How to remove GOZ virus

What is Goz virus?

GOZ virus (also known as GameOver Zeus, P2PZeus and GameOver Trojan) is a dangerous trojan horse, which has ability to steal people’s banking logins, passwords and other credentials or sensitive information. It can also be involved to the distribution of Cryptolocker ransomware and other ransomwares that have ability to encrypt specific files that are kept on user's computer and then ask to pay a ransom for their decryption. Unfortunately, if GOZ virus downloads Cryptolocker or other cyber threat to the system, anti-malware helps only in the removal of this virus. Encrypted files can be decrypted only by paying a ransom, which varies from $100 to $500… Fortunately, you can try using such programs as R-studio and Photorec for recovering your files but we can't assure you that these program will work on your computer.

UPDATE! There is a hope that this virus won’t affect your system – according to the latest news, FBI has managed to take GOZ virus down. However, it is believed that millions of PC users are still infected with this Trojan horse. For checking the system we highly recommend using reputable security software. For that we would like to recommend using FortectIntego. Of course, before running it you should update its database. Please, do NOT delay this scan because Goz malware can easily lead you to money loss, identity theft and similar issues.

How can GOZ virus infect my computer?

GOZ virus is mostly spread in the US, Canada and Russia. It is mostly done with a help of spam campaigns that involve malicious attachments and message body that informs about “important” situation. Once victim is tricked into believing that something is wrong and clicks on the attachment, he/she downloads a malicious .exe file that is a GOZ virus. The most interesting fact about this Trojan horse is its Peer-to-Peer capability that is used for downloading a configuration file. Please, be very careful with emalis that present themselves as important messages from FDIC, IRS, MySpace, Facebook, or Microsoft. If you think that your PC was affected, don‘t waste the time and follow a guide that is given below:

How to remove GOZ virus?

When trying to remove GOZ virus from the system, you should think about reputable anti-spyware. We recommend using FortectIntego or SpyHunterCombo Cleaner. Make sure you use updated versions to detect all files that belong to this dangerous virus. If GOZ has already infected your PC with Cryptolocker virus or similar ransomware, try to follow these steps:

1. Reboot you infected PC to 'Safe mode with command prompt' to disable virus (this should be working with all versions of this threat)
2. Run Regedit
3. Search for WinLogon Entries and write down all the files that are not explorer.exe or blank. Replace them with explorer.exe.
4. Search the registry for these files you have written down and delete the registry keys referencing the files.
5. Reboot and run a full system scan with updated FortectIntego.

Also, it's advisable to have a backup of your data. If you would use USB, CD's, DVD's or at least online backups, you would get ability to avoid problems related to encrypted data. If you want to restore your files, you may try using such recovery tools as R-studio and Photorec.