The GPAA Ransomware is a malicious computer virus that seeks to encrypt sensitive user data on the victims computer. All processed files are renamed with the .cerber6 extension and the victims are blackmailed to pay a large ransom fee. Read our complete removal guide to learn how to restore your computers and recover the encrypted files.
Manual Removal Guide
Recover GPAA Ransomware Files
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
How Does GPAA Ransomware Infiltrate the System?
The GPAA ransomware is distributed in a limited attack wave that targets mainly English-speaking users worldwide. As it is made by an unknown hacker or criminal collective we cannot judge the primary infection method.
We suspect that coordinated email spam messages are one of the primary strategies. The hackers send out templates that resemble legitimate and well-known companies or government institutions and attach the GPAA ransomware samples directly. In other cases they are linked in the body contents.
The inclusion of the GPAA virus code in infected documents or software installers is also used by the hackers. They are distributed on hacked or hacker-controlled download sites and P2P networks like BitTorrent. Web redirects and malicious ad networks can also be utilized to spread the virus over ordinary sites as well.
Related: Scarab Virus, May Ransomware
Infection Flow of GPAA Ransomware
GPAA ransomware is a recently identified computer virus that does not appear to contain any code sourced from the famous malware families. At its current state it features only an encryption engine that seeks to process sensitive and user files according to a predefined list of target file type extensions.
The researchers have extracted the list from the captured ransomware samples. The GPAA ransomware processes the following file type extensions:
.123, .3dm, .3dmap, .3ds, .3dxml, .3g2, .3gp, .602, .7z, .accdb, .act, .aes, .ai, .arc, .asc,
.asf, .asm, .asp, .assets, .avi, .backup, .bak, .bat, .bdf, .blendl, .bmp, .brd, .bz2, .c,
.c4dl, .catalog, .catanalysis, .catdrawing, .catfct, .catmaterial, .catpart, .catprocess,
.catproduct, .catresource, .catshape, .catswl, .catsystem, .cdd, .cgm, .class, .cmd, .config,
.cpp, .crt, .cs, .csr, .csv, .dae, .db, .dbf, .dch, .deb, .der, .dif, .dip, .djvu, .doc, .docb,
.docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .edb, .eml, .fbx, .fla, .flv, .frm, .gif, .gl,
.gl2, .gpg, .gz, .h, .hpgl, .hwp, .ibd, .icem, .idf, .ig2, .igs, .ipt, .iso, .jar, .jasl,
.java, .jpeg, .jpg, .js, .jsp, .key, .lay, .lay6, .ldf, .library, .m3u, .m4u, .mal, .max,
.maxl, .mb, .mdb, .mdf, .mid, .mkv, .mml, .model, .mov, .mp3, .mp4, .mpeg, .mpg, .msg, .myd,
.myi, .nef, .obj, .odb, .odg, .odp, .ods, .odt, .onetoc2, .ost, .otg, .otp, .ots, .ott,
.p12, .paq, .pas, .pdf, .pem, .pfx, .php, .pl, .png, .pot, .potm, .potx, .ppam, .pps, .ppsm,
.ppsx, .ppt, .pptm, .pptx, .ps, .ps1, .psd, .pst, .rar, .raw, .rb, .rtf, .sch, .session,
.sh, .sldm, .sldx, .slk, .sln, .snt, .sql, .sqlite3, .sqlitedb, .stc, .std, .step, .sti,
.stp, .stw
GPAA Ransomware crafts a ransomware note in a “!READ.htm” file that reads the following message:
Congradulations! Now you are a member of GPAA (Global Poverty Aid Agency).
We need bitcoins, our crowdfunding goal is to get 1000 BTCs. 1 BTC for 1 CHILD!
>> Click Here To Buy Bitcoins << Q: What happened? A: Ooops, your inportant files are encrypted. lt weans you will not be able to access them anyeore until they are decrypted. These files could NOT be decrypted if you do not have the KEY (RSA4096). Q: How can I get the decrypt programme? A: Your task is 10.91 btc. Send the correct amount to the bitcoin address 19ZLfCEpxdskvWGLLhNUnM6dUG7yikhz2W You can send more coins. When the goal is achieved, you will get the decrypt programme. Q: Where to get the decrypt programme? A: When the goal is achieved, we will send it to [email protected] (You may register it first with the specified password: Save1000Children!!! ).
The criminals behind the GPAA virus use social engineering tricks to make the victims pay the requested sum – 10.91 Bitcoins which is the equivalent of about 28630 US Dollars. They have also posted an email that can be used to contact them.
Remove GPAA Ransomware and Restore Data
WARNING! Manual removal of GPAA Ransomware requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
GPAA Ransomware – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Show Hidden Files
Some ransomware threats are designed to hide their malicious files in the Windows so all files stored on the system should be visible.
1. Open My Computer/This PC
2. Windows 7
- – Click on Organize button
– Select Folder and search options
– Select the View tab
– Go under Hidden files and folders and mark Show hidden files and folders option
3. Windows 8/ 10
- – Open View tab
– Mark Hidden items option
4. Click Apply and then OK button
Enter Windows Task Manager and Stop Malicious Processes
1. Hit the following key combination: CTRL+SHIFT+ESC
2. Get over to Processes
3. When you find suspicious process right click on it and select Open File Location
4. Go back to Task Manager and end the malicious process. Right click on it again and choose End Process
5. Next, you should go folder where the malicious file is located and delete it
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
Recover GPAA Ransomware Files
WARNING! All files and objects associated with GPAA Ransomware should be removed from the infected PC before any data recovery attempts. Otherwise the virus may encrypt restored files. Furthermore, a backup of all encrypted files stored on external media is highly recommendable.
DOWNLOAD GPAA Ransomware Removal ToolSpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
1. Use present backups
2. Use professional data recovery software
Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.
3. Using System Restore Point
- – Hit WIN Key
– Select “Open System Restore” and follow the steps
4. Restore your personal files using File History
- – Hit WIN Key
– Type restore your files in the search box
– Select Restore your files with File History
– Choose a folder or type the name of the file in the search bar
– Hit the “Restore” button
