Gero Ransomware Description
Recently, malware analyzers have come across a brand-new ransomware threat called Gero Ransomware. Nowadays, even less-skilled cyber crooks can build data-locking Trojans like the Gero Ransomware, as there is a practice of borrowing the code of an already established ransomware threat and only slightly alter it.
Propagation and Encryption
This is the case with the Gero Ransomware, as once cybersecurity researchers studied this threat they found out that it is a variant of the widely popular STOP Ransomware. It is not yet known how the authors of the Gero Ransomware are propagating their creation. There are speculations that mass spam email campaigns alongside bogus software updates and fake pirated copies of popular applications may be at play regarding the propagation of the Gero Ransomware. A scan will be performed as soon as the Gero Ransomware gains access to your system. This is done so that the threat can locate the files, which it was programmed to target. Often, the list of file types that ransomware threats target is very long so that the data-locking Trojan is guaranteed to cause maximum damage. Once the files of interest are located, the Gero Ransomware will start encrypting them. When a file undergoes the encryption process of the Gero Ransomware, its name will be altered. The Gero Ransomware appends a '.gero' extension at the name of each affected file. This means that an audio file called 'lino-points.mp3' will be renamed to 'lino-points.mp3.gero' once the encryption process is completed.
The Ransom Note
Then, the Gero Ransomware will drop a ransom note that goes by the name '_readme.txt.' In the note, the attackers make it clear that the ransom fee is $980. However, they state that every user that contacts them within 72 hours of the attack will receive a 50% discount and will have to pay $490 instead. The creators of the Gero Ransomware offer to unlock one file free of charge as proof that they are in possession of a functioning decryption key. There are two emails given out as a means of contacting the attackers – 'firstname.lastname@example.org' and 'email@example.com.'
You should avoid contacting cyber crooks. There is nothing good coming out of it. A safer approach in this sticky situation would be to download and install a legitimate anti-spyware solution and have it wipe off the Gero Ransomware from your computer. Next, you can try recovering some of the files using a third-party data-recovery application.
Do You Suspect Your PC May Be Infected with Gero Ransomware & Other Threats? Scan Your PC with SpyHunterSpyHunter is a powerful malware remediation and protection tool designed to help provide PC users with in-depth system security analysis, detection and removal of a wide range of threats like Gero Ransomware as well as a one-on-one tech support service. Download SpyHunter's FREE Malware Remover
Security Doesn't Let You Download SpyHunter or Access the Internet?Solutions: Your computer may have malware hiding in memory that prevents any program, including SpyHunter, from executing on your computer. Follow to download SpyHunter and gain access to the Internet:
- Use an alternative browser. Malware may disable your browser. If you're using IE, for example, and having problems downloading SpyHunter, you should open Firefox, Chrome or Safari browser instead.
- Use a removable media. Download SpyHunter on another clean computer, burn it to a USB flash drive, DVD/CD, or any preferred removable media, then install it on your infected computer and run SpyHunter's malware scanner.
- Start Windows in Safe Mode. If you can not access your Window's desktop, reboot your computer in "Safe Mode with Networking" and install SpyHunter in Safe Mode.
- IE Users: Disable proxy server for Internet Explorer to browse the web with Internet Explorer or update your anti-spyware program. Malware modifies your Windows settings to use a proxy server to prevent you from browsing the web with IE.