Gomme Ransom Virus (Restore .gommemode Files) - How to, Technology and PC Security Forum | SensorsTechForum.com

Gomme Ransom Virus (Restore .gommemode Files)

Article created to show you how to remove the Gomme Ransom virus from your computer and restore files encrypted with .gommemode file extension.

A new ransomware virus has appeared at the end of March 2017. The virus encrypts the files on the compromised computers adding the file extension .gommemode after their files. After having encrypted the files on the computer Gomme ransomware demands the victims to pay a ransom “fee” of $25 in BitCoin in order to restore the files back to their working state. In case your computer has been infected by this ransomware infection, we advise you to read the following material thoroughly.

Threat Summary

NameGomme Ransom
TypeRansomware, Cryptovirus
Short DescriptionGomme Ransom encrypts files on the computers infected by it, demanding a ransom payoff of $25 in BTC for the files’ decryption.
SymptomsThe files are encrypted with the aid of a cipher after which the file extension .gommemode has been added to them.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by Gomme Ransom


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Gomme Ransom.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Gomme Ransomware – Distribution

For the Gomme ransomware virus to cause infections, the malware may use different tactical approaches for it’s distribution. The most widely used method to infect unsuspecting users is via malicious e-mail spam, also known as malspam. Such campaigns include deceptive e-mail messages pretending they come from big organizations, for example:

  • PayPal.
  • DHL.
  • FedEx.
  • Various banks.
  • eBay.
  • Amazon.
  • AliExpress.

The e-mails usually have different types of deceptive messages in them, like pretending to be confirmation letter or an invoice of a purchase which the targeted user has not made. Some e-mails go as far as claiming there is suspicious activity in the bank account of the user and may even use your name in them. There are also blank e-mails with just the attachment in them.

Besides e-mail spam, various other methods may be used to infect computers, such as:

  • Fake Adobe or Java updates.
  • Distribution via browser redirects caused by unwanted software (PUPs).
  • Fraudulent key generators, license activators or patches uploaded on suspicious sites.
  • Fake setups uploaded online.

Gomme Ransomware – Analysis

After the victim is infected one way or another, the Gomme Ransom virus begins to drop it’s malicious files on the compromised computer. It’s primary malicious executable is called gmm33.exe and it may be located in:

  • %AppData%
  • %Temp%
  • %Windows%
  • %Roaming%
  • %Local%
  • %LocalLow%

After the file has been dropped on the infected computer, the ransomware infection also leaves a portable file, named TORBrowser.exe, which is a portable TOR Browser with which the victim can pay the ransom anonymously.

The virus also drops it’s ransom note file, which has the following contents:

“=====Gomme Ransom=====
Everything, Music, Documents, Programs etc, has been encrypted!
How can I get my files back?
You will need to pay $25, as soon as you did, you will receive your files back.
You will find the ‘TOR Browser’ on your desktop.
lf you don’t own BTC, purchase some at paxful.com or localbitcoins.

The Gomme Ransom virus may also perform other type of activities such as create other support files in the above mentioned Windows directories and tamper with the Windows Registry Editor.

Gomme Ransom – Encryption Process

The encryption of Gomme Ransom is performed so that all important files on the infected computer are encrypted. We are talking about MS Office documents, PDF files, pictures, music, video and other types of files. Gomme Ransom is very careful not to encrypt the system files of Windows, because this may break the operating system, so it may avoid system folders. After the encryption is complete, the files are left with the .gommemode file extension appended to them and look like the following:

Remove Gomme Ransom and Restore .gommemode Files

Before beginning to remove the virus files of Gomme Ransom from your computer, we strongly recommend you to backup all the encrypted files, in case they are lost during removal.

Then, for the removal process, advices are to follow the removal instructions below. They are specifically designed to initially isolate the virus in safe mode and then manually delete the malicious objects. In case manual removal is something you are not technically prepared to do, malware experts often advise using an advanced anti-malware software in order to completely remove Gomme Ransom from your computer and protect your computer in the future as well.

After the removal process, you can try to restore your encrypted files using the alternative tools in the removal instructions below. They are in no way 100% guarantee that all of your files will be recovered, but with their aid you can restore at least a portion of your encrypted files.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share