The Gomme Virus is a dangerous new ransomware that encrypts sensitive user data and extorts the victims for a ransomware fee of 25 US Dollars. The Gomme virus engine renames all processed data with the .gommemode file extension. Affected computer users can restore their files by following our in-depth Gomme ransomware removal instructions.
Manual Removal Guide
Recover .gommemode Files
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
How Does Gomme File Virus Infiltrate the System?
The Gomme virus can infect computer victims by using various strategies. As the threat has been analyzed and does not show a correlation with any of the known malware families the experts cannot conclude which is the main infection method. This means that it is possible to distribute the Gomme virus samples in several different ways.
One of the main ways of getting infected with the Gomme virus ransomware is by opening infected email messages. The hackers send out emails that pose as being sent by legitimate institutions or users. The social engineering strategies used distributed the samples as either links located on a hacker-controlled server or as file attachments. In the last few months infected Office documents that contain malicious scripts distributing the virus threat. The Gomme virus ransomware can be delivered by manipulating the victims into enabling them with a prompt. Some anti-virus engines cannot detect a Gomme virus infection that is being delivered in this way.
Other infection methods that are widely used rely on the user downloading the Gomme virus binary file from a hacked or hacker-controlled site. The ransomware can be built into software installers that are distributed on counterfeit legitimate download sites or P2P networks. BitTorrent trackers are a popular source of viruses of all kinds, including this one. The researchers discovered that the Gomme virus masquerades as the TOR Browser, the application that allows computer users to use the anonymous network.
Browser hijackers are another possible medium. They are malicious web browser plugins that pose as useful additions that provide additional functionality. However upon installation they immediately start to harvest the users data and send it to the remote hackers. The browser hijackers also modify important settings such as the default home page, search page and new tabs page.
Infection Flow of Gomme File Virus
The Gomme virus follows the typical ransomware behavior patterns. Upon infection it starts its virus encryption enggine that processes user and system files and data based on a predefined file type list. Depending on the hacker configuration different extensions may be targeted: music, videos, photos, documents, archives, databases, backups and etc.
All of the processed files are renamed using the .gommemode extension. Next a ransomware note is shown to the victims that contains the following message:
=====Gomme Ransom=====
ALL OF YOUR FILES HAVE BEEN ENCRYPTED!
Everything, Music, Documents, Programs etc, has been encrypted!
WARNING: IF YOU RESTART YOUR COMPUTER WE WON’T BE ABLE TO RESTORE YOUR FILES & YOU WILL LOSE THEM FOREVER!
How can I get my files back?
You will need to pay $25, as soon as you did, you will receive your files back.
You will find the ‘TOR Browser’ on your desktop.
lf you don’t own BTC, purchase some at paxful.com or localbitcoins.
SEND THE MONEY TO THIS ADDRESS:
*****
The computer hackers behind the virus extort the victims for the fee of 25 US dollars payable in the Bitcoin digital currency. Such transactions cannot be traced and it is relatively easy to withdraw them using different methods.
Related: Oled Ransomware Virus, 4rw5w Ransomware
Affected victims should not pay the criminals. The virus removal can be done by using a quality anti-spyware solution or using manual methods if the samples are relatively simple. After the Gomme ransomware virus has been deleted the victims can restore their data by using a professional-grade recovery software. Refer to our instructions below.
Remove Gomme File Virus and Restore Data
WARNING! Manual removal of Gomme file virus requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Gomme File Virus – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Show Hidden Files
Some ransomware threats are designed to hide their malicious files in the Windows so all files stored on the system should be visible.
1. Open My Computer/This PC
2. Windows 7
-
– Click on Organize button
– Select Folder and search options
– Select the View tab
– Go under Hidden files and folders and mark Show hidden files and folders option
3. Windows 8/ 10
-
– Open View tab
– Mark Hidden items option
4. Click Apply and then OK button
Enter Windows Task Manager and Stop Malicious Processes
1. Hit the following key combination: CTRL+SHIFT+ESC
2. Get over to Processes
3. When you find suspicious process right click on it and select Open File Location
4. Go back to Task Manager and end the malicious process. Right click on it again and choose End Process
5. Next, you should go folder where the malicious file is located and delete it
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
DOWNLOAD Gomme Removal ToolSpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Recover .gommemode Files
WARNING! All files and objects associated with Gomme file virus should be removed from the infected PC before any data recovery attempts. Otherwise the virus may encrypt restored files. Furthermore, a backup of all encrypted files stored on external media is highly recommendable.
1. Use present backups
2. Use professional data recovery software
Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.
3. Using System Restore Point
-
– Hit WIN Key
– Select “Open System Restore” and follow the steps
4. Restore your personal files using File History
-
– Hit WIN Key
– Type restore your files in the search box
– Select Restore your files with File History
– Choose a folder or type the name of the file in the search bar
– Hit the “Restore” button
Preventive Security Measures
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
