Do you know what Gillette Ransomware is?
Gillette Ransomware is an infection that was created to encrypt your personal files and then make you pay money to get them decrypted. Unfortunately, the promise to decrypt your files is completely empty, and it is introduced to you only to make you think that you have a valid option. In reality, if your files were encrypted, there is nothing you can do to recover them. Hopefully, the files encrypted by the infection are not the only ones you have, and we are talking about backups here. If you have backups, you have nothing to worry about. Just quickly remove Gillette Ransomware, and then transfer the backup copies to replace the corrupted files, which, of course, you want to delete to free up space. If backups do not exist, take this as a painful lesson that personal files must be secured.
According to our research team, Gillette Ransomware comes from the Rapid Ransomware family, and so it is not surprising that it works similarly to other threats from this family. It might use spam emails to hide itself, and the victims might be tricked into executing this malware themselves. Unauthorized remote access connection, malicious downloaders, and other security backdoors could help this threat travel too. Once executed, it takes no time to encrypt files, and the “.GILLETTE" extension is added to their names in the process. This is where the name of Gillette Ransomware comes from. Once that is handled, the threat also creates scheduled tasks to execute itself and to open a ransom note. The ransom note is set to open every minute, and it also should auto-start with Windows. It was found that there are two different ransom note files (“Decrypt DATA.txt” and “recovery.txt”), and we advise removing both of them.
Gillette Ransomware screenshot
Scroll down for full removal instructions
The message represented via both of the Gillette Ransomware ransom note files is very straightforward. First, the message informs that files were encrypted. Then, it states that the only thing you can do is contact the attacker and pay a ransom to get the so-called “decryption software.” Even though the exact sum of the ransom is not disclosed, it is revealed that it must be paid in Bitcoin. The message ends with two email addresses (gillette_help@mail.com and gillette-help@mail.com) and a unique ID number that must be sent to them. This is your line of communication. Whether you have no intention of paying the ransom, or you are seriously considering the option, emailing cyber criminals is a terrible idea. They can flood you with spam emails in the future, and the alleged decryptor might conceal malware. Of course, if you learn how to pay the ransom and then you pay it, the attackers should seize communicating with you. Would you get a decryptor before that? Highly unlikely.
We hope that you can delete Gillette Ransomware from your operating system manually using the guide below, but do not panic if this option is not for you. The best thing you can do for your own security and the security of your personal files is to install anti-malware software. It will remove Gillette Ransomware automatically, and then it will strengthen the protection overall to ensure that you do not need to face malicious threats in the future. Besides installing this software, you also need to figure out the security of your personal files. While security software should help you immensely, you also want to back up your files to guarantee that they are safe at all times, regardless of what invades your system.
Remove Gillette Ransomware
- Delete the ransom note file called Decrypt DATA.txt.
- Launch Windows Explorer by tapping keys Win+E.
- Enter %APPDATA% into the quick access field.
- Delete the files named info.exe and recovery.txt.
- Enter %WINDIR%\system32\Tasks into the quick access field.
- Delete the tasks named Encrypter and EncrypterSt.
- Exit Explorer and then launch Run by tapping keys Win+R.
- Enter regedit.exe and click OK to launch Registry Editor.
- Navigate to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
- Delete the values named Encrypter_074 and userinfo.
- Exit Registry Editor and then quickly Empty Recycle Bin.
- Install a malware scanner you can trust to run a thorough system scan.
In non-techie terms:
Gillette Ransomware is a threat that can permanently corrupt your personal files. This infection encrypts files to make you pay the ransom. Since a free decryptor did not exist at the time of research, and decrypting files manually was not possible, the option offered by the attackers was the only one. Unfortunately, this option is fictitious, and if you follow the instructions (email the attacker and pay the ransom), you are unlikely to get anything. Nothing will change, except for the amount of money you lose. If you have backups for your personal files, you will get back to normal in no time, but if you end up losing your precious personal files, make sure you start backing up new files. It is also important that you secure your operating system, which you can do using anti-malware software, which also can delete Gillette Ransomware. The alternative to that is manual removal, and, hopefully, you can successfully follow the manual removal steps above.