How to remove Good virus and restore encrypted files

If you've suffered from an encrypting infection and you're certain that it’s the Good program – on this website you'll find help. We suggest plain and efficient tips for Good deletion and practicable ways to restore the encrypted info.

What is Good

Good can be considered a bogey of mankind, and everyone knows that if you see the inscription “files are encrypted” – it’s time to be anxious. It is a accurate reaction, by the way. An encrypting virus is the worst threat that you may face on the Internet as a common user literally cannot get rid of it. The only event when you can defeat an encrypting virus is if you’re not dealing with a real virus, but a fake, that blocks the display and tries to lure your funds. In all other events, if ransomware was created and protected in a right method – you should only expect that specialists can beat it. If swindlers failed somehow, and there are some flaws, which give you an ability to recover information – we will explain to you what to do in the following guide.


Good ransomware


Let's find out, what we have to say about Good? It is built upon a completely legitimate encryption algorithm that modifies all files on customer’s workstation, so you can't utilize them in any manner. That key is also encoded with another manner. In most cases, swindlers favour RSA and AES methods, which are famous for their complexity and fail-safety. These methods and the software based on them are freely available in the Net, so swindlers only need to develop mechanisms of defense, to block an access to a ransomware, and create the flawless control and update system. Some encrypting tools just act in standalone mode, and swindlers know about another victim as late as he approaches them and sends his money. Other viruses are function in different manner, and send reports to hundreds addresses, to puzzle the malware-fighters and maximize the work required to defeat a ransomware.

Regardless of ransomware’s kind, the RSA and AES algorithms are too complicated to hack them directly. It will take thousands of years to perform all necessary calculations on a common computer or, possibly, twenty or thirty years if you can use an industrial computer. There are two solid methods to defeat an encrypting malware: to hack into it, or hack its server, to get a master key. Some viruses also have a breaker that can stop virus' operation completely or to make it pass a particular computer. If someone finds such breaker for this virus, or publish a decryption program, we'll provide you with full information in this item.


There are a few things to inspect, until you can give in and await for a decryptor. As it is stated above, web-criminals also fail, and some specialties of the operating system may support you to restore information.


  • If you don't use the Windows via an admin entry – you're really fortunate. The thing is that your OS replicates all files prior to they’re destroyed or encrypted. Suchlike files are called SVC, and Good has the methods to erase them. If you're operating from the usual entry – the OS asks for a authorization at the exact moment Good goes to delete shadow copies. If you saw such confirmation and ignored it – your copies are fine, and you can download a topical program to restore the data.
  • A backup is the only totally effective method to get your files back, but you have to uninstall Good before. Make sure that Good is deleted fully, as if it isn't – all information will be messed up one more time, including the files that were kept on a flash disc.


If you tested all these things and there is no possibility to get back your information – you better remove the malware from the system and expect when a decryptor will be developed.

How to remove Good

Unfortunately, there’s no possibility to totally elude an installation of software. Good is too tricky and there is a possibility to miss some parts and then regret it (it might happen if you connect an external data storage with the saved files to a not-totally-cleared machine). It also lurks very good, so you just can't remove it completely with your own hands. According to this, we have created a decent uninstall directions which will suit all your needs. It consists of some manual steps and one extra anti-viral program step.

Removal instruction

If you are MAC user, follow this guide: how to decrypt files on MAC.




Step 1. Boot the system into safe mode

  • Press Start
  • Type Msconfig and press Enter

Safe mode. Step 1


  • Select Boot tab

Safe mode. Step 2



  • Select Safe boot and press Ok

More information about Safe mode: What is Safe Mode and how to boot computer in Safe Mode


Step 2. Show all hidden files and folders

  • Press Start
  • Click on Control Panel

Show hidden files. Step 1


  • Select Appearance and Personalization

Show hidden files. Step 2


  • Click on Folder Options
  • Select View tab
  • Select Show hidden files, folders and drives

Show hidden files. Step 3


  • Press Ok


Step 3. Remove virus files


Check next folders to find suspicious files:

  • %TEMP%
  • %ProgramData%


Step 4. Fix hosts file

  • Go to %SystemRoot%\System32\drivers\etc\ folder



  • Open hosts file using Notepad or other text editor
  • Delete suspicious elements
  • Basic hosts file looks like this:



Step 5. Clean registry (for experienced users)

  • Click Start
  • Type Regedit.exe and press Enter
  • Clean startup registry keys
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunServices
  • HKEY_LOCAL_MACHINE(HKEY_CURRENT_USER)\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Step 6. Scan computer with antivirus

We suggest you to test Spyhunter AntiMalware which is not just effective, but also fast and constantly developing tool which is able to clear the PC of all harmful programs. Click the link under this paragraph to test our tool and delete the ransomware.


Special Offer

Download Spyhunter - Anti-malware scanner

We advise downloading SpyHunter to see, if it can detect malware for you.

Spyhunter has a biggest malware database

It protects the system against all kinds of threats: Trojans, adware and hijackers

24/7 Free Support Team

SpyHunter scanner detects threats and malware for free, but to remove infected elements you need to purchase a full version of program for 39.99$. More information about Spyhunter, EULA and Privacy policy.


Step 7. Disable Safe Mode and restart computer

  • Press Start
  • Type Msconfig and press Enter
  • Select Boot tab
  • Remove the check near Safe boot

How to restore files

When you deleted Good, or at though know how to do it, let’s think over the file restoration. As you know now, if you use an administrator profile and you permitted Good a pass to the computer – you have no method to get back your data except for the previously saved copies. If you that didn't happen – you still have some chances, but it will require peculiar recovery software. The best ones of them are ShadowExplorer and Recuva programs. You can find these tools simply on their official websites, with thorough guides.

  • Click Start
  • Click Control Panel

Decrypt files. Step 1


  • Click System and Security

Decrypt files. Step 2


  • Select Backup and Restore

Decrypt files. Step 3


  • Select Restore files from backup
  • Select checkpoint to restore


Share your feedback to help other people
1 1 1 1 1 1 1 1 1 1 Rating 0.00 [0 Votes]

Add comment

Security code



Acronis suggestion to CrashPlans users

Around a month ago, there was an accident with CrashPlans backup software.

What is MicTrayDebugger and is it dangerous

This is a brief entry about MicTrayDebugger: what is it, how it appeared in the system, is it dangerous and how to get rid of it.

What is HoeflerText and is it dangerous?


This article is dedicated to the fraud scheme that is called HoeflerText font wasn't found. We will explain you what is this scheme and how to avoid it.

What is Wpad.dat virus and how it is used

The topic of our today's article is a script that had been unjustly called a virus. It’s Wpad.dat, and it is not a virus. We will explain what is Wpad.dat and how to prevent fraudsters to deceive yourself with its help.


Cancer virus trollware

This is an article about crazy Cancer virus and the madness that it brings to victim's computer.

This website uses cookies to improve your experience