This article aims to help you remove the Gruxer ransomware infection and restore the AES encrypted files by this ransomware virus.
A ransomware infection going by the name GruxEr has been reported to encrypt the files on the computers it infects and then demand a ransom of $250 in BitCoin from the victims to get the files back. The virus has been detected at the beginning of May 2017 and it has been reported to wreak havoc ever since. It drops a ransom note which asks victims not to shut down their computer or else the files will be permanently lost. In case your computer has been infected by the GruxEr ransomware threat, you should read the following article thoroughly to learn how to remove it from your computer and restore files encrypted by this infection. Be advised to attempt anything suggested in this article and it’s instructions solely at your own risk!
GruxEr Ransomware – How Does It Spread
The distribution of GruxEr ransomware has been reported to be conducted in multiple different methods. The primary methods of those is via spreading a Trojan-type of executable via fake updates, game patches, key generators or other online file sharing services. The executable of GruxEr ransomware has been detected to be the following:
As soon as the malicious executable of GruxEr ransomware has been opened, the virus drops multiple files on the victim’s computer, predominantly located in %Temp% directory. The files are reported to have the following name:
- GRUXER.EXE
- TEARS.EXE
- WORM.EXE
One of the files hints of a possible method of spreading the GruxEr ransomware via a worm infection, which is particularly dangerous. The main reason for this is that worms unlike other malware may spread automatically from a computer to computer via open ports of the network or automatically generated requests.
GruxEr Ransomware – In Depth Analysis
Believed to use the HiddenTear source code for file encryption, called Tears, the virus initially begins to block the screen of the user’s computer using the GRUXER.EXE module. The blocked screen has the following ransom note:
Your documents, photos, databases and other important files have been encrypted with the strongest encryption known to man. And is secured with a unique key, generated for this computer. The private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay to obtain your key.
You must pay $250 in Bitcoin to the bitcoin address below.If you do not have Bitcoin visit the site Localbitcoins and purchase $250 USD worth of bitcoin. Within 2 minutes of recieveing your payment, an automated bot will send your computer your personal decryption key.
You have 72 hours to submit the payment. If you do not send the money within the provided time, all your files will be permanently crypted and no one will ever be able to recover them.
After this, the GruxEr virus encrypts the files on the compromised computer and it’s final phase is to keep spreading by a .JPG infection worm, via the WORM.EXE module. This infector looks for JPG files and rewrites the beginning of those files using PNG file architecture.
GruxEr Ransomware – Encryption Process
The process of encrypting files is performed via the TEARS.EXE module. When it is activated, it begins to apply the AES encryption algorithm which generates a decryption key afterwards. The files that the virus may target are believed to be the following types:
→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com
After it encrypts the files on the compromised computers, the virus may add the following text in their strings:
“Files has been encrypted with hidden tear
Send me some bitcoins or kebab
And I also hate night clubs desserts, being drunk.”
Fortunately files encrypted by this ransomware virus may be decryptable, since it is part of the hidden tear ransomware viruses. But first, it is very important to remove the files that are malicious from your computer and the registry objects as well as other settings. To do this, we advise you to follow the instructions underneath.
Remove GruxEr Ransomware
Before begging to remove GruxEr from your computer, we strongly suggest that you extract the encrypted files. However, the ransomware appends a lockscreen via the GRUXER.EXE module. And what is worse is that the virus warns you that the files will be permanently lost if your computer is shut down. This is believed to be a scareware message, but we strongly advise not to rely on this information.
The best course of action is to turn off your computer by force, by cutting the power to it, whether it is via the power source or battery (laptop). Then, we advise following the below-mentioned steps:
1. Download a live operating system on your computer which boots from a flash drive. Make sure the live OS is Windows and has what is known as AntiWinLocker which unlocks folders of Windows if you boot from a live OS and bypasses user accounts. One of those live Windows OS’s is called Windows 7 LiveCD [Xemom1]. You can find it on many torrent sites.
2. Install the live OS on a flash drive via software, such as Rufus. If you are having difficulty using rufus, you can follow the instructions on our forum. Use a safe PC, not the one you just turned off.
3. The final step is to follow these instructions in order to boot your computer without risk. This can happen if you remove it’s hard drive and attach it to another safe PC so that you can access the encrypted files and copy them to the Safe PC.
We prefer to give you the “hands-on approach” because it is less complicated and can bypass any Windows login screens, etc. But for this to work, you will need the following tools:
Now it is time to get down to business. Before beginning, bear in mind that even if you have a desktop PC, the instructions do not differ much, because the same principles are applied. We have decided to perform those instructions for laptops because they are most widely spread amongst other PCs.
Step 1: Remove the battery from your laptop and unscrew the screws from it to remove the hard drive, like the pictures below display:
Step 2: Make sure to extract the module with SATA conversion board and port and insert the SATA drive into it.
Step 3: Connect the drive to your computer. It should display as a “Removable Disk” or “Local Drive” with a drive letter other than your original drives. (ex. G:, E:, F:)
Step 4: Copy your files. Now all that is left for you is to access your files, depending on where they are located. If your drive has two partitions, you will see this as two removable drives connected to your computer. In case you keep all your important files in only one partition, and cannot find them on the primary drive, you should go to the following location to access your profile:
There you should be able to see all of your profile’s folders:
After having done this, we advise you to copy the files onto an external drive or better – write them on a disk so that they are safe and unmodifiable by any malware or crashes that may occur on your computer.
Then, you can boot your computer into Safe Mode and safely remove the virus files, by following the instructions down below. Malware researchers strongly advise to remove the Lockscreen first, by locating the string ScreenSaver:
HKCU\Control Panel\Desktop
To open the Windows registry editor, first boot in Safe Mode:
1. For Windows 7,XP and Vista.
2. For Windows 8, 8.1 and 10.
Then hold the WIN + R keys and in the box type regedit. From it’s search bar on the top right, you can type the registry string names for the screensaver. When you remove it, you may remove the lockscreen.
Then you can restart your computer and remove the malware. The best method to remove GruxEr is to scan your computer with an advanced anti-malware software. This will help you to completely get rid of the threat and all settings it has changed.
Automatically remove GruxEr by downloading an advanced anti-malware program
1. Install SpyHunter to scan for and remove GruxEr.
Back up your data to secure it against infections and file encryption by GruxEr in the future.
After removing the virus, you can now begin to decrypt the backed up encrypted files by following the decryption instructions below.
How to Decrypt Files Encrypted by GruxEr
The file-decryption process of HiddenTear ransomware viruses, like GruxEr is not as difficult, but you need to be prepared and do it from a safe computer that is powerful. Let’s begin!
Step 1: Download the HiddenTear BruteForcer by clicking on the button below and open the archive:
Step 2: Extract the program onto your Desktop or wherever you feel comfortable to easily access it and open it as an administrator:
Step 3: After opening it, you should see the main interface of the brute force. From there, choose “Browser Sample” to select a sample encrypted file of the type of ransomware you are trying to decrypt:
Step 4: After this select the type of ransomware from the down-left expanding menu:
Step 5: Click on the Start Bruteforce button. This may take some time. After the brute forcing is finished and the key is found, copy it and save it somewhere on your PC in a .txt file, you will need it later.
Step 6: Download the HiddenTear Decryptor from the download button below:
Step 7: Extract it and open it, the same way with HiddenTear Bruteforcer. From it’s primary interface, paste the key copied from the BruteForcer, write the type of extension being used by the ransomware and click on the Decrypt button as shown below:
After these steps have been completed, you should immediately copy your files to an external device so that they are safe. After this has been done, we strongly recommend completely wiping your drives and reinstalling Windows on the affected machine.
GruxEr Decryption – Conclusion
Viruses like the GruxEr variants are becoming more and more common. Researchers, publish many projects online with the goal to stop ransomware, but this represents an opportunity to coders that develop ransomware and either start infecting users with it or put it up for sale in the deep web. With the expanding of ransomware variants lately, we predict seeing even more infected systems than the year 2015. This is why we advise you to follow our recommendations for securing your computer below:
Advice 1: Make sure to read our general protection tips and try to make them your habit and educated others to do so as well.
Advice 2: Install an advanced anti-malware program that has an often updated real-time shield definitions and ransomware protection.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
Advice 3: Seek out and download specific anti-ransomware software which is reliable.
Advice 4: Backup your files using one of the methods in this article.
Advice 5: : Make sure to use a secure web browser while surfing the world wide web.
