “Advanced” in the bottom right of the windows.

dns reset5

  • Click the “DNS” tab at the top.

dns reset6

  • Click Add and then type a “Tier2 server IP” in the box that pops up and click add again.

dns reset7

(“Tier Server IP” addresses are local IPs which located according to your area. For further information about your nearest area IP, you can visit to

Note: You can repeat above step as many times as you want to add more DNS servers IP. DNS servers added to the list are being tried consecutively after a short timeout when one or more of them are offline.

If you are feeling lazy or confused about above steps then you can also try some software located on our website. It will help you to maintain your Computer settings to default and remove GandCrab Ransomware.

Getting trouble to follow above steps?

Download Plumbytes to remove, eradicate, delete, uninstall, eliminate GandCrab Ransomware in one click.

How to remove GandCrab Ransomware infection from browser:

Sometimes malware like GandCrab Ransomware handicaps your Internet speed by getting attached to it. They often get installed on browser as extension, Browser Helping Object or toolbar programs and began to irritate the victims through unwanted redirection and pop-ups. You need to take immediate action in order to fix them all.

Uninstall GandCrab Ransomware from Google Chrome:

  • Open up your Chrome browser>> click on the three strip icon located on up right corner.
  • Click on settings>>extension setting and find GandCrab Ransomware named extension and uninstall it.
  • Then after clear all browsing data and malicious search engine which installed on your browser without your permission.
  • To take your setting’s effect, please restart the browser.

Delete GandCrab Ransomware from Mozilla Firefox:

  • Open up Firefox browser and click on “Firefox” button present on the top-left corner.
  • Click on add-ons options>> Extension tab.
  • Here you will find all the extensions which were installed on the PC.
  • Choose the malicious extension which installed without your permission and uninstall it.
  • To take effect of your changes, please restart the browser.

Eliminate GandCrab Ransomware form Internet Explorer:

  • Open I.E browser on PC.
  • Click on Tool or Gear icon >> Manages add-ons option.
  • Extension window will be appears on the screen, now detect the malicious extension related to GandCrab Ransomware and disable it.
  • Restart the browser.

Get rid of GandCrab Ransomware from safari browser:

  • Open up safari browser and select the “Safari” dropdown menu.
  • Click the “Preferences” button. This action will launch a new menu.
  • Now, select Extension tab.
  • Here, you can manage all your installed extension. Please check malicious extensions and uninstall it.
  • Restart your browser in order to load your settings effects.

Delete GandCrab Ransomware’s corrupted entries from Windows Registry Box:

  • Run windows run dialog box through clicking on Win+R button.
  • Now type in [regedit] in the empty field in the box and hit enter button.


  • A new window will open up called windows Registry Box.


  • Now check some common below listed entries and delete it.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup=”C:\windows\start menu\programs\startup”
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup=”C:\windows\start menu\programs\startup”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
“Common Startup”=”C:\windows\start menu\programs\startup”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
“Common Startup”=”C:\windows\start menu\programs\startup”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
“Whatever”=”c:\runfolder\GandCrab Ransomware.exe”
[HKEY_CLASSES_ROOT\exefile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @=”\”%1\” %*”
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @=”\”%1\” %*”
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @=”\”%1\” %*”

Not able to locate corrupted registry path and browser extension?

Download RegCure Pro toremove, eradicate, delete, uninstall, eliminateGandCrab Ransomware’s suspicious regitries and extensions.

Uninstall GandCrab Ransomware and their hidden related files from your Drives and Temp files:

  • First of all, go through Control Panel>>Appearance and Personalization.

hidden file1

  • Click on Folder Options, a new window will open up, go to View tab.

hidden file2

  • Check [Show Hidden Files and Folders] Option and Press Ok.

Through this action you will able to view hidden file which were located on the drive. Now, we are going to need to manually check the hard drive by going to where the user data is located.

  • Go to the following path: [C:\Users\XXXXX\AppData\Local\Temp] (“XXXXX” is the User name of your PC).
  • Delete all the files and folder located in the Temp Folder.
  • Sometimes, this action can ask your administrator permission so don’t get panic, simply press OK button.

↓↓↓Some other Malware Removal Tools to Delete GandCrab Ransomware from Computer.↓↓↓

Click here to download SpyHunter 4 Click here to download Reimage+
Click here to download MacKeeper Click here to download Plumbytes
Click here to download WiperSoft Click here to download RegCure Pro
Click here to buy Panda Antivirus Click here to download PCKeeper Pro