Guid Virus


Guid is a ransomware infection that targets individual web users and big businesses with the idea to extort money from them. Guid performs its malicious attack by sneaking in a computer and encrypting the files that are stored on it.


The Guid ransomware will leave a _readme.txt file with instructions

We assume that since you are reading this, you have had a close meeting with this particular type of cyber attack and Guid is the infection that is behind it. That’s why we are going to begin by explaining to you what this Ransomware is capable of and how you might possibly be able to deal with it. In general, Guid is a cryptovirus created to encrypt your files and threaten you for a ransom by keeping the information on your computer under control. In the paragraphs that follow, however, we will do our best to help you cope with this online danger and eventually recover your files. That’s why below you will find a manual removal guide with instructions on how to remove Guid and a section with free file-recovery steps.

The Guid virus

The .Guid virus is a computer infection that is interested in encrypting user information and keeping it hostage for a ransom. The victims of the .Guid virus are asked to transfer a certain amount of money to a given cryptocurrency account in order to obtain a decryption key for their files.

Unlike some other malware that steals, destroys or completely eliminates your data after you have been infected, Guid does not do that. It won’t delete or overwrite your system files and your personal information in any way. However, by applying complex file encryption, it simply will lock various documents, images, videos, audios, archived materials, and other essential digital information. In this way, no program will be able to identify and open any of the encrypted files. Everything will be still present on the computer, however, the victims won’t be able to access it.

The Guid file extension

The Guid file extension is a special sequence of symbols, digits, and letters that get applied to the files encrypted by Guid. The Guid file extension is an unknown file format that no program can recognize or open.


The Guid virus will encrypt your files

Only a specially generated decryption key can make the inaccessible files accessible again. The hackers behind the Guid, Gujd, Ufwj ransomware, however, will ask for some money to send it to you. The preferred payment method is cryptocurrencies such as Bitcoins because they are untraceable and provide anonymity for the criminals. A specially generated ransom note that gets displayed on the victim’s computer provides all the payment details.

Paying the ransom may seem like the quickest solution to the infection but, in fact, it is the worst thing the victims of Ransomware could do. Many security experts warn users not to give their money to some anonymous cyber criminals. For one, this only helps the hackers become richer and makes infections like Guid a lucrative criminal model for “business” for more cyber crooks. Besides, there is no assurance that the decryption key the crooks promise to send will actually be received and will work properly. What if the applied decryption code fails to decrypt your information, all your money, and your data will most probably be lost. In addition, if the Ransomware is still on the device the compromised computer cannot be used safely. Therefore, the first way to start fixing the issues that Guid has caused is to focus on how to remove the harmful script from the system. Please make sure you follow the instructions of the removal guide below for reference. If you are not sure how well you can handle the manual process, think about using a removal tool. See the File Recovery section of the guide for instructions that can assist you in restoring the affected files.



Name Guid
Type Ransomware
Detection Tool

Remove Guid Ransomware

To remove Guid, all suspicious programs and apps must be removed from the computer and all processes that seem harmful must be disabled.

  1. Access Programs and Features from the Control Panel, search for harmful programs, and uninstall the ones that may be linked to the Ransomware threat.
  2. Launch the Task Manager and stop whatever suspicious processes you may encounter in it.
  3. Look for unwanted modifications made by the Ransomware in the System Registry, the Hosts file, and then Startup items, and revoke any such modifications.
  4. Open the AppData, LocalAppData, ProgramData, WinDir, and Temp folders, and delete from them any suspicious data in order to remove Guid.

The instructions below will provide you with a more in-depth look at the specifics of the Guid removal process, so we advise you to explore them.

Detailed Guide


Access the Control Panel from your Start Menu, open Programs, and then go to Programs and Features, where you will see what programs are installed on the computer. If Guid has been introduced to your computer by a rogue program, it is likely that the program in question would have been installed not long before your files got encrypted. Look at the installation dates for the items in the list and see if there’s anything suspicious that has been added right before the Ransomware locked up your files.

If you think you’ve found a program in that list that may be related to the Guid virus, Uninstall it. Make sure that you do not agree to keep anything from the suspected program on your computer (including any temporary files or personalized settings).

This image has an empty alt attribute; its file name is uninstall1.jpg



Search for the Task Manager using the search bar under the Start Menu and when you start the Task Manager, open the Processes tab.

Sort the listed processes by order of how much CPU or virtual memory they are using at the current moment, and then look at the ones with the highest consumption. If among them there is an item with a name that looks suspicious to you, conduct a quick online search for the name of that process and see if there are reports about it being potentially harmful. If you come across such information, especially if it is from a reliable source, go to the process, right-click it, and access its File Location.

In the newly-opened folder, scan each file with the next free scanner (you can use it directly from this page, there’s no need to install anything):

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    This image has an empty alt attribute; its file name is task-manager1.jpg

    If you find malware while scanning the files, first go back to their related processes, End it, and then return to the file location folder and delete all of its contents. Lastly, delete the folder itself. Don’t worry if any of the files in that folder cannot be deleted right now – once you are finished with the guide, you should be able to eliminate them for good. Just remember to come back to the location folder once the guide is completed to delete that folder with all of its remaining contents.

    This image has an empty alt attribute; its file name is task-manager2.jpg

    Note: It’s possible that the scanner doesn’t find malware in the file location folder despite the process being harmful. If you have found reliable information that the process is linked to the malware and that information comes from trusted sources, eliminate the process and the data related to it even if you didn’t detect any malware in the scanned files.


    Your PC needs to stay in Safe Mode for the next steps as this would hopefully prevent Guid from re-launching its harmful processes. For more information on how to enter Safe Mode, please, visit this link.


    Click the Start Menu, type msconfig, press the Enter key, and select Startup. This list shows what apps and services are set to automatically launch when your computer starts. Typically, the items shown there should be familiar to you so if you see one that you don’t recognize, that seems suspicious, and/or that has an Unknown manufacturer, uncheck that item. Once you’ve unchecked everything you think may be unwanted, click on OK.

    Next, copy this:”notepad %windir%/system32/Drivers/etc/hosts“, paste it in the Start Menu, and hit Enter.

    Copy whatever lines are written below “Localhost” in the newly-opened file, post them in the comments section below this post, and wait for our reply. Once we determine if what’s in your Hosts file is from the Guid virus or from other malware, we will tell you whether you ned to delete it from the file.

    If there’s nothing written below “Localhost”, this means the file hasn’t been modified by any malicious program and there’s no need to do anything in that file.

    This image has an empty alt attribute; its file name is hosts2.jpg


    WARNING!: You will now have to find Guid items in the Registry of your computer and delete them. It’s essential that the only items you delete are from the malware because, if you delete anything else, you may damage your system. Because of this, our advice for you s to always consult our team through the comments section below if you come across a suspicious ite that you aren’t sure should be deleted.

    First, you need to go to the Registry Editor tool – one way to access it is to type regedit in the Start Menu, hit the Enter key, and then select Yes.

    Once the Registry Editor window appears on your screen, press Ctrl + F, type Guid, and press Enter to perform the search. Delete whatever item is found and then search for Guid again to see what other items related to it are there. In this way, make sure that everything linked to Guid that’s in the Registry gets deleted.

    This image has an empty alt attribute; its file name is 1-1.jpg

    Once there are no more Guid items to be removed, locate these three directories in the panel to the left:

    • HKEY_CURRENT_USER > Software
    • HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run
    • HKEY_CURRENT_USER > Software > Microsoft > Internet Explorer > Main

    Look in them for entries with long and seemingly random names like, for instance: “hd3892ht390ur9ugh9h2738t98ghf9823“, and if you find anything like this, delete it (preferably after first asking us about it in the comments).


    One by one, copy each of the next lines, paste them in the Start Menu, and hit the Enter key.

    • %AppData%
    • %LocalAppData%
    • %ProgramData%
    • %WinDir%
    • %Temp%

    In each of the folders that open, delete all files created since the Ransomware’s arrival. In the Temp folder, select all files and delete them.

    If the manual steps didn’t help Sometimes, it may not be feasible to manually remove a threat like Guid. Maybe the virus has entrenched itself too deeply in the system, or maybe there’s a secondary threat such as a Rootkit or a Trojan Horse that’s preventing you from deleting the Ransomware. In either case, in such instances, you’d likely need the help of a specialized software tool to help you with the virus’ removal. If you’ve found yourself to be unable to manually eliminate Guid, our recommendation is to use the help of the powerful anti-malware tool available on this page to take care of the Ransomware infection (and of any other malicious software that may be hiding in your system at the moment).

    How to Decrypt Guid files

    When it comes to file decryption, before you attempt to restore any of your files, you must have first made sure that the Ransomware is fully gone from the computer, so do not forget that you can always use the online scanner tool we have on our site to test suspicious file on your computer for malware code.

    Once you are certain that Guid is no longer present on the computer, you should visit our How to Decrypt Ransomware article, where you will find the most effective file-recovery methods we’ve been able to find (with instructions on how to perform them) that do not involve the payment of a ransom.


    About the author


    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1