How to remove BleachGap ransomware from the operating system?

Also Known As: BleachGap virus
Distribution: Low
Damage level: Severe

BleachGap ransomware removal instructions

What is BleachGap ransomware?

BleachGap is a ransomware-type program. It operates by encrypting data and demanding payment for the decryption. In other words, the files affected by BleachGap are rendered inaccessible, and victims are asked to pay a ransom for access recovery. During the encryption process, files are appended with the ".lck" extension. For example, a file originally titled something like "1.jpg" would appear as "1.jpg.lck" - following encryption. At the time of research, BleachGap seemingly had an unintentional flaw - it left the original file and created two encrypted copies (e.g., "1.jpg.lck" and "1.jpg.lck.lck"). The original was likely intended for deletion, with only the compromised copy remaining. After the encryption process is complete, ransom notes are dropped onto the desktop. This ransomware creates 100 copies of the message, named in this manner - "Pay2Decrypt1.txt", "Pay2Decrypt2.txt", "Pay2Decrypt3.txt", and so on up to "Pay2Decrypt100.txt".

The ransom-demanding message ("Pay2Decrypt1.txt", "Pay2Decrypt2.txt" ... "Pay2Decrypt100.txt") informs victims that they must pay a ransom to recover the compromised files. The ransom is stated to be 0.0002 BTC (Bitcoin cryptocurrency). At the current exchange rate, this sum is worth approximately 9 US dollars (note, exchange rates constantly fluctuate; hence, the conversion may be inaccurate in the future). Victims are warned that they have a limited timeframe to make the payment, else their data will be deleted. However, due to BleachGap ransomware leaving unencrypted file copies and the note lacking a cryptowallet address (into which the demanded sum could be transferred) - it is highly probable that this malware has been released for testing purposes. Therefore, the bugs (flaws) may be absent from later releases.

Unfortunately, in most cases of ransomware infections, without cyber criminals' involvement - decryption is impossible. It might be if the malicious program has significant flaws and/or is still in development. Whatever the case, it is expressly advised against meeting the ransom demands. Despite paying, victims often do not receive the promised decryption tools/software. Hence, they experience financial loss and their data remains useless. To prevent ransomware from further encryptions - it must be removed from the operating system. However, removal cannot restore already affected files.


BleachGap decrypt instructions (Pay2Decrypt1.txt, Pay2Decrypt2.txt ... Pay2Decrypt100.txt)

UrsORALWallet (Dharma)MrJeck, and Monero are some examples of malicious programs within the ransomware classification. They are designed to encrypt data and demand ransoms for the decryption tools/software. There are two primary differences in-between these programs/infections - the cryptographic algorithms they use (symmetric or asymmetric) and demanded payment's size. When leveraged against the average user, the sums tend to range from three to four digits in USD. Digital currencies (e.g., cryptocurrencies, pre-paid vouchers, etc.) are usually used because their transactions are difficult/impossible to trace. To avoid permanent data loss, it is strongly recommended to keep backups in remote servers and/or unplugged storage devices. Ideally, backup copies should be stored in multiple different locations.

How did ransomware infect my computer?

Ransomware and other malware are spread through dubious download channels (e.g., unofficial and free file-hosting websites, Peer-to-Peer sharing networks, and other third-party downloaders). Illegal activation ("cracking") tools and fake updaters are prime examples of malware-proliferating content, often obtained from dubious download sources. "Cracks" can infect systems rather than activate licensed products. Illegitimate updaters cause infections by abusing weaknesses of outdated programs and/or by installing malicious software instead of the updates.

Spam campaigns are also commonly used to distribute malware (ransomware included). This term defines a mass-scale operation during which scam emails are sent by the thousand. The letters have infectious files attached to and/or linked inside them. Virulent files can be in various formats, e.g., archives (ZIP, RAR, etc.), executables (.exe, .run, etc.), PDF and Microsoft Office documents, JavaScript, and so on. When the files are executed, run, or otherwise opened - the infection chain (i.e., malicious software download/installation) is initiated.

Threat Summary:
Name BleachGap virus
Threat Type Ransomware, Crypto Virus, Files locker
Encrypted Files Extension .lck
Ransom Demanding Message Pay2Decrypt1.txt, Pay2Decrypt2.txt, Pay2Decrypt3.txt, and so on up to Pay2Decrypt100.txt (100 ransom notes in total)
Ransom Amount 0.0002 BTC (Bitcoin cryptocurrency)
Detection Names Avast (Other:Malware-gen [Trj]), BitDefender (Dropped:Trojan.GenericKD.45329011), ESET-NOD32 (A Variant Of Generik.NTEPZQT), Kaspersky (HEUR:Trojan-Downloader.BAT.Generic), Microsoft (Ransom:Win32/Filecoder.PAA!MTB), Full List Of Detections (VirusTotal)
Malware Removal (Windows)

▼ Download Malwarebytes

How to protect yourself from ransomware infections?

It is recommended to only use official and verified download channels. Additionally, all programs must be activated and updated using functions/tools provided by legitimate developers. To avoid infecting the device via spam mail, it is advised against opening suspect and/or irrelevant emails - especially any attachments or links present in the letters. It is crucial to have a reputable anti-virus/anti-spyware installed and kept up-to-date. Furthermore, this software has to be used to perform regular system scans and remove detected threats and issues. If your computer is already infected with BleachGap, we recommend running a scan with Malwarebytes for Windows to automatically eliminate this ransomware.

Text presented in BleachGap ransomware's text files ("Pay2Decrypt1.txt", "Pay2Decrypt2.txt" ... "Pay2Decrypt100.txt"):

Pay us 0.0002 BTC to


Your personal key is: o8zAmoRF0EB88DtQ8nPIY5A2xEZEewgJ5Ahjw794DW


You have 5 days to pay, if the time elapse, your files will be deleted.
The time start now: D:Mon 03/01/2021 T:15:24:51.61.

Screenshot of files encrypted by BleachGap (".lck" extension):

Files encrypted by BleachGap ransomware (.lck extension)

BleachGap ransomware removal:


Quick menu:

Reporting ransomware to authorities:



Isolating the infected device:


Step 1: Disconnect from the internet.





Step 2: Unplug all storage devices.



Step 3: Log-out of cloud storage accounts.


Identify the ransomware infection:


Identify ransomware-type infection (step 1)



Identify ransomware-type infection (step 2)



Identify ransomware-type infection (step 3)


Example 1 (Qewe [Stop/Djvu] ransomware):

Identify ransomware-type infection (step 4)

Example 2 (.iso [Phobos] ransomware):

Identify ransomware-type infection (step 5)


Search for ransomware decryption tools:



Searching for ransomware decryption tools in nomoreransom.org website

Restore files with data recovery tools:


Step 1: Perform a scan.


Recuva data recovery tool wizard


Recuva data recovery tool scan time

Step 2: Recover data.


Recuva data recovery tool recovering data

Create data backups:








Creating a data backup:



Click the OneDrive icon in the taskbar


Select Help & Settings and click Settings


Select the Backup tab and click Manage backup

Go to the Backup tab and click Manage backup.

Select folders to backup and click Start backup




Select a file manually and copy it


Paste the copied file in the OneDrive folder to create a backup


File statuses in OneDrive folder


Click Help & Settings and click View Online


Click the Settings cog and click Options

Step 2: Restore corrupted files.










Click to post a comment

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.




Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
BleachGap virus QR code
We Recommend:

Get rid of Windows malware infections today:

Download Malwarebytes

Platform: Windows

Editors' Rating for Malwarebytes:
Editors ratingOutstanding!

[Back to Top]
