I wrote this article to help you remove GrodexCrypt Ransomware. This GrodexCrypt Ransomware removal guide works for all Windows versions.

Are you familiar with the family of ransomware? If yes, it means that you have already had to deal with one of its members and you know exactly how dangerous that is. If not, prepare yourself. Judging by the fact that you are reading this removal guide, we assume that you are infected with the GrodexCrypt infection. It also belongs to the ransomware group and is an updated version of the MIRCOP pest. Regardless its origin, though, GrodexCrypt is dreaded.

As a classic ransomware, it enters your machine in silence and takes over. What we mean by that is the ransomware finds and locks all of your files. This includes your pictures, music, videos, work-related documents, etc. and etc. Every single one of them gets encrypted with a strong encryption algorithm. Then, you are no longer able to access any of them. GrodexCrypt keeps them hostage. It even changes their names.

For instance, if you had a file named “song.mp3”, after the pest locks it, it becomes “Lock.song.mp3”. Seeing your files renamed like that means that the first part of the ransomware`s job is done and your files have been turned into unusable gibberish. Nothing you do changes that. You still see the renamed files, but you cannot open them. Trying to change back their names or moving them into another folder does nothing as well. It is how GrodexCrypt takes leverage. It has something of yours and it is about to blackmail you for it.

Once the file-locking process is over, the ransomware drops its ransom note. This is basically a message from the crooks, explaining what happened. It says that your data has been encrypted and that the only way of freeing it is by obtaining a special decryption tool. Needless to say, this tool doesn’t come for free. You are supposed to pay a ransom for it. $50 to be exact. 50 dollars in Bitcoins is what the hackers what in exchange for your file`s release. Yes, the sum is not that big but we still recommend against paying. Why? Because paying guarantees you nothing.

The ransomware industry is created only for monetary gain. This means that the crooks are only interested in your money. They couldn’t care less about your files. They may not send you the tool even if you pay. Or, they may send you a non-working one. Either way, you still lose because by transferring the sum you are giving hackers access to your private information. If they get a hold of that, your situation will worsen really quickly. Not to mention that even if you get the right decryptor and free your files, the ransomware itself remains on your machine ready to strike again.

Don’t sponsor these people by paying them. They will use the money for nothing but more malware creation and expansion. What you need to do first is remove GrodexCrypt from your PC. To do that, follow our removal guide at the end of this article. Once your machine is clean, use the guide again to try and recover your locked data. This is the right thing to do. If it doesn’t work, your data is replaceable. We cannot say the same about your privacy.

How did GrodexCrypt enter? The infection relies on the usual tactics when it comes to infiltration. Number one technique is spam email messages but there are more. Like freeware bundles, for instance. Or fake program updates, corrupted pages/links/torrents, third-party ads, etc. GrodexCrypt could have even used the help of a Trojan to enter so you should definitely check your computer for other infections. The point is that any of these methods would work if you are negligent. What hackers pray for the most is your carelessness. Without it, they would never succeed.

So, be more vigilant online. Don’t give into haste and distraction as they lead to infections. What doesn’t lead to infections is caution. Be cautious and keep your PC safe. Also, get yourself a good anti-malware program to help you protect yourself and your machine. Keep the program up to date and perform regular scans of your computer to be sure it is infection-free. And another piece of advice: keep backups of your most important files.

GrodexCrypt Ransomware Removal

Method 1: Restore your encrypted files using ShadowExplorer
Usually, GrodexCrypt Ransomware deletes all shadow copies, stored in your computer. Luckily, the ransomware is not always able to delete the shadow copies. So your first try should be restoring the original files from shadow copies.

1. Download ShadowExplorer from this link: http://www.shadowexplorer.com/downloads.html.
2. Install ShadowExplorer
3. Open ShadowExplorer and select C: drive on the left panel
4. Choose at least a month ago date from the date field
5. Navigate to the folder with encrypted files
6. Right-click on the encrypted file
7. Select “Export” and choose a destination for the original file

Method 2: Restore your encrypted files by using System Restore

1. Go to Start –> All programs –> Accessories –> System tools –> System restore
2. Click “Next“
3. Choose a restore point, at least a month ago
4. Click “Next“
5. Choose Disk C: (should be selected by default)
6. Click “Next“. Wait for a few minutes and the restore should be done.

Method 3: Restore your files using File Recovery Software
If none of the above method works, you should try to recover encrypted files by using File Recovery Software. Since GrodexCrypt Ransomware first makes a copy of the original file, then encrypts it and deletes the original one, you can successfully restore the original, using a File Recovery Software. Here are a few free File Recovery Software programs:

1. Recuva
2. Puran File Recovery
3. Disk Drill
4. Glary Undelete