How to remove GandCrab 3 and decrypt .CRAB files

What is GandCrab 3?

GandCrab 3 is a third version of a GandCrab ransomware. There are no particularly new features in this GandCrab 3, however the virus is spreading quite rapidly and it’s still dangerous for any system. This ransomware may become a serious issue for your computer, because it will encrypt all the important, personal and sensitive data. Encryption would not let you access encrypted files is any possible way. GandCrab 3 uses AES-256 (CBC mode) + RSA-2048 encryption algorithm in order to encode the files. In this article you may learn how to remove GandCrab 3 ransomware and decrypt .CRAB files without paying a ransom.

GandCrab 3 ransomware adds .CRAB file extension to the name of all the encrypted data. For example, sample.png file turns into sample.png.CRAB file. Once data on your computer is encrypted, GandCrab 3 ransomware will create CRAB-DECRYPT.txt text file in each folder with the encrypted data and change desktop wallpapers. Here’s CRAB-DECRYPT.txt ransom note:

—= GANDCRAB V3 =—
Attention!
All your files documents, photos, databases and other important files are encrypted and have the extension: .CRAB
The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
0. Download Tor browser – https://www.torproject.org/
1. Install Tor browser
2. Open Tor Browser
3. Open link in TOR browser:
4. Follow the instructions on this page
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
The alternative way to contact us is to use Jabber messanger. Read how to:
0. Download Psi-Plus Jabber Client: https://psi-im.org/download/
1. Register new account: http://sj.ms/register.php
0) Enter “username”: 21b1a2d1729f0695
1) Enter “password”: your password
2. Add new account in Psi
3. Add and write Jabber ID: ransomware@sj.ms any message
4. Follow instruction bot
ATTENTION!
It is a bot! It’s fully automated artificial system without human control!
To contact us use TOR links. We can provide you all required proofs of decryption availibility anytime. We are open to conversations.
You can read instructions how to install and use jabber here http://www.sfu.ca/jabber/Psi_Jabber_PC.pdf
CAUGHTION!
Do not try to modify files or use your own private key. This will result in the loss of your data forever!

GandCrab 3 uses typical ransomware scheme to force you to pay them. After finishing encrypting process, the ransomware will state that there are no ways to recover your files but to pay ransom. You should know that nobody can guarantee that they will help you, don’t trust them, these cyber criminals are not going to do their part of the deal. Mostly they are just ignoring people who pays them. So please do not invest into this criminal scheme. Trust us, there’s no need to panic, GandCrab 3 ransomware does very complicated encryption, but it does not damage, move or delete your files, which means you have chance to recover your personal data.

How to remove GandCrab 3 from your computer?

Unfortunately, there are no possible ways to remove GandCrab 3 ransomware manually, because the infection goes too deep into your system. You can remove the virus only with automatic removal tools. You may try to use SpyHunter to clean your system from GandCrab 3 ransomware.

Download SpyHunter 5 _{SpyHunter provides an opportunity to remove 1 detected malware for free during trial period. The full version of the program costs $39,99 (you get 6 months of subscription). By clicking the button you agree to EULA and Privacy Policy. Downloading will start automatically.}

How to decrypt .CRAB files encrypted by GandCrab 3?

Once you’ve removed virus, you are probably thinking of recovering files from encryption. Let’s take a look at possible ways of decrypting your data.

Decrypt .CRAB files with automated decryption tools

Unfortunately, due to novelty of GandCrab 3 ransomware, there are no available automatic decryptors for this virus yet. Still, there is no need to invest in malicious scheme by paying ransom. You are able to recover files manually.

Decrypt .CRAB files manually

You can try to use one of these methods in order to restore your encrypted data manually.

Recover data with Data Recovery

1. Download and install Data Recovery
2. Select drives and folders with your files, then click Scan.
3. Choose all the files in a folder, then press on Restore button.
4. Manage export location.

Restore data with Windows Previous Versions

This feature is working on Windows Vista (not Home version), Windows 7 and later versions. Windows saves copies of files and folders which you can use to restore data on your computer. In order to restore data from Windows Backup, take following steps:

1. Open My Computer and search for the folders you want to restore;
2. Right-click on the folder and choose Restore previous versions option;
3. The option will show you the list of all the previous copies of the folder;
4. Select restore date and the option you need: Open, Copy and Restore.

Restore the system with System Restore

You can always try to use System Restore in order to roll back your system to its condition before infection infiltration. All the Windows versions include this option.

1. Type restore in the Search tool;
2. Click on the result;
3. Choose restore point before the infection infiltration;
4. Follow the on-screen instructions.

How to protect PC from GandCrab 3?

It’s pretty difficult task to get rid of any ransomware, including GandCrab 3. But you can easily prevent any infection of your PC. HitmanPro.Alert’s CryptoGuard can help you with this problem. It’s one of the best anti-ransomware applications. No matter how sneaky it is, HitmanPro.Alert’s CryptoGuard will stop GandCrab 3 infiltration to your system. After detection, this program removes all the related to the ransomware data and prevents your file from being encrypted.

Download HitmanPro.Alert