How to remove GPGQwerty ransomware

GPGQwerty ransomware is a crypto-virus which unsuccessfully tries to encrypt users’ files

GPGQwerty ransomware was noticed at the start of March 2018. The ransomware drops the README_DECRYPT.txt file and tries to encrypt data using gpg.exe. The virus is supposed to use the extension “.qwerty” to encrypt files. However, it merely provides ransom note and does nothing else.

The .txt file dropped by Qwerty virus states that all files on victim’s computer have been locked. The ransom is demanded in Bitcoin cryptocurrency and should be paid into BTC walled 3M3QNTzEpEzFgzUtXZRT5FjG1YfVDyh9K. Cybercriminals ask for 0.1 Bitcoin. At the time of the writing, 0.1 Bitcoin is worth $1127.36.

As soon as victim pays the ransom, hackers will allegedly send the encryption key with can release all the locked files. However, no data is encrypted. Hence, all you have to do is remove GPGQwerty ransomware from your computer using FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.

A user is also assigned a unique ID which gives attackers an identification for each of the victims. A user is also informed that he can send one file (up to 1MB) which does not contain any important information for hackers to unlock it and show that the decryption is possible.

Some victims might only read ransom note and not check their files. Those users would assume that the ransomware has done the job and locked up all files. However, please do not contact GPGQwerty authors as you would only be funding their illegal activities, which can lead to more ransomware production.

Working ransomware would encrypt all .txt, .doc, .html, .mpeg, .jpg, mp3, etc. files and affix the extension to each of these files. In this case, the “.qwerty” extension would be used – a file called picture.jpg would be turned into picture.jpg..qwerty. However, the extension is never assigned to any of the files.

Most likely, the ransomware is not entirely developed yet. However, this might change in the future, once attackers figure out the way how to properly encrypt files. Nevertheless, 38 out of 67 AV engines^[1] recognize and mark GPGQwerty file as malicious. Therefore, do not delay GPGQwerty virus removal.

Check your inbox carefully as emails might contain malware

The most prominent ransomware distribution technique used by hackers is spam emails. In most cases, attackers target thousands of users and send them phishing emails. Typically, the person writing an email pretends to a representative from an important organization, such as a bank, government or a well-known retailer. The author uses social engineering to make victims open the malicious file which contains ransomware code.

Therefore, be extremely careful when handling emails from unknown sources. The signs of a phishing email^[2] are quite visible as soon as you encounter them few times. Additionally, your webmail provider uses a built-in scanner which marks most suspicious emails. Thus, never ignore these warnings.

Delete GPGQwerty ransomware safely and quickly

Security experts^[3] warn that manual GPGQwerty removal should not be attempted by anyone, as the code used is exceptionally complicated. Instead, users should rely on a robust anti-malware software which can take care of everything automatically.

This method will remove GPGQwerty ransomware quickly. However, be aware that the virus might prevent the startup of security software. In this case, restart your PC and boot it in Safe Mode with Networking. Security software can then quickly be started from there.