Security software companies and research organizations are collaborating to break the encryption codes of ransomware variants and free those who have fallen victim to cybercriminals. Unfortunately for many, these efforts take time, and that’s why decryption methods often do not exist for the newest ransomware variants. The good news for those who have been infected by older ransomware is that there may be a decryption method available to recover their data.
If backups are available, the easiest course of action is to simply remove the virus, delete the infected files and restore data that has been encrypted. But that’s not always an option. In some cases, users become infected with older ransomware that is no longer being monitored for ransom payments—so paying the ransom won’t help. If your computer is infected with ransomware, the chart below may help.
Search for the ransomware in the table below and then download the decryption tool from the URL provided. Some tools will scan for ransomware and prompt you to decrypt the files while others require you to point the decryption tool directly at the encrypted files. You may also have the option to remove the encrypted file after a decrypted version has been created. Please note: The decryption of files could take hours and a large number of encrypted files could take weeks to decrypt. In other words, be prepared to wait.
The list below was compiled in October 2016 and it contains links to decryption tools and or scripts that can potentially set your computer free.
This list contains keys that can be directly used to decrypt files encrypted by Crypt38, Locker, and NoobCrypt.
|Crypt38||Fortinet||Look in your %Appdata%\Microsoft\Windows\request.bin directory|
|NoobCrypt||Jakub Kroustek||ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHg|
For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.