Uploading the ransom note AND an encrypted file is typically the most reliable method of identification. Step 2: Check ransomware decryptor availability. Emsisoft and a number of other security companies develop free ransomware decryption tools for many different ransomware strains.

1. Exe File Decrypter Software
2. Dvd Decrypter
3. File Decryption Tool
4. Program To Decrypt Files
5. File Decrypter Software

Here is a list of best free file encryption software.These file encryption software let you encrypt any type of file easily. All these file encryption software are completely free and can be downloaded to Windows PC. If you need to compress, encrypt, decrypt or shred files, AxCrypt is a powerful solution. With a host of features that can be easily accessed in any part of the Windows operating system, this application is easily the top choice amongst free file encryption software. DOWNLOAD 3K, 2012. Dec 15, 2015  this tutorial helps you to decrypt an encrypted file in that created by windows operating system.you can protect your file from another user that uses the same PC. Giveaway Link. CryptoMix (also known as CryptFile2 or Zeta) is a ransomware strain that was first spotted in March 2016. In early 2017, a new variant of CryptoMix, called CryptoShield emerged. Both variants encrypt files by using AES256 encryption with a unique encryption key downloaded from a remote server. Jun 27, 2019  File Encryption, Whole-Disk Encryption, and VPNs In this roundup, I'm specifically looking at products that encrypt files, not at whole-disk solutions like Microsoft's Bitlocker.

If you are looking for a way to decrypt files encrypted by Ransomware then this complete list of Ransomware decrypt & removal tools will help you unlock files encrypted or locked by ransomware on your Windows computer. Ransomware threats are on the rise, and every other day we get to read about it – whether it is WannaCrypt, Petya or Locky ransomware. This class of malware seems to be the favorite now as it is very profitable – lock down users files and data and the demand money to unlock them.

While there are some basic steps one can take to prevent ransomware, including making use of some free anti-ransomware software, it can still happen that you end up being a victim of some ransomware.

Well, what does one do after a Ransomware attack on your Windows computer?

Ransomware Decryption Tools

First of all, identify the Ransomware which has infected your computer. For this, you may use a free online service called ID Ransomware

If you are able to identify the ransomware, check if a ransomware decrypt tool is available for your type of ransomware. Currently, the following decryptor tools are available.

You may go through the entire list or press Ctrl+F and search for a specific ransomware name.

Before you use these tools, use any good antivirus software or ransomware removal tool to remove the ransomware. Only then should you use these ransomware file decryptor tools. However, if you have moved your encrypted files to another isolated secure system, you directly use these tools.

1] Decrypter for HydraCrypt and UmbreCrypt Ransomware: HydraCrypt and UmbreCrypt are the two new Ransomware variants from the CrypBoss Ransomware family. Once successful in breaching your PC security, HydraCrypt and UmbreCrypt can lock your computer and deny access to your own files.

2] CryptoLocker Decryption Tool : This free Decryptlocker or CryptoLocker Decryption online tool from FireEye and Fox-IT to decrypt the Cryptolocker encrypted files. UPDATE: The site appears to have been taken down.

3] Petya ransomware decrypt tool & password generator: PETYA ransomware is one of the most recent online threats for PC users. It is a malware which overwrites the MBR (Master Boot Record) of your PC and leaves it unbootable and also disallows restarting the PC in Safe Mode.

4] Operation Global III Ransomware Decryption Tool: This ransomware attacks your system and then displays a leaving the user with no choice but to pay the ransom amount. All your encrypted file extensions are changed to .EXE and are infected with malicious codes.

5] Unlock files locked by Decrypt Protect ransomware using this tool from Emsisoft.

6] Emsisoft has released several decryptor tools for ransomware. This list currently includes ransomware decryption tools for:

AutoLocky, Aurora, Nemucod, DMALocker2, HydraCrypt, UmbreCrypt, DMALocker, CrypBoss, Gomasom, LeChiffre, KeyBTC, Radamant, CryptInfinite, PClock, CryptoDefense, Harasom, Xorist, 777, BadBlock, DApocalypse, ApocalypseVM, Stampado, Fabiansomware, Philadelphia, FenixLocker, Al-Namrood, Globe, OzozaLocker, Globe2, NMoreira or XRatTeam or XPan, OpenToYou or OpenToDecrypt, GlobeImposter, MRCR, Globe3, Marlboro, OpenToYou, CryptON, Damage, Cry9, Cry128, Amnesia, Amnesia2, NemucodAES, BigBobRoss, PewCrypt, CryptoPokemon, ZQ Ransomware, MegaLocker, JSWorm 2.0, GetCrypt, Ims00rry, ZeroFks, JSWorm 4.0, WannaCryFake, Avest,Muhstik, HildaCrypt.

You can get them all for free at their official website along with detailed usage guides.

7] Cisco also offers a free Decryption Tool for TeslaCrypt Ransomware Victims. This TeslaCrypt Decryption Tool is an open source command line utility for decrypting TeslaCrypt ransomware encrypted files so users’ files can be returned to their original state. Read more on it here.

8] Cisco Talos has released PyLocky ransomware decryptor tool. This decryptor is intended to decrypt the files for those victims affected by the ransomware PyLocky.

9] TeslaCrack is available on GitHub. It will help you decrypt files that were encrypted with the latest version of the TeslaCrypt ransomware.

10] Trend Micro AntiRansomware Tool will help you take back ownership of your computer by removing the ransomware on infected computers. To use this tool, enter Safe Mode with Networking. Download the Anti-Ransomware software and save it to your desktop. Next double-click on it to install it. Once it has been installed, restart your computer and go to the normal mode where the screen is locked by the ransomware. Now trigger the Anti-Ransomware software by pressing the following keys: Left CTRL+ALT+T+I. Run the Scan, Clean and then Reboot your computer. This tool is useful in cases of ICE Ransomware infections.

11] Trend Micro Ransomware Screen Unlocker Tool will give you access to a ransomware blocked computer.

12] Trend Micro Ransomware File Decryptor tool will attempt to decrypt files encrypted by certain Ransomware families like CryptXXX, Crysis, DemoTool, DXXD, TeslaCrypt, SNSLocker, AutoLocky, BadBlock, 777, XORIST, Teamxrat/Xpan, XORBAT, CERBER, Stampado, Nemucod, Chimera, LECHIFFRE, MirCop, Jigsaw, Globe/Purge, V2:, V3:, etc.

13] HitmanPro.Kickstart is a free Ransomware Removal Tool that will help you rescue a ransomed PC. It lets you start your computer from a USB flash drive to remove malware that has ransomed or locked your computer and does not allow you to access it.

14] Shade Ransomware Decryption Tool will help decrypt files with the following extensions: .xtbl, .ytbl, .breaking_bad, .heisenberg. Go get it from McAfee Intel.

15] McAfee Ransomware Recover is a tool and a platform which not only unlock user files, applications, databases, and other encrypted files but is also available for the security community.

16] AVG has also released ransomware decrypt tools for the following ransomware:

Apocalypse, Bart ransomware, BadBlock, Crypt888, Legion, SZFLocker, TeslaCrypt.

Go get them all here.

17] Check Point has released a Cerber Ransomware Decryption Tool. It is an online tool where you have to upload a file. UPDATE: This Cerber Ransomware Decryption Tool has been rendered ineffective. Merry X-Mas Decryptor from CheckPoint can decrypt files encrypted by the Merry X-Mas ransomware. BarRax decryptor tool is designed to decrypt files encrypted by BarRax. Available at CheckPoint.

18] The decryption keys for the NoobCrypt ransomware have been posted on Twitter. Use these unlock keys ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHg if your computer gets infected.

19] Bitdefender has released the following ransomware decryption tools: Bart Ransomware Decryptor Linux.Encoder.3 Linux.Encoder.1 BTCWare GandCrab Decryptor Annabelle Decryptor.

20] The CoinVault decryption tool decrypts files encrypted by Coinvault and Bitcryptor. ChimeraDecryptor tool is designed to decrypt files encrypted by Chimera. Get them all from NoMoreransome.org.

21] Vindows Ransomware Decryption Tool will help decrypt files locked by Vindows Locker. Download it here.

22] Download Decryptor from BleepingComputer to decrypt 8lock8 ransomware encrypted files.

Software: Accessories: ESI Labels: Product Listing: Email Page to Friend: ESI Cordless (Large) Labels $28.00: ESI 55 Business Phone $28.00: ESI 30D, 30 Digital, 30SIP Plastic Cover $3.00: ESI 30D, 30 Digital 30SIP $28.00: ESI 40, 45SIP Standard Business Phone $28.00: ESI Cordless Handset II Plastic Cover. ESI is a premier provider of business communications systems and services – from the Cloud, to On-Premises, to a Hybrid approach. ESI offers a complete solution portfolio developed to make it easier for business to communicate. ESI phone systems have the ability to grow and expand with the needs of your business. Even if you start out with a small system we can simply add more to it instead of replacing the entire system. Even if you start out with a small system we can simply add more to it instead of replacing the entire system. Esi phone programming software. ESI is a Texas-based provider of business-centric products. In addition to fax services and media management, this company offers cloud-based phone systems. Along with standard calling, they provide integration between multiple channels of communication.

23] Decryptor for Crypren ransomware encrypted files is available here.

24] Decryptor for Crypt38 ransomware encrypted files is available here.

25] Decryptor for CryptInfinite or DecryptorMax is available here.

26] For CryptoHost, you can use this password generator created by Michael Gillespie. The file is hosted on Dropbox.

27] Decryptor for my-Little-Ransomware is available on Github.

28] CERT-PL has released one for CryptoMix Decryptor

29] Popcorn Decryptor Tool is available here.

30] Avast has released decryption tools for the following ransomware:

AES_NI, Alcatraz, Locker, Apocalypse, BadBlock, Bart, BTCWare, Crypt888, CryptoMix (Offline) or CryptFile2, Zeta, CryptoShield ransomware family, CrySiS, EncrypTile, FindZip, Globe, HiddenTear, Jigsaw, LambdaLocker, Legion, NoobCrypt, Stampado, SZFLocker, TeslaCrypt, XData, BigBobRoss.

Get them all here.

31] ESET Crysis Decryptor is a free decryption tool for Crysis ransomware victims. Download it from Eset. It will also remove Dharma ransomware.

32] Kaspersky WindowsUnlocker can be useful if the Ransomware totally blocks access to your computer or even restrict access to select important functions, as it can clean up a ransomware infected Registry.

33] RannohDecryptor from Kaspersky will help decrypt files encrypted by the Rannoh, AutoIt, Fury, Crybola, Cryakl, CryptXXX, CryptXXX v.2, CryptXXX v.3, MarsJoke, Polyglot, Dharma ransomware. Download it from here.

34] Kaspersky have also released several other decryptor tools like Rector Decryptor, Rakhni Decryptor, Wildfire Decryptor, Scraper Decryptor, Shade Decryptor, Scatter Decryptor, Xoris Decryptor, etc – go get them here. They will decrypt files encrypted by Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Lortok, Cryptokluchen, Democry, Bitman, TeslaCrypt and other ransomware.

35] Kaspersky Ransomware Decryptor will automatically decrypt all files for CoinVault and Bitcryptor victims. Get it here. It also helps in the case of Cryakl ransomware.

36] Visit the Kaspersky NoRansom web page to find out if they have released a decryption tool for your ransomware. Currently, the page shows the availability of WildfireDecryptor tool, ShadeDecryptor tool, RakhniDecryptor, RannohDecryptor tool and CoinVaultDecryptor tool. Also included are manual how-to’s and other useful resources about ransomware. Intel McAfee has also made a Wildfire Decryptor.

RakhniDecryptor will help decrypt files encrypted by Dharma, Crysis, Chimera, Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Lortok, Cryptokluchen, Democry, Bitman (TeslaCrypt) version 3 and 4 ransomware.

37] Malwarebytes has released a Telecrypt Ransomware Decrypter Tool to decrypt files infected with the Telecrypt Ransomware. Download it here.

38] Michael Gillespie, a ransomware researcher has released these ransomware decryptor tools:

Aurora Ransomware Decrypter, FilesLocker Ransomware Decrypter, InsaneCrypt Decryptor for desuCrypt Ransomware, GIBON Ransomware Decryptor, Striked Ransomware Decrypter, DCry Ransomware Decrypter, BitKangaroo Decrypter, BTCWare Ransomware Decrypter, Crypt38 Ransomware Decrypter, BitStak Ransomware Decrypter, Alpha Ransomware Decryptor, Unlock92 Ransomware Decrypter, Hidden Tear Ransomware Decrypter, Hidden Tear Brute Forcer Ransomware decryptor, PowerWare Locky Ransomware Decrypter, GhostCrypt Ransomware Decrypter, MicroCopy Ransomware Decryptor, Jigsaw Ransomware Decrypter.

Plus he has also released the following useful tools:

1. StupidDecryptor decrypts files encrypted by various screenlockers that are fairly easy to decrypt
2. RansomNoteCleaner can be used to scan a ransomware victim’s computer for left over ransom notes and delete them
3. CryptoSearch cleans up your computer of encrypted files and ransom notes from a ransomware infection.

39] Master Key for TeslaCrypt ransomware has been released. Tesladecrypt from Intel will decrypt TeslaCrypt encrypted files with the following extensions: .mp3, .micro, .xxx, and .ttt.

40] BTCWareDecrypter will decrypt files encrypted by BTCWare Ransomware. Get it here.

41] 360 Ransomware Decryption Tool can decrypt files locked by over 80 ransomware including GandCrab, Petya, Gryphon, GoldenEye and WannaCry ransomware.

42] Under favorable conditions, WannaKey and WanaKiwi, two WannaCrypt decryption tools can help decrypt WannaCrypt or WannaCry Ransomware encrypted files by retrieving the encryption key used by the ransomware.

43] Crysis Decrypting Tools have been developed by Eset as well as Avast.

44] The ransomware decryptor tool from QuickHeal will decrypt files locked by the following ransomware –

Troldesh Ransomware [.xtbl], Crysis Ransomware [.CrySiS], Cryptxxx Ransomware [.crypt], Ninja Ransomware [@aol.com$.777], Apocalypse Ransomware [.encrypted], Nemucod Ransomware [.crypted], ODC Ransomware [.odcodc], LeChiffre Ransomware [.LeChiffre], Globe1 Ransomware [.hnyear], Globe2 Ransomware [.blt], Globe3 Ransomware [.decrypt2017], DeriaLock Ransomware [.deria], Opentoyou Ransomware [.-opentoyou@india.com], Globe3 Ransomware [.globe & .happydayzz], Troldesh Ransomware [.dharma], Troldesh Ransomware [.wallet], Troldesh Ransomware [.onion].

Download it here.

45] Ransomware Removal & Response Kit is not a tool, but a compilation of guides and various resources relating to dealing with ransomware, that can prove to be of help. It is a 500 MB download. Read more about it here.

46] Generally speaking, Anvi Rescue Disk can come to your rescue as it can help you uninstall & remove Ransomware.

All the best!

If you have any more free ransomware decryptor tools to add, please do so in the comments section, linking to their official home or download page.

This post talks a little more about Ransomware Attacks & other FAQ.

Updated on 25th Sept 2019.

Related Posts:

This page was created to help users decrypt Ransomware.

Below we have compiled in several steps the best possible chance you have to recover your files (except for actually paying the criminals). We firmly advise you to not pay the ransom- if you pay it, you simply fund the criminals to create even more advanced ransomware versions.

100% Еffective Against All Ransomware Attacks

With the ever increasing numbers of ransomware and their victims, it is paramount that everyone take the necessary precautions against them. The surest way to make sure Ransomware can’t harm you in the future, is by backing up your files. And the best way to do that is with cloud storage. Specifically, there’s a great free tool out there called pCloud Rewind that can restore any of your files even if they have encrypted with ransomware or even just older versions of them. Check it out here to learn more.

Removal

Before you begin restoring your files you need to make sure that the Ransomware program itself has been neutralized. Use the guide you came from to remove it, or it may encrypt your files again.

Shadow Clone Restoration

The first thing you can try is to restore your files through their shadow copies. We advise you to do this before resorting to decryptors, as it is risk-free, meaning if it fails, your files won’t be deleted by the ransomware. Some especially nasty ransomware variants threaten to delete your files if they detect any sort of tampering.

There are several different programs that use shadow volume copies to restore your files. We tested some of them and Data Recovery Pro seems to have the highest chance to help. Unfortunately that comes in the form of cost – you need to purchase the full version to receive its benefits. If you want to try::

Download Data Recover Pro from here. Install the program.

Start the program and choose the hard disk you want to scan for recoverable files. Then click “Start Scan” just like in the picture below.

If you prefer, you can specify a file name in the “Full Scan” section.

After the scan finishes, simply click “Recover” on the bottom right and see if you get your files back.

Identification

Below you will find a list of free decryption tools that can possibly help you recover your files. However, you need the right tool for the type of encryption used on your files. To learn that, use ID Ransomware – a free online service that will tell you which ransomware is currently messing with your files. You’ll be asked to upload the ransom note file (usually found on your desktop), as well as a sample encrypted file. Ransomware attacks have now taken center stage and have outranked the biggest viruses out there like Zeus Virus Detected and Weknow.ac mac.

Click on Choose file in each highlighted field and navigate to the files in question

Once it’s done analyzing, ID Ransomware will tell you exactly which ransomware version you are dealing with.

Below you will find a list of all known ransomware file decryptors. Browse through the list and look for a decryptor for your particular type of ransomware. They are listed both by virus name and by extension used on your files.

Decryption

We do not 100% guarantee any of these will work and they are provided by their creators as is, but most of the time they will get the job done!

• Naturally, before you try any of them it is recommended that you make backups for all files.

• Autolocky – file extension: .locky
• Nemucod – file extension: .crypted
• DMALocker2 – file extension: unchanged
• DMALocker – file extension: unchanged
• Gomasom – file extension: .crypt
• LeChiffre – file extension: .lechiffre
• KeyBTC – file extension: .[email protected]_com
• Radamant – file extension: .rdm or .rrk
• PClock – file extension: unchanged
• CryptoDefense – file extension: unchanged
• Harasom – file extension: .HTML
• Decrypt Protect – file extension: .HTML
• Apocalypse – .encrypted
• ApocalypseVM variant – .ecrypted .locked
• Xorist – .cerber (for the Cerber ransomware including .cerber and .cerber2 look below)
• Globe ransomware – .globe
• MRCR or Merry Christmas/Merry Xmas – .pegs1, .mrcr1, .rare1, .merry, .rmcm1

A company called Emsisoft has created decryptors for all above mentioned ransomware programs. Kudos to those guys.

Emsisoft is a company that specialized in ransomware decryption and they are doing a pretty good job at that. You can download all decryptors for the ransomware from the list above from their website here.

Their decryptors are user-friendly and there’s nothing difficult about using them. Most decryptor tools by Emsisoft have similar interface and are used in the same way. Simply run the tool designed for the specific ransomware(no installation required) and in the resulting window choose the folder/disk you’d like to have decrypted. You can add or remove folders with the buttons below. Once you’re ready, simply select the folder in question and click on Decrypt.

MRCR or Merry Christmas/Merry Xmas – file extensions: .pegs1, .mrcr1, .rare1, .merry, .rmcm1

Here is the download link for the MRCR decrypter. Look at the above toggle “Click to see how to use all decryptors from Emsisoft” for instructions how to use the decrypter.

Additional information, as stated by Emsisoft:

“To start the decryption process you will need a file pair consisting of an encrypted file and the non-encrypted version of the same file. The files need to be between 64 KB and 100 MB in size. Select both and drag and drop them onto the decrypter executable to start the process.”

Some users have mentioned that there browser was hijacked by my quick converter before having there files encrypted. Make sure that you do not have unwanted programs installed on your computer.

HydraCrypt and UmbreCrypt – file extension: .hydracrypt and .umbrecrypt

Those two ransomware viruses are the latest additions to CrypBoss ransomware. The decryptor is also developed by Emsisoft. Here’s a download link for this decryptor.

This decryptor tool works a bit differently compared to most other decryptors by Emsisoft and this is the reason we separated the instructions on how to use it from the rest. In order to use it, you will need to find an encrypted file on your computer, where you also have its un-encrypted version. Once you have the pair, you’ll need to select both of them and drag-drop them over the tool’s icon.

In case you’re unable to get such a pair (pretty likely scenario), find an encrypted PNG file (basically a picture, Windows has sample PNG picture files in the Picture category in My Documents) in your system and then download a random PNG picture from the internet. The files in question need not be the same – only the extension matters! Use the two PNG files as your pair. Doing this will enable the decryptor to bust the code for the encryption.

Note that this guide method may apply to future Emsisoft decryptors as well.

Petya password generator – no extension, whole HDD is locked

Petya is among the latest of ransomware viruses. It renders your PC unbootable and also makes you unable to enter safe-mode. In other words, this virus encrypts your whole PC. Decrypting files by Petya is therefore a bit more complicated.

First you will need to unplug your infected HDD/SSD and plug it into another machine. Make sure the other computer has an anti-virus installed and running! Petya should be already inert, but we don’t want to take any chances.

Now download and start the Petya Sector Extractor by Wosar. It will scan the infected HDD and extract the relevant data, which you’ll copy and use to fill in the fields of this site Here. Once done hit submit and you will get a code. Write it down on paper. Put the HDD back into your PC and start Windows as normal. When Petya prompts for the key use it and you should now have access to your files.

Operation Global III – file extension: .exe

An important note about this particular ransomware is that each file that it has encrypted are potential carriers of the virus. Therefore, do not, under any circumstances, transfer encrypted files to other computers/devices.

The name of the tool used here is OG3 Patcher. Click here to download. This tool is simple and easy to use. Once you’ve downloaded it, just run it and in the resulting window click on Patch. After the patching has finished a simple double-click on any encrypted files should be enough to bring them back to normal.

Keep in mind that using this tool to decrypt executable files might occasionally render them unusable, therefore, you may need to reinstall the program associated with them. This happens due to the fact that the ransomware itself is problematic and there is nothing really that can be done about it. Also, it is strongly advised that you reinstall your whole OS and format all affected drives (or at least do a deep security sweep) once you’ve secured and backed-up any important files. This will ensure that there are no traces of Operation Global III left on your machine.

TeslaCrypt – file extensions .ECC, .EXX, and .EZZ

Talos decryptor by Cisco – you can download the decryptor from here. This command line tool helps you bust the code that is used for the encryption of your files by the early TeslaCrypt ransomware virus. It will not work for TeslaCrypt version 2.0 and later (which has other file extensions), for those look at the other decryptor below.

In order to use this tool you’ll need the “key.dat” file that is created by TeslaCrypt. The tool will NOT work without this file, period!

The tool will automatically search for “key.dat” in the original location of the file, if it doesn’t find it there it will look in the directory it has been installed it. If it doesn’t find it there it will exit with an error message. Make sure “key.dat” is found in either of these two directories!

You will need to input the directory you need decrypted. You’ll need to provide either the path of the name of file to be decrypted.

For example if you dump everything in a directory called Decryption that is located in the C drive you need to write the following:

C:/Decryption

Group the files you need decrypted, enter the directory, hit enter and you are done!

The tool supports the following command line options

• /help – Shows the help messages
• /key – Specify the master key for the decryption manually (32 bytes/64 digits)
• /keyfile – Specify a specific path to the “key.dat” file, other than the default.
• /file – Input name of specific file to be decrypted.
• /dir – Selected directory will have all files decrypted.
• /scanEntirePc – This will scan your entire PC for .ecc files.
• /KeepOriginal – This will keep the encrypted copies after decryption is done.
• /deleteTeslaCrypt – This command will kill any active TeslaCrypt dropper files

TeslaCrypt – file extensions .micro, .xxx, .ttt, .mp3 or “unchanged”

Decryptor name TeslaCrypt Decryptor – This decryption tool was developed by the antivirus company ESET. It can be obtained from their official site here.

1. Download the Decryptor and save it to your Desktop
2. Open your start menu and search for Command Prompt (or CMD). Right Click on the executable file and select Run as Administrator
3. Type the following command inside – cd %userprofile%Desktop – type the command as written here, you do not need to replace userprofile with your username.
4. Type ESETTeslaCryptDecryptor.exe and hit Enter.
5. Type ESETTeslaCryptDecryptor.exe C: and hit Enter to scan your C drive. Do the same with other drive letters if you have D, E, F installed etc.
6. Files encrypted by TeslaCrypt (extensions .micro, .xxx, .ttt, .mp3 or “unchanged”) will be decrypted automatically

BitCryptor and CoinVault – file extension: 7z.encrypted

Last year Kaspersky busted the codes used by those two ransomware programs and have released a decryptor that will aid with restoring access to your files. You can download the free tool from here. Unzip the compressed file and run the decryptor. It’s simple and easy to use.

1. Once you open it, click on Start Scan. A file-selection window will open.
2. Here, you’ll need to navigate to a specific file named filelist.cvlst. This is a file left by the ransomware and locating it is required to proceed with the decryption process.
3. If you’re unable to locate that file, you’ll have to move all your encrypted files into a single folder and use the Folder with encrypted files. This setting can be accessed from the decryptor main window by clicking on Change Parameters.
4. After the setting is checked, carry on with the scanning, this time choosing the folder with all encrypted files in the file-selection window.
5. After the decryptor is done unlocking your files, it will make accessible copies of them with decryptedKLR added to their names. If you want the program to outright replace the encrypted files with the decrypted ones, you can choose that setting from Change Parameters.

Kaspersky has also developed decryptors for the following ransomware viruses:

CrySiS – .crysis and .crysis2 file extensions. Use the Rakhni decryptor for this one.

Rector – file extension: unknown

Rakhni – file extension: .locked

.kraken; .nochance; .oshit; [email protected]_com; [email protected]_com; .crypto; [email protected]; [email protected]_com; [email protected]_com; .crypt; [email protected]_com; [email protected]_com; [email protected]_com; [email protected]_com; .encrypted; .cry .AES256; .enc; [email protected]_com_id371; [email protected]_com_id372 [email protected]_com_id374; [email protected]_com_id375; [email protected]_com_id376; [email protected]_com_id392; [email protected]_com_id357; [email protected]_com_id356; [email protected]_com_id358; [email protected]_com_id359; [email protected]_com_id360; [email protected]_com_id20; [email protected]_characters; .hb15;

[email protected]$.777; .xxx; .ttt; .micro; .mp3

Scatter – file extensions: .pzdc .crypt .good

Xorist – file extension: unknown

Rannoh – possible file extensions locked-<original_name>.<four_random_letters> ; <original_name>@<mail server>_<random_set_of_characters> ; <original_name>.crypt

Dharma Ransomware – file extension .dharma. Use the Rakhni decryptor for this one.

Rector (decryptor link)

Exe File Decrypter Software

Rakhni (decryptor link)

Scatter (decryptor link)

Xorist (decryptor link)

Rannoh (decryptor link)

Dvd Decrypter

Please note that decryptors for all of these ransomware are pretty similar to the one used for CoinVault and BitCryptor above, so if you follow the guide for that one, you should do fine with the rest of these tools.

Trend Micro’sDecrypter will allow you to decrypt files affected by:

TeslaCrypt(v3, v4) – extensions .micro, .xxx, .ttt, .mp3 or “unchanged”

AutoLocky – extension: .locky

SNSLockeр – extension: .RSNSlocked

CryptXXX(v1, v2, v3) – extension: .crypt

This is a tool developed by Trend Micro that will help you with the decryption of your files. There are several ransomware encryptions that this tool can deal with. We’ve listed them above. To download the decryptor click here.

1. Once you’ve downloaded the tool, open it and accept End User License Agreement.
2. Now click on Select and from the list choose the ransomware that has encrypted your files.
   
3. After that, click on Select and Decrypt. Choose the file or folder that you’d like to have decrypted and click on OK. Know that different ransomware encryptions take different time to be unlocked, so be patient.
   
4. If your files have been locked by CryptXXX, then you may need to provide a pair of an encrypted and normal file. Therefore, it is a good idea to keep a backup of important files, in case anything like this happens.

Jigsaw – file extensions: .fun; .kkk; .gws; .btc; .PAYSM

File Decryption Tool

This particular ransomware program, once inside your PC, will not only lock your files but will also gradually delete them if you don’t pay the demanded ransom. This is a direct link for downloading the decryptor and its courtesy to the Bleeping Computers forum.

1. After you download the decryptor, double-click on it and then click on Select Directory. Find the folder/es containing the encrypted files, select it and click on OK. Tip: to make it easier for both you and the decryptor, you may want to first gather all your encrypted files into a single folder.
   
2. Now, all you need to do is click on Decrypt my files. You can check the option Delete Encrypted Files if you so desire.
   

CryptXXX – file extensions: .crypz and .crypt1 ONLY

This one is not actually a decrypter, but rather a bug with the decryptor system itself. It appears that victims of the ransomware with the .crypz and .crypt1 ransomware can follow the instructions as outlined by the ransomware itself and decrypt their files without paying for it! Hurry before the hackers realize their mistake and fix this issue!

The ODCODC ransomware

Breaking Bad themed ransomware with the following file extensions:

.xtbl, .ytbl, .breaking_bad, .heisenberg.

Download link is here.

The decryptor is provided by Kaspersky Labs and is fairly simple to use – download, run it and select the appropriate locations to scan. It will do the rest on its own.

Cerber ransomware with the following file extensions:

.cerber and .cerber2

Link is here.

WARNING! Site appears to be temporarily down at the moment. We are waiting for the owner to restore functionality while looking for an alternative soltion. Please make a backup of the encrypted files and patiently wait for a resolution.

The decryption is a two-step process as described on the site.

1. Download a ceber-encrypted file to receive your private key in the form of a PK file
2. Download the decryptor, create a directory and put the Private key file and the decryptor inside, then run it

DMA Locker 3.0

Program To Decrypt Files

1. Follow this link where you can download the decryptr tool.
2. Extract the files from the archive within your Program Data folder (My ComputerC:Program Data).
3. The password for the archive is infected.
4. Next, right-click on the svchosd.exe file and select Run as Administrator.
   • Note: After running the .exe file, your PC might experience a BSOD crash, which is expected. However, after the restart, the decryptor interface should still be displayed on your screen.
5. In the decryptor, press the Open button and navigete to the DMA 3.0 folder (DMALOCKS). Once there, select the dma_private.key file and then click on Open.
6. The decryption should then commence and hopefully any encrypted files on your system should be unlocked by the tool.

Decryptor tools for 7ev3n Ransomware

1. Follow this link and downoad the 1st decryptor from there. Run the tool and in the Original dir field type the original location where the file you want to unlock was stored.
2. If you download the decryptor from this link, you’d need to enter the unique id that the Ransomware has given you (you can find that within the Ransomware note). Type the id within the field labeled unique id within the decryptor’s interface.
3. If you use this decryptor, you’d need to provide both the original file location and the unique id.
4. After you’ve chosen one of the three decryptor tools and provided the needed information, you can either unlock decrypted files one by one with the Decode file option or decrypt a whole directory with the Decode full directory alternative.

File Decrypter Software

MBRFilter (Ransomware blocker tool for Petya, Satana and Petya+Mischa)

This is a very useful tool that protects your PC from Ransomware viruses such as Petya, Satana and Petya+Mischa. Those viruses, instead of encrypting your files, lock you out of your computer until you pay the ransom. The tool prevents them from modifying your Master Boot Record which in turn makes the virus powerless and harmless. Here is what you need to do in order to get the tool:

1. Follow this link and download the .zip file that corresponds to the architecture of your system (32-bit/64-bit).
2. Once the .zip file is downloaded, extract its contents – there should be a single folder.
3. Open the ectracted folder, right-click on the file named MBRFilter.inf and select Install.
4. After the installation has finished, you will be prompted to restart your PC. Do that and after the reboot, your system will be protected against MRB-encrypting/modifying Ransomware viruses.

Waiting for a solution

Neither ransomware viruses nor their creators are perfect or infallible and the above list of decryptors is proof of that. Unfortunately, it usually takes time for security researchers to break into the ransomware code and find the solution we so desperately need. Even if there is no decryptor tool available now this doesn’t mean one won’t be created in the future. Feel free to bookmark this page and check here for newly available ransomware solutions. We’ll add them to the list as we spot them on the Net.