How to remove GNS ransomware

GNS ransomware – malicious program designed to prevent access to personal files

GNS ransomware is a threat that has been spotted spreading around the world in early July 2020^[1] and was attributed to the Dharma ransomware family, which has been around for several years now. The malware spreads via several channels, including malicious spam emails, repacked installers, and weakly protected RDP connections.

As soon as the payload is executed, GNS ransomware begins the data locking process with the help of RSA + AES ciphers,^[2], which also modifies file names. For example, a file “picture.jpg” is turned into “picture.jpg.id-random string.[geniusid@protonmail.ch].GNS,” and can no longer be accessed by the victims.

Malware also drops a ransom note FILES ENCRYPTED.txt, as well as shows a popup window. These documents serve as a message from GNS files virus authors and explain that users have to pay a ransom in Bitcoin in order to regain access to their data.

While GNS ransomware can use several different distribution methods, it mostly penetrates machines with the help of social engineering. Believable messages are crafted by malware authors and then delivered to thousands of users. Clipped to such emails are the attachments which hold the payload of ransomware. Hackers behind the strain often use double extensions in order to confuse users and make them believe that they are not opening an executable (.exe) file.

Once such a file is executed, Windows operating system is heavily modified, and several built-in backup systems deleted. This is done to prevent users from recovering from the virus without paying the ransom. In some cases, even GNS ransomware removal might not help when it comes to system performance after the infection is terminated. In such a case, we suggest using PC repair software FortectIntego, which could help to regain computer stability after malware intrusion.

GNS files virus begins the file encryption process immediately – it looks for pictures, music, videos, databases, MS Office documents, and other types of most commonly-used file types. The process of encryption is swift – and for a reason. In many cases, the data encryption process might begin to slow down the computer, which could make users suspicious and interrupt the process. Thus, ransomware typically encrypts only a few kilobytes of each file.

As soon as the encryption process is finished and the .GNS extension applied, malware does not hide its presence on the system anymore and displays the following information via the pop-up window:

YOUR FILES ARE ENCRYPTED
Don't worry,you can return all your files!
If you want to restore them, follow this link:email geniusid@protonmail.ch YOUR ID –
If you have not been answered via the link within 12 hours, write to us by e-mail:geniusyourid@cock.li
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Another file, FILES ENCRYPTED.txt, which can be opened via the Notepad, includes a much shorter description of a ransomware attack:

all your data has been locked us
You want to return?
write email geniusid@protonmail.ch or geniusyourid@cock.li

Most security researchers^[3] advise not paying the ransom, as it might result in not only data but also money loss. Instead, we suggest you remove GNS ransomware from your system with the help of powerful anti-malware software and then use alternative methods for data recovery – we provide some solutions below.

Should you pay the ransom? GNS files recovery methods

We advise you to take the words of cybercriminals behind the GNS virus with a grain of salt: they claim that other methods of data recovery will result in a complete data loss. This is not true, however, since some alternative methods might actually be successful in GNS virus files recovery.

In case malware failed to delete Shadow Volume Copies and System Restore features, you would most likely be able to retrieve all data without any issues. However, all the modern and working crypto-malware strains are programmed to delete the automatic backups (although this process might fail due to bugs or other reasons).

Another solution is using third-party recovery tools – this option also has a very small success rate, as most of such tools rely on retrieving working copies of files from the hard disk. Note that neither data recovery software, nor anti-malware can remove .GNS file extension (i.e., decrypt current files), as it is not designed for such a purpose.

Finally, paying criminals is your last resort. Before you consider this option, please take points into consideration:

• Crooks might send you a non-working decryptor
• Hackers might not send you anything and completely ignore you
• Payments only fuel the will of cybercriminals to create more malware
• You might be a target of future attacks, as threat actors would know you are willing to pay.

As you can see, the task of recovering GNS files is not that easy. We suggest you keep backups ready in case such unfortunate circumstances happen to you in the future. To protect your machine, use reputable anti-malware, update your operating system and the installed software on a regular basis, and never download software cracks.

Delete GNS ransomware from your computer and only then attempt file recovery

Many ransomware victims find themselves in a state of disbelief and even shock after they find out that they cannot open their photos, school papers, or a work project. However, panicking doe nothing in such a situation, and handling it correctly is the only way to go forward. If you never had to deal with GNS ransomware removal, it might seem like a very complicated task, however.

Nonetheless, considering you had no backups available, you should copy all the encrypted files before you remove GNS ransomware from your computer. Encrypted data does not store any malicious code within it, so having them on another medium is safe. Likewise, security researchers might develop a working GNS ransomware decryptor in the future.

To delete the GNS file virus from your machine, perform a full system with anti-malware software, although do not get surprised that your files till cannot be opened. As explained earlier, malware termination will not grant you access to locked files. Instead, follow the instructions for alternative data recovery methods below.