A new ransomware virus has appeared at the end of March 2017. The virus encrypts the files on the compromised computers adding the file extension .gommemode after their files. After having encrypted the files on the computer Gomme ransomware demands the victims to pay a ransom “fee” of $25 in BitCoin in order to restore the files back to their working state. In case your computer has been infected by this ransomware infection, we advise you to read the following material thoroughly.
|Short Description||Gomme Ransom encrypts files on the computers infected by it, demanding a ransom payoff of $25 in BTC for the files’ decryption.|
|Symptoms||The files are encrypted with the aid of a cipher after which the file extension .gommemode has been added to them.|
|Distribution Method||Spam Emails, Email Attachments, Executable files|
|Detection Tool|| See If Your System Has Been Affected by Gomme Ransom |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Gomme Ransom.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Gomme Ransomware – Distribution
For the Gomme ransomware virus to cause infections, the malware may use different tactical approaches for it’s distribution. The most widely used method to infect unsuspecting users is via malicious e-mail spam, also known as malspam. Such campaigns include deceptive e-mail messages pretending they come from big organizations, for example:
- Various banks.
The e-mails usually have different types of deceptive messages in them, like pretending to be confirmation letter or an invoice of a purchase which the targeted user has not made. Some e-mails go as far as claiming there is suspicious activity in the bank account of the user and may even use your name in them. There are also blank e-mails with just the attachment in them.
Besides e-mail spam, various other methods may be used to infect computers, such as:
- Fake Adobe or Java updates.
- Distribution via browser redirects caused by unwanted software (PUPs).
- Fraudulent key generators, license activators or patches uploaded on suspicious sites.
- Fake setups uploaded online.
Gomme Ransomware – Analysis
After the victim is infected one way or another, the Gomme Ransom virus begins to drop it’s malicious files on the compromised computer. It’s primary malicious executable is called gmm33.exe and it may be located in:
After the file has been dropped on the infected computer, the ransomware infection also leaves a portable file, named TORBrowser.exe, which is a portable TOR Browser with which the victim can pay the ransom anonymously.
The virus also drops it’s ransom note file, which has the following contents:
ALL OF YOUR FILES HAVE BEEN ENCRYPTED!
Everything, Music, Documents, Programs etc, has been encrypted!
WARNING: IF YOU RESTART YOUR COMPUTER WE WON’T BE ABLE TO RESTORE YOUR FILES & YOU WILL LOSE THEM FOREVER!
How can I get my files back?
You will need to pay $25, as soon as you did, you will receive your files back.
You will find the ‘TOR Browser’ on your desktop.
lf you don’t own BTC, purchase some at paxful.com or localbitcoins.
SEND THE MONEY TO THIS ADDRESS:”
The Gomme Ransom virus may also perform other type of activities such as create other support files in the above mentioned Windows directories and tamper with the Windows Registry Editor.
Gomme Ransom – Encryption Process
The encryption of Gomme Ransom is performed so that all important files on the infected computer are encrypted. We are talking about MS Office documents, PDF files, pictures, music, video and other types of files. Gomme Ransom is very careful not to encrypt the system files of Windows, because this may break the operating system, so it may avoid system folders. After the encryption is complete, the files are left with the .gommemode file extension appended to them and look like the following:
Remove Gomme Ransom and Restore .gommemode Files
Before beginning to remove the virus files of Gomme Ransom from your computer, we strongly recommend you to backup all the encrypted files, in case they are lost during removal.
Then, for the removal process, advices are to follow the removal instructions below. They are specifically designed to initially isolate the virus in safe mode and then manually delete the malicious objects. In case manual removal is something you are not technically prepared to do, malware experts often advise using an advanced anti-malware software in order to completely remove Gomme Ransom from your computer and protect your computer in the future as well.
After the removal process, you can try to restore your encrypted files using the alternative tools in the removal instructions below. They are in no way 100% guarantee that all of your files will be recovered, but with their aid you can restore at least a portion of your encrypted files.