How to remove Gollum ransomware

Gollum – a virus which affects the computer by encrypting files and displaying a ransom note

Gollum ransomware is a cryptovirus also known as Bitshifter. It sneaks into the system unnoticed and usually is carried out by various spam emails^[1] or fake Flash updates. Once installed Gollum virus starts its hazardous activity immediately. First, it affects personal files by adding the .encrypted extension. For that, it uses a combination of AES^[2] and RSA encryption algorithms. As soon as data is blocked, the Command & Control server controlled by hackers sends out ransom notes – ransom_pay.html and ransom_note.txt. Crooks explain that victims have to pay 0.05 BTC into a specified Bitcoin address in order to receive a decryption tool for data decryption.

Here is a piece of the ransom note provided by the virus:

MOST OF YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED BY AES 256-CBC AND RSA 2048!

well, if you want to restore all your files you should
send 0,05000000 BTC to the next bitcoin address as you see below
[1352RtNRpYRdKLWUUDklBUKP7p4SqMAiTF]
until 04-Jul-2018 08:33:12 (UTC)

Furthermore, this severe threat makes several changes to a computer's parameters to gain persistence. In some cases, ransomware may be tricky to detect as it can not yet be included in the AV database. Therefore, to remove Gollum virus from your computer and avoid further damage you should download and install an anti-malware tool. We recommend using FortectIntego for this process.

Another piece of advice is not to pay the ransom. Even if you are desperate – better don't. After the money is transferred, victims may not receive the promised decryption key and face only money loss. Additionally, some malware is capable of tracking users' activity on the infected machine, making the identity theft a more likely possibility. To avoid such damaging activity, perform Gollum ransomware removal as soon as you discover files with the .encrypted extension.

Moreover, when your files are locked up, and the system starts to struggle, Gollum cryptovirus also opens a path for other harmful threats. It might lead to another severe malware infection, such as crypto-miner, trojan horse or a keylogger. This is just another reason why you should get rid of the cyber threat as quickly as possible.

Avoid ransomware infections by being cautious

According to IT experts^[3], ransomware is called a sneaky virus for a reason. These are the ways cryptovirus might infiltrate your PC system:

• Fake updates. This ransomware seems to be actively distributed via fake Flash Player updates.
• Spam emails. Another common distribution method. It comes like legitimate-looking content and tricks the victim into opening the harmful file attached or click on the malicious link.
• Malicious websites. If you are careless enough and often visit file-sharing websites (such as torrent ones) and download executables or other files, the probability of infection increased drastically. Thus, avoid such domains. Besides, downloading cracked software is a criminal offense and could be punished by law.

To avoid ransomware infection, you need to remember a few things. First, always be careful and pay attention to every website you visit and make sure all the programs you download are legitimate. Although some emails might be placed in the spam box mistakenly, you should take extra care when you open any of them. 

Get rid of Gollum ransomware and protect your computer

To remove Gollum virus from your computer system, you should rely on professional anti-malware software. We recommend downloading and installing FortectIntego, SpyHunterCombo Cleaner, or MalwarebytesMalwarebytes. It will display elimination instructions and help you get rid of the cyber threat successfully.

The complete Gollum removal process might take a while due to ransomware blocking security software in normal mode. In such case, reboot your PC and enter Safe Mode with Networking, as explained below. Only then you can proceed with recovery procedure – either get your files back from a backup or try third-party software that could help.