Part of the ransomware trojan family, CryptoMix was first noticed in March 2016 and, since then, new variants were released, one of the most widely spread being CryptoShield. CryptoMix encrypts your files using the AES256 algorithm, downloading the encryption key from a server if the computer is connected to the Internet, which is usually the case. However, in the absence of an online connection, an offline key is used. That is where Avast Decryption Tool for CryptoMix, as it can reproduce this offline encryption key and thus help you unlock your files.

Symptoms of a CryptoMix infection on your computer

Files that are encrypted by CryptoMix or its variants have one of the following extensions: .CRYPTOSHIELD, .rdmk, .rscl, .rmd, .lesli, .code or .scl.

A ransom note is placed on the desktop, either in HTML or text format, encouraging the victim to contact the attacker via email to get instructions on how to proceed with the payment. However, there is no guarantee the files will be decrypted.

Needs an encrypted and an unencrypted file to crack the password

The Avast Decryption Tool for CryptoMix is designed like a wizard, providing a step-by-step guide to decrypting all the files. First, you have to select the locations where the encrypted files are stored by choosing between local and network drives, or individual directories.

To crack the encryption key, Avast Decryption Tool for CryptoMix requires you to load an encrypted file and its counterpart. To get a matching pair of files, you can try using the default files in the "Pictures" folder. Unencrypted versions of files can be easily found in a backup file or the "Pictures" folder of another workstation.

A solution for recovering data stolen by the CryptoMix ransomware, offline variant

Avast Decryption Tool for CryptoMix tries to decrypt your files based on a key generated by analyzing the infected documents with respect to a non-infected file. As mentioned above, it only works if the offline key was used to encrypt files. Therefore, it cannot guarantee that all the locked files are decypted. Even so, it is worth a try.

Filed under

CryptoMix decryptor Decrypt CryptoMix Remove ransomware CryptoMix Decryptor Ransomware Decrypt

Avast Decryption Tool for AtomSilo and LockFile

A decryption tool for AtomSilo and LockFile that will allow victims of these ransomware variants to get back their files without paying the ransom.

Avast is one of the major security players that also has a ransomware division in the Avast Threat Labs and periodically releases dedicated decryption tools to aid ransomware victims. Created in collaboration with the RE - CERT malware analyst Jiří Vinopal, the Avast Decryption Tool for AtomSilo and LockFile aims to provide a way for users to recover access to their encrypted files without having to pay up the ransom. The reason why this tool is good for both these ransomware strains is that they are very similar.

Scan and decypt entire local or network drives

No installation is required, as the decryptor is up and running as soon as you double-click on the main executable. The application is capable of scanning and decrypting entire disk partitions using a wizard-based tool that requires no prior knowledge to use.

The first step you need to take is selecting the location to decrypt. By default, the application displays a list of all the detected drives, but dragging and dropping another location to the main window adds that particular location to the list. The Avast Decryption Tool supports both local and network drives.

Creates backups of encrypted files

Before proceeding with the scan, you are prompted to backup the encrypted files, just to be on the safe side of things. It is highly recommended to follow the suggestions of the decryptor. Should anything go wrong, the process can be restarted.

It is also advisable to run the decryptor with administrative rights, so as to allow the decryption of all the affected files.

The scanning process might take more or less time, depending on the number of files and the size of the selected drives. Users can pause and cancel it, but that is not advisable. The number of decypted files and the elapsed time is shown within the main window.

Unlock your files without paying the ransom

Avast Decryption Tool for AtomSilo and LockFile is worth a try, since users have nothing to lose. On the contrary, if it works, they get their original files back without having to pay a dime. The application can scan entire drives, decrypting files that have been infected by AtomSilo or LockFile, all in a few-steps wizard.

Filed under

AtomSilo decryptor LockFile decryptor Ransomware decryptor AtomSilo LockFile Decryptor Ransomware

Avast Decryption Tool for HiddenTear Ransomware

Unlock files that were infected by the HiddenTear ransomware and recover your data without having to pay a dime to the cybercriminals.

HiddenTear is the famous open-source ransomware whose author published the code on GitHub as a proof-of-concept and an educational initiative. However, as expected, his actions have been speculated by malware creators, and hundreds extortion attempts relied on HiddenTear. However, if your computer somehow got infected by the HiddenTear infection, which is possible if you do not use a reliable and up-to-date security solution, you can try out Avast Decryption Tool for HiddenTear Ransomware.

A few symptoms of the HiddenTear ransomware

You should be able to recognize a few of the symptoms of the infection pretty easily. When encrypted by HiddenTear, some files on your computer change their extension to one of the following: locked, bloccato, Hollycrypt, unlockit, monstro, krypted, doomed, and the list goes on with similar strings.

Additionally, the ransomware message is created in a text or a HTML file on the desktop. Depending on the ransomware variant, the message might vary.

Try to decrypt your files to restore access to your data

The Avast Decryption Tool for HiddenTear Ransomware works as a wizard that guides you step-by-step in unlocking your AES-encrypted files and restoring access to your data.

First, you have to select the location of the encrypted files by choosing between local and network drivers, or individual folders. If a password needs to be cracked as well, the decryptor prompts you to provide an encrypted file and its original, unencrypted version (which you should have from a previous backup, for instance). Password cracking can take a lot of time and takes up lots of resources, but the progress is saved periodically.

Before starting the decryption, the application asks you whether to save a copy of the encrypted file, so you can restart the process should anything go wrong.

A post-infection solution to get rid of the HiddenTear ransomware

Although the HiddenTear ransomware code was published online, there might still be cases when a PC gets infected by HiddenTear, if not equipped with a proper security solution. Avast Decryption Tool for HiddenTear Ransomware is just a post-infection solution you can try out once you observe the symptoms described above.

Filed under

HiddenTear decryptor Remove HiddenTear Remove ransomware HiddenTear Ransomware Decrypt Decryptor

Password Cracker

A tool for restoring forgotten passwords (also for Internet Explorer), which features a simple interface that is very easy to get accustomed with.

Every time we forget a password we think that we could easily write it down somewhere safe. Usually that works, but if we didn't do that and still tried to find a way to get it out of the software, somehow, we would end up looking for a piece of software that is able to take those passwords already stored in your applications.

Although it can be used in less-orthodox ways, Password Cracker brags about lending you a helping hand when you need to `see` behind those password asterisks. Its purpose is a noble one – get rid of those panic attacks when you realize you've lost or misplaced the registration code of your software. As long as your application has a filled-in password filed, Password Cracker should get the job done.

This application is very small in size and it comes packed in an archive with no install process whatsoever. Just unpack and run it. The interface will pose some question marks as it isn't the cleanest piece of work. Besides that, there are just two buttons that will ask for your attention – `Enable` and `Options`. Accessing the options of the application will result in a drop-down menu with `Recover in IE` or `Recover in all windows`, `Top Most` or `Sound` features. Users may also select the appropriate language for the interface of the program from a variety of options.

Password Cracker won't actually do miracles when it comes to reading passwords within the new versions of the most popular web browsers, that's for sure. Truth be told, it will only do that with a bunch of applications and Internet Explorer 7. The most noticeable of the supported software consists of Putty, Windows Live Writer, FTP Downloader and Total Commander. Password Cracker can run in tray mode as well, popping out every time it detects a new form. It's a silly way to do it because it will definitely drive you crazy in a matter of seconds.

Bottom line is that Password Cracker will prove to be a good tool if you want to get passwords out of particular applications. It will provide the means to crack those password masks with no fuss, as long as you don't cross the line of supported programs.

Filed under

Reveal password Restore pasword Decrypt password Decryption Password Cracker Decrypt

Avast Decryption Tool for Stampado

A decryption tool designed to unlock files that were encrypted by the Stampado ransomware and help you remove traces of the infection.

Released in the middle of 2016, the Stampado ransomware was sold on the dark web, and multiple variants appeared afterward. Having files you cannot access anymore with the ".locked" extension attached is a sign you might have been a victim of this ransomware. In that case, you can try out the Avast Decryption Tool for Stampado, which might be able to provide assistance in regaining access to your files.

Indicators of a compromised system

Written using AutoIt, Stampado encrypts files of various types, including databases, multimedia files, text documents, and so on, and demands the victim to get in contact with the attacker via email for instructions on how to make the payment. Additionally, it threatens to permanently delete one random file every six hours, and erase them all after 96 hours if no payment is made.

You can get your computer infected with Stampado via spam or suspicious online downloads. The trojan is configured to automatically start with Windows and hide behind what seems a valid Windows process. It spreads throughout the network and has the potential of infecting removable drives as well. Furthermore, it can encrypt files that have been encrypted by other ransomware.

Go through a few steps to have your files decrypted

The Avast Decryption Tool for Stampado provides a post-infection solution that is worth a try. With a wizard-like interface, it guides you through the entire process of decrypting your files, step-by-step.

First, you must select the locations where the encrypted files are found by choosing between individual folders, network or local drives. To reveal Stampado's password, the decryptor requires you to provide the path of an encrypted file and its unencrypted counterpart, which you might have stored inside a backup file, on your email, or somewhere else. Avast Decryption Tool for Stampado compares the two matching files and discloses the encryption key.

A simple utility that tries to decrypt files locked by Stampado

As prevention is much better than repairing, it is ideal to have a permanent antivirus solution to avoid situations when a ransomware trojan takes over your files. Moreover, you have to be cautious and create data backups on a regular basis. Nevertheless, if you got infected by Stampado and want to try to get rid of it, a dedicated decryptor such as Avast Decryption Tool for Stampado might be of help.

Filed under

Stampado decryptor Remove Stampado Decrypt file Stampado Decryptor Ransomware Remover

Avast Decryption Tool for Babuk

A simple solution for victims of the Babuk Russian ransomware, allowing them to try unlocking their files without paying the ransom.

The full source code for the Babuk ransomware was leaked by a member of the cyber-criminal group and, as follows, Avast took action and started developing a dedicated decryption tool to help out victims recover their files. It goes by the name of Avast Decryption Tool for Babuk, it is extremely easy to use and requires no installation.

Wizard-based decryption utility

Thanks to the wizard-based approach of the decryption software utility, using it is a matter of hitting a few “Next” buttons. First, you get to choose the locations to scan. By default, Avast Decryption Tool for Babuk adds the drives it detects but you can also drag and drop other folders to the main window to populate the list. Keep in mind that both local and network drives are accepted, and so are individual folders.

Once the target location is set, you are prompted to create a backup for the encrypted files. It is recommended you do so, just as a precautionary measure. In case something goes wrong, you can then start all over again with the decryption wizard. To make sure access to all the encrypted files is granted, you are advised to run the application as an administrator. This option will offer you the best decryption rate.

Wait for the tool to unlock your files

Next, it is time to let the Avast Decryption Tool for Babuk do its magic. As the scan continues, you can see the file that is currently scanned and decrypted. The total number of unlocked files is shown in the lower side of the window, alongside the elapsed time and buttons that allow you to cancel or pause the job.

Run a full scan to remove the ransomware completely

The Avast Decryption Tool for Babuk can help you unlock the files that have been infected by the Babuk ransomware, but it might not eliminate the ransomware from your computer. That is why you are advised to make sure a reliable and up-to-date antivirus or security solution is installed on your computer and run a full scan to get rid of the infection for good.

Filed under

Babuk decryptor Unlock Babuk Ransomware decryptor Babuk Decryptor Ransomware Decrypt

Avast Decryption Tool for Jigsaw

Decrypt files that were locked by the Jigsaw ransomware and remove the password the malware applied using this simple Avast-signed decryptor.

First noticed around March 2016, the Jigsaw ransomware is named after a famous movie character, "The Jigsaw Killer" and poses a real threat to the infected computer. Not only that it encrypts files and asks for ransom, but it also threatens to erase files if the payment is not made.

Fortunately, security companies such as Avast already started to create anti-ransomware tools as post-infection solutions. Needless to say, a permanent security solution with up-to-date definitions on your system is a must to prevent infections.

Targets an assortment of file types

The Avast Decryption Tool for Jigsaw is worth a try in case your computer has been infected by the Jigsaw ransomware. Aside from a ransom screen that usually embeds the Jigsaw Killer's picture, you can recognize the presence of this ransomware due to the changes in the name of the infected files. Jigsaw appends specific extensions to the original name, such as .payransom or .paymts, but the list contains much more items. As for the types of files it targets, Jigsaw is quite versatile: from multimedia files to Office documents, Java files, etc.

How Avast Decryption Tool for Jigsaw works

The decryption tool is created as a wizard to guide you step-by-step. First, you must select the location to decrypt, which can be either a local drive, a network drive or an individual folder.

Next, you are required to provide the path of an encrypted file and the location of the original file. The latter can be found in a system backup, your inbox, etc. This is mandatory if you don't know the key, as the application will try to rebuild the password based on specific information within the two files. Alternatively, if you know the password, the decryption tool can proceed to decrypt your files.

A post-infection solution to counterattack against Jigsaw

If you notice symptoms of the Jigsaw ransomware, then Avast Decryption Tool for Jigsaw might be of help. It attempts to unlock the files the ransomware encrypted by comparing a regular file and an infected one to return the key. Unfortunately, that is the only way the password can be retrieved. Nevertheless, Avast's Decryption Tool for Jigsaw is worth a try if it has even a small chance to help you get rid of the ransomware.

Filed under

Jigsaw decryptor Decrypt Jigsaw Ransomware remover Jigsaw Decryptor Ransomware Cleaner

Avast Decryption Tool for BigBobRoss

A dedicated software utility that can help you recover the files that have been encrypted by BigBobRoss ransomware and that you can no longer open.

Ransomware infections are on the all over the worlds rise and, since you are advised not to pay the ransom to regain access to your files, you need to find the most suitable solution to recover your data.

Avast Decryption Tool for BigBobRoss is one such utility, especially suitable for those who have been infected by the BigBobRoss ransomware. In this case, your documents are encrypted using AES128 encryption and the new extension ".obfuscated" is added at the end of the filename.

Portable decryption solution

Since this app is a portable one, you do not need to install it on your computer in order to run it. You only need to launch it, even if you keep it on a removable device.

The first step is to select the location where your encrypted data is stored. It can be one or more files and folders, or you can select an entire drive, if you are unsure about which directories have been affected. Moreover, you can even add network drives.

Select an encrypted file and its unaffected counterpart

In order for Avast Decryption Tool for BigBobRoss to be able to efficiently restore your files, you need to load a pair of files: one that was encrypted and has the ".obfuscated" extension and its original counterpart.

On the other hand, if you already know the password for decrypting these documents, you can enter it in the dedicated section and process all your files at the same time, thus saving your time and energy.

To sum things up

In a nutshell, you should always pay great attention while browsing the web, lest your PC ends up infected with various types of malware. However, if you do get infected with ransomware, it is best not to rush into paying the ransom and to look for a dedicated decryption utility first.

Filed under

BigBobRoss Decryptor BigBobRoss Decryption Ransomware Decryptor BigBobRoss Ransomware Decryption Decrypt

Avast Decryption Tool for GandCrab

A dedicated software solution that can help users regain access to the files that have been encrypted by the GandCrab ransomware.

GandCrab has been one of the most prevalent threats during 2018 and numerous users had their documents encrypted by this ransomware.

Since then, both the malware developers and the authorities have released several decryption keys that are currently packed in Avast Decryption Tool for GandCrab.

Portable decryption solution

Since this is a portable app, you do not need to install it to your computer to make sure it successfully restores access to your encrypted data.

It is enough for you to copy it on a removable USB drive and run it whenever you come across a PC that needs decrypting.

Decrypt GandCrab-encrypted documents

When your computer has been infected with this malware, the file extensions of all affected documents are appended with various strange looking strings of letters.

So when you launch Avast Decryption Tool for GandCrab you need to create a list with all the folders and/or drives where your encrypted items are.

Needs to be run as Admin

Moreover, to make sure nothing interrupts the process once the decryption begins, it is best to run Avast Decryption Tool for GandCrab with elevated privileges, as an Administrator. If you do not have admin rights, you can still run the app without issues yet not all your files might be correctly processed.

You also get the possibility to create backups for your encrypted files, so you do not lose them in case anything goes wrong during the decryption process.

While the decryption takes place, the application displays a dedicated screen where you can view all the files it is currently examining.

Conclusion

To wrap it up, Avast Decryption Tool for GandCrab comes in handy to all those who want to regain access to the documents that have been encrypted by any version of GandCrab. No expert skills are required and the whole process is as straightforward as it can be.

Filed under

GandCrab Decryptor Decrypt Ransomware GandCrab Decryption GandCrab Ransomware Decryption Decryptor

360 Ransomware Decryption Tools

A software utility that promises to become a real weapon against ransomware, providing a quick way for you to decrypt locked files.

In the light of the latest ransomware outbursts, with the WannaCry attack followed by Petya and GoldenEye, the attention of security companies has shifted towards this type of infection. As a result, not only that all major antiviruses have now updated definitions to prevent ransomware infection, but there are dedicated decryption tools meant to unlock a victim's encrypted files. One of these is the 360 Ransomware Decryption Tools.

An attempt at recovering data without paying the ransom

This particular application promises to securely decrypt the files that have been taken hostage by cyber-criminals, allowing users to recover their data without having to pay a dime.

It provides compatibility with the three malware types above, but it also comes with support for other ransomware variants.

Select a target folder and let the application do the rest

360 Ransomware Decryption Tools sports a simple look and intuitive controls, allowing the user to browse to the folder that stores the encrypted files. The location where the decrypted files are saved is customizable, but that is the only setting available. Next, one has to press the "Scan Now" button to start the decryption process.

As the application does its job, users can see the currently scanned file, the number of encrypted and decrypted files, and the elapsed time.

What users have to keep in mind is that although 360 Ransomware Decryption Tools does its best at decrypting locked files, the operation might not be successful at all times.

A decryption tool with support for widespread ransomware

360 Ransomware Decryption Tools is easy to use and provides one simple means of decrypting files locked by ransomware, or at least that is the developer's intention. While it might not work in all cases, it is worth trying before reinstalling the OS and losing all the data or paying the ransom cybercriminals demand.