Gomme Ransom Virus (Restore .gommemode Files) - How to, Technology and PC Security Forum | SensorsTechForum.com
THREAT REMOVAL

Gomme Ransom Virus (Restore .gommemode Files)

OFFER

SCAN YOUR PC
with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by Gomme Ransom and other threats.
Threats such as Gomme Ransom may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

Article created to show you how to remove the Gomme Ransom virus from your computer and restore files encrypted with .gommemode file extension.

A new ransomware virus has appeared at the end of March 2017. The virus encrypts the files on the compromised computers adding the file extension .gommemode after their files. After having encrypted the files on the computer Gomme ransomware demands the victims to pay a ransom “fee” of $25 in BitCoin in order to restore the files back to their working state. In case your computer has been infected by this ransomware infection, we advise you to read the following material thoroughly.

Threat Summary

NameGomme Ransom
TypeRansomware, Cryptovirus
Short DescriptionGomme Ransom encrypts files on the computers infected by it, demanding a ransom payoff of $25 in BTC for the files’ decryption.
SymptomsThe files are encrypted with the aid of a cipher after which the file extension .gommemode has been added to them.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by Gomme Ransom

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Gomme Ransom.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Gomme Ransomware – Distribution

For the Gomme ransomware virus to cause infections, the malware may use different tactical approaches for it’s distribution. The most widely used method to infect unsuspecting users is via malicious e-mail spam, also known as malspam. Such campaigns include deceptive e-mail messages pretending they come from big organizations, for example:

  • PayPal.
  • DHL.
  • FedEx.
  • Various banks.
  • eBay.
  • Amazon.
  • AliExpress.

The e-mails usually have different types of deceptive messages in them, like pretending to be confirmation letter or an invoice of a purchase which the targeted user has not made. Some e-mails go as far as claiming there is suspicious activity in the bank account of the user and may even use your name in them. There are also blank e-mails with just the attachment in them.

Besides e-mail spam, various other methods may be used to infect computers, such as:

  • Fake Adobe or Java updates.
  • Distribution via browser redirects caused by unwanted software (PUPs).
  • Fraudulent key generators, license activators or patches uploaded on suspicious sites.
  • Fake setups uploaded online.

Gomme Ransomware – Analysis

After the victim is infected one way or another, the Gomme Ransom virus begins to drop it’s malicious files on the compromised computer. It’s primary malicious executable is called gmm33.exe and it may be located in:

  • %AppData%
  • %Temp%
  • %Windows%
  • %Roaming%
  • %Local%
  • %LocalLow%

After the file has been dropped on the infected computer, the ransomware infection also leaves a portable file, named TORBrowser.exe, which is a portable TOR Browser with which the victim can pay the ransom anonymously.

The virus also drops it’s ransom note file, which has the following contents:

“=====Gomme Ransom=====
ALL OF YOUR FILES HAVE BEEN ENCRYPTED!
Everything, Music, Documents, Programs etc, has been encrypted!
WARNING: IF YOU RESTART YOUR COMPUTER WE WON’T BE ABLE TO RESTORE YOUR FILES & YOU WILL LOSE THEM FOREVER!
How can I get my files back?
You will need to pay $25, as soon as you did, you will receive your files back.
You will find the ‘TOR Browser’ on your desktop.
lf you don’t own BTC, purchase some at paxful.com or localbitcoins.
SEND THE MONEY TO THIS ADDRESS:”

The Gomme Ransom virus may also perform other type of activities such as create other support files in the above mentioned Windows directories and tamper with the Windows Registry Editor.

Gomme Ransom – Encryption Process

The encryption of Gomme Ransom is performed so that all important files on the infected computer are encrypted. We are talking about MS Office documents, PDF files, pictures, music, video and other types of files. Gomme Ransom is very careful not to encrypt the system files of Windows, because this may break the operating system, so it may avoid system folders. After the encryption is complete, the files are left with the .gommemode file extension appended to them and look like the following:

Remove Gomme Ransom and Restore .gommemode Files

Before beginning to remove the virus files of Gomme Ransom from your computer, we strongly recommend you to backup all the encrypted files, in case they are lost during removal.

Then, for the removal process, advices are to follow the removal instructions below. They are specifically designed to initially isolate the virus in safe mode and then manually delete the malicious objects. In case manual removal is something you are not technically prepared to do, malware experts often advise using an advanced anti-malware software in order to completely remove Gomme Ransom from your computer and protect your computer in the future as well.

After the removal process, you can try to restore your encrypted files using the alternative tools in the removal instructions below. They are in no way 100% guarantee that all of your files will be recovered, but with their aid you can restore at least a portion of your encrypted files.

Note! Your computer system may be affected by Gomme Ransom and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as Gomme Ransom.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove Gomme Ransom follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove Gomme Ransom files and objects
2. Find files created by Gomme Ransom on your PC

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by Gomme Ransom

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...