Gerkaman@aol.com Ransomware Removal Guide

Gerkaman@aol.com Ransomware is one of the many ransomware applications that belong to the same family. The family does not have a specific name, but the programs in this group are based on the CrySiS Ransomware engine, and they all demand that the infected users contact them via given emails. Needless to say, sending any kind of message to these cyber criminals is out of the question. Succumbing to their demands would not solve anything, and you would only lose your money. Thus, your best option in this situation is to remove Gerkaman@aol.com Ransomware at once, and then invest in a licensed security application.

As mentioned, it is not a lone-wolf program. The application is practically identical to Vegclass@aol.com Ransomware, Green_ray Ransomware, Alex.vlasov@aol.com Ransomware, and an extensive list of other ransomware programs. Usually, when there are several programs from the same crop, it means that the same removal method can be applied to almost all the apps in the basket. That is also similar to this group, too. The removal instructions that we have added to other ransomware descriptions in this group work for Gerkaman@aol.com Ransomware as well. However, we have not been able to find the decryption key yet, so the affected files remain locked.

This program encrypts all third-party programs, pictures, and document files. It does not touch the Windows system files because it still needs your computer to function properly in order for you to send the decryption request. All the encrypted files will have an extension added to them that reads .id-B4500913.{Gerkaman@aol.com}.xtbl. Technically, this extension does not give you any kind of hint or anything, but visually, you can easily see the extent of the infection, and just how many files were afflicted.

The ransomware does not lock your screen, but it drops a file called Decryption instructions.txt. It also changes your desktop background into an image that has the ransom message, too. The message says that you need to send one locked file to germakan@aol.com or germakan@india.com. It also says you “only have 3 day for reply at this email before unlocking becomes impossible.” In other words, the people behind this infection threaten to destroy the decryption key if you fail to meet their demands immediately.

However, it is very unlikely that they would issue the decryption key in the first place. Albeit, there are ransomware programs that do give users the decryption key once the ransom fee is transferred, you have to consider the possibility that Gerkaman@aol.com Ransomware may not be able to secure a stable server connection, and your money or the decryption key could be lost somewhere in between.

Thus, rather than paying these cyber criminals, you should delete the infection and then restore your files from a backup. You probably have copies of your files saved on an external hard drive or at some cloud storage. Just remember that you need to transfer your files back AFTER you have deleted Gerkaman@aol.com Ransomware for good.

The instructions below may seem really long and complicated, but they are not as difficult as you might think. Nevertheless, it is still strongly recommended to run a full system scan after manual removal, as you may have missed malicious files or other potential threats. Only when your computer is absolutely safe and clean, you can breathe a sigh of relief.

How to Remove Gerkaman@aol.com Ransomware

1. Press Win+R and the Run prompt will open.
2. Type %APPDATA% into the Open box and click OK.
3. Go to Microsoft\Windows\Start Menu\Programs\Startup.
4. Find and delete a random name .exe file.
5. Press Win+R once more and type %ALLUSERPROFILE%. Click OK.
6. Go to Microsoft\Windows\Start Menu\Programs\Startup.
7. Locate and delete a random name .exe file.
8. Press Win+R and enter %WINDIR% into the Open box. Press OK.
9. Go to the Syswow64 folder and remove a random name .exe file.
10. Open the WINDOWS folder again and go to System32.
11. Find and delete a random name .exe file. Press Win+R.
12. Type in regedit and click OK. Go to HKEY_CURRENT_USER\Control Panel\Desktop.
13. Right-click the Wallpaper value on the right pane.
14. Delete or change the wallpaper’s image path. Click OK to save changes.
15. Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers.
16. Right-click the value with the value data C:\Users\user\Decryption instructions.jpg and delete it.
17. Go to HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run.
18. Delete the values with the following value data:
    %WINDIR%\Syswow64\*.exe
    %WINDIR%\System32\*.exe
19. Launch a full system scan.