GoodMorning Ransomware - How to remove

There is a malware infection called GoodMorning. GoodMorning is file-locking ransomware: it encrypts files, changes their names, then asks the victims to pay money if they want to get their files back.

As GoodMorning is still pretty new, there is not much known about it. At the time of writing, there’s no free decryptor or another easy solution for fixing the data that was encrypted by GoodMorning.

About GoodMorning ransomware:

Threat type	Ransomware.
Signs of GoodMorning infection	Files do not open because they are encrypted, file names have a second extension – “GoodMorning”, notes called GoodMorning.txt can be found in some folders.
How to get your files back	Restore data from backups, look into file repair, wait for other solutions.
How to delete GoodMorning	Use antivirus scanners (Spyhunter, others) to find and delete all malware.

Hows to recognize GoodMorning ransomware

GoodMorning ransomware is pretty new and not very popular. It’s good that it’s not too widespread, but there’s not very much information on it out there.

Like all file-encrypting ransomware, GoodMorning infects Windows PCs, discovers the files stored on those PCs, and encrypts them.

The files locked by GoodMorning can be recognized by their changed names, where an id number and an email address are included in the name of each file. If GoodMorning encrypted your files, their names might look something like this:

picture.jpg.Id(ABC123456) Send Email([email protected]).GoodMorning

Besides GoodMorning, the phrase TroubleMaker has also been used by this ransomware. In the future, other names might be used, too.

The GoodMorning ransomware is also programmed to create ransom notes – GoodMorning.txt. Here’s the text:

Good Morning!!

All your Files Have Been Encrypted

You can not protect your system I want help you

You must pay an amount of bitcoin to decrypt your files

If you want restore your files or you want my help send this ID : [id number]

to this email : [email address]

If you didn’t recieve any message , write message to this email : [email address]  or this : [email address]

!!!!!!!

I forget to tell this , never try decrypt your files by yourself , maybe you lost them forever

and do not rename them

Most likely, GoodMorning spreads via hacked RDP accounts or malicious emails. Emails are often used to spread malware – for instance, fake work emails with malicious attachments were recently used to spread a malicious version of CobaltStrike.

Can you fix your files?

GoodMorning uses encryption (probably hybrid encryption) to break files. Encrypted files can’t be opened because their contents were basically corrupted. The only way to fix the encrypted files is with a decryption program and a unique decryption password/key. While a decryption tool might be available, the decryption keys are only known to the people behind GoodMorning.

The best way to get back your data after a GoodMorning attack is to restore it from a backup. But what if you didn’t have a backup?

The people who made GoodMorning ransomware are trying to get money, which is why they ask for Bitcoin. They promise that, if you pay them, they’ll fix your files. But there’s no way to know if they will. This is for a couple of reasons:

• GoodMorning is new. The extortionists behind it have no reputation. There’s no way to know that their decryption tools work at all.
• Extortionists can’t ever be trusted. It’s not unusual for such criminals to ask for a second ransom payment or to fail to send any decryption tools.

Unfortunately, there might not be a good solution to fixing the damage done by the GoodMorning ransomware.

File recovery programs (like EaseUS) might restore some of the lost data, but that’s not guaranteed – always test with a free program or free trial first. Not to mention, this method doesn’t work for SSDs.

There’s a chance that a free decryption tool might be developed. It would appear on Nomoreransom.org.

Sometimes, ransomware infections don’t completely encrypt some files. In these cases, it’s possible to recover some data by repairing those files.

How to delete GoodMorning

To use your computer normally again, delete the GoodMorning malware. Use antivirus programs (for example, Spyhunter) to scan your computer and delete the GoodMorning ransomware.

Unfortunately, not all antivirus scanners detect GoodMorning. Here is a scan of one variant of the GoodMorning ransomware: Virustotal.com. At the time of writing, only 21/69 security programs flag GoodMorning. In part, this is because GoodMorning is relatively unknown and unpopular.

To delete GoodMorning, you can reset your computer and reinstall your operating system. But still, if you keep any of your files, scan them with antivirus programs to make sure that no malicious files are left. It happens from time to time that a ransomware victim gets reinfected with the same (or different) ransomware right after the first attack and one of the ways this can happen is if the victim once again opens the malicious file that infected their computer originally.

Automatic Malware removal tools

How to recover GoodMorning Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before GoodMorning Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of GoodMorning Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to GoodMorning Ransomware. You can check other tools here.  

Step 3. Restore GoodMorning Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually GoodMorning Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover GoodMorning Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.