Steps for decryption:

Step 1: Download the decryption tool fromdownload.bitdefender.com/am/malware_removal/BDGoGoogleDecryptor.exe

and save it somewhere on your computerThis tool does not require an active internet connection.

Step 2: Double-click the file (previously saved as BDGoGoogleDecryptor.exe) and allow it torun by clicking Yes in the UAC prompt.

Step 3: Select “I Agree” for the End User License Agreement

Step 4: Select “Scan Entire System” if you want to search for all encrypted files or just add thepath to your encrypted files.
We strongly recommend that you also select “Backup files” before starting the decryption
process. Then press “Scan”.

The “test folder” must contain two pair of original/encrypted files which will be used todetermine the decryption type. It is essential this folder only contain two pair:-1 pair of encrypted/original files both smaller than 1 MB.
-1 pair of encrypted/original files both bigger than 2 MB.

NOTE: Some versions of GoGoogle are known for irrecoverably altering
files under 2MB.

Users may also check the “Overwrite existing clean files” option under “Advanced options”
so the tool will overwrite possible present clean files with their decrypted equivalent.

At the end of this step, your files should have been decrypted.

If you encounter any issues, please contact us at forensics@bitdefender.com.
If you checked the backup option, you will see both the encrypted and decrypted files. Youcan also find a log describing decryption process, in %temp%\BDRemovalTool folder:To get rid of your left encrypted files, just search for files matching the extension andremove them bulk. We do not encourage you to do this, unless you doubled check your files canbe opened safely and there is no trace of damage.

Ransomware in some cases encrypts files incorrectly so that decryption will not work properly,
we recommend that you back up your files before using the decryption tool if you have not alreadychecked the option "backup files " from decryption tool.

Silent execution (via cmdline)
The tool also provides the possibility of running silently, via a command line. If you need to automate
the deployment of the tool inside a large network, you might want to use this feature.

• -help - will provide information on how to run the tool silently (this information will be written inthe log file, not on console)• start - this argument allows the tool to run silently (no GUI)• -path - this argument specifies the path to scan
• -test - this argument specifies the test path where should be a pair of original/encrypted files• o0:1 - will enable Scan entire system option (ignoring -path argument)• o1:1 - will enable Backup files option• o2:1 - will enable Overwrite existing files option

Examples:BDGoGoogleDecryptor.exe start -path:”C:\” -> the tool will start with no GUI and scan C:\
BDGoGoogleDecryptor.exe start o0:1 -> the tool will start with no GUI and scan entire system
BDGoGoogleDecryptor.exe start o0:1 o1:1 o2:1 -> the tool will scan the entire system, backup theencrypted files and overwrite present clean files

Acknowledgement:This product includes software developed by the OpenSSL Project, for use in theOpenSSL Toolkit (http://www.openssl.org/)