Do you know what Guvara Ransomware is?
Guvara Ransomware adds the “.guvara” extension to the files it corrupts, and if you have found this specific extension added to the names of files that you cannot open, you have your culprit. Unfortunately, even if you can identify the infection, you cannot do anything to recover the files corrupted by it. A complex encryption algorithm is used to encrypt files, and after that, they can be read only using a decryptor. Where is it? If it exists, it is in the hands of cyber criminals, and they want you to pay money for it. Unfortunately, there are no guarantees when it comes to cyber attackers, and if you wholeheartedly believe that your files would be decrypted as soon as you paid the ransom, most likely, you are very wrong. Of course, we cannot say for sure that your transaction would be a waste because cyber criminals are unpredictable, but know that your chances of ever restoring the files are slim to none. This is why we focus not on the payment of the ransom but on the removal of Guvara Ransomware.
It took our research team a glance to figure out that Guvara Ransomware is part of the STOP Ransomware family, just like Kiratos Ransomware, KEYPASS Ransomware, INFOWAIT Ransomware, and many other well-known infections. They usually spread using existing remote access vulnerabilities and spam emails, but that is how most file-encrypting threats spread anyway. If they found their way in, they usually cause Explorer to crash, but that is not the extent of the attack. It is most important for Guvara Ransomware and its clones to encrypt files. Needless to say, there is no point in encrypting system files because they can be downloaded from the web and replaced. That might not be the case with personal files. In fact, they can be replaced only if backup copies exist on cloud or external drives. Wherever the files are encrypted, the infection creates its own file named “_readme.txt.” It is just a text file, and it is safe for you to open it. That being said, when you initiate the removal process, remember to delete every single copy of this file.
Guvara Ransomware screenshot
Scroll down for full removal instructions
The ransom note message starts with this statement: “ATTENTION! Don't worry my friend, you can return all your files!” This might give you false hope, and that is exactly what the attacker wants. They want you to believe that you have an option, and that option entails purchasing a “decrypt tool and unique key.” The note informs that the software you need to recover encrypted files costs $490 in the first 72 hours and then increases to $980 after that. To get more information about the payment and to obtain the decryptor, you are urged to email vengisto@india.com and vengisto@firemail.cc. We recommend doing neither because buy emailing the attackers, you would be exposing yourself to more malicious emails, and by paying the ransom, most likely, you would be wasting money that you could invest to strengthen your virtual security.
Needless to say, whether or not you want to pay the ransom, you have to act fast because as long as Guvara Ransomware is installed, you will remain at risk. We have a full manual removal guide for you if you would like to give a shot at eliminating the threat yourself. As you will see, the first step entails identifying and deleting the main launcher file, and if you are not able to do that, you will not be able to clear the infection on your own. The good news is that you do not need to do it yourself. Instead, you can install an anti-malware program that will find and erase the threat automatically. Furthermore, after it deletes Guvara Ransomware, it will secure your operating system to ensure that other file-encryptors cannot invade.
Remove Guvara Ransomware
- Delete the [random].exe installer that launched the infection (since the name and location are likely to be unique, we cannot point you to it).
- Delete every single copy of the ransom note file named _readme.txt.
- Tap Win+E keys simultaneously to launch Windows Explorer.
- Enter %LOCALAPPDATA% (depending on Windows OS, %USERPROFILE%\Local Settings\Application Data\).
- Delete the ransomware-related [random] folder with malicious [random].exe file inside.
- Enter %WINDIR%\System32\Tasks\ into the field at the top.
- Delete a ransomware-related task named Time Trigger Task.
- Exit Explorer and then tap Win+R to launch Run.
- Enter regedit to launch Registry Editor and go to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
- Delete the value named SysHelper if the value data points to the location of [random].exe file in step 5.
- Exit Registry Editor and then Empty Recycle Bin.
- Perform a full system scan using a legitimate malware scanner.
In non-techie terms:
If your files have backup copies, there is no point in postponing the removal of Guvara Ransomware. Even if backups do not exist – in which case, your personal files are encrypted permanently – you need to eliminate the malicious infection as soon as possible. You have an option of deleting Guvara Ransomware manually, but we cannot guarantee that you will succeed. On the other hand, if the task is too complicated for you, there is nothing better than a reliable anti-malware program. It will immediately scan your system, delete found threats, and reinstate full protection to ensure that you do not need to deal with existing threats or face new ones in the future. Our research team strongly recommends implementing anti-malware software even if you successfully delete the ransomware all on your own.