Gotcha Ransomware - How to remove

Did your files (everything — videos, pictures, documents, archives) disappear, only for a multitude of unfamiliar, unopenable files with the “.gotcha” extension to show up in your folders?

[file name].gotcha

Did you find a text file named “!GOTCHA!.txt”, telling you to immediately contact someone who, for a small fee, will get back your files?

Gotcha is a new ransomware virus: a type of infection that scrambles your files into unrecognisable data and tries to extort people’s money by promising to return the files to normal if the victim gives money to the criminals.

How does Gotcha encrypt files?

Like most ransomware nowadays, Gotcha uses hybrid cryptography. Symmetric cryptography is fast but not very secure — it leaves a key which can be used to reverse the encryption and fix the files. Asymmetric cryptography is more secure — it uses different keys for encryption and decryption — but it’s slow. Gotcha most likely encrypts your files with the symmetric algorithm and then encrypts the decryption key with an asymmetric algorithm. Only the cybercriminals can now fix your encrypted files.

If you catch the encryption process in action — for example, if only some of your files are encrypted — you can interrupt the process by immediately shutting down the computer and disconnecting it from the internet. This will at least give you time to decide what you should do next. For example, you could consult an IT specialist.

If it’s too late and Gotcha already encrypted all your files, I think it’s a very bad idea to pay the ransom. Not just because you’d be paying criminals and supporting this illegal practice of extortion, but also because not nearly everyone who pay the ransom get their files back.

There are sometimes third-party decryption tools developed, so if you want, you can save your encrypted files and wait and see if one is created for the Gotcha virus.

Who does ransomware target?

Targeted attacks

• Infected hardware: dropping a thumb drive in the car park of a business or government agency, especially if the device has the logo of that business, is one strategy that has been used to infect networks with viruses (this power plant got infected and lost three weeks of work).
• Passwords to Remote Desktop access, if they’re leaked or guessed by some hackers, can give them control of a computer. Malware can be downloaded remotely, settings can be changed, additional administrator accounts can be created, making the cybercriminals very tricky to get rid of.

Mass distribution

• Spam emails can deliver Trojans to a computer. If the recipient of a malicious email opens the infected attachment file and allows macros to run, or if they click on a download link, this can result in the computer being infected.
• Pirated files can sometimes be viruses, or come bundled with some.

Most ransomware attacks actually target businesses — cryptoviruses are very destructive to productivity, so businesses are often willing to pay the ransom because it is seen as simpler and faster than the other solutions. Individual people might have more freedom to look for better ways to get their files back, and there is a guide below to try and restore your files without having to contact the Gotcha developers.

Who is vulnerable to ransomware?

Distracted people, those who don’t know a lot about how malware works, and those whose personal information has been leaked. If you are careful and skeptical, you might be able to avoid a lot of infections. Change your passwords, scan new files before running them, pay attention to details.

Computers that do not have a good antivirus program installed, or those that have an operating system that hasn’t been updated for a long time. Some operating system updates are very important to security. When a weakness is discovered, usually it’s not long until criminals find a way to exploit it. They bet on some people not patching their operating system and being vulnerable.

It’s risky to not have important files backed up. Not just because of the risk of a Gotcha (or other ransomware) infection, but also because disks can fail. Keep up-to-date copies of your files somewhere separate from your computer.

How to remove Gotcha

Get an antivirus program which has a good reputation and is professional, like Spyhunter. Remove malware. There might be more viruses than just Gotcha, as they all spread using similar strategies.

Follow the guide below to manually restore your system.

Extorting people for money by breaking their files is illegal, so if you want, you can probably contact the police about this.

Automatic Malware removal tools

How to recover Gotcha Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Gotcha Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Gotcha Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Gotcha Ransomware. You can check other tools here.  

Step 3. Restore Gotcha Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Gotcha Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Gotcha Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.