Ransomware File Decryptor Tool – Download and Usage

By | Posted on August 18, 2016 | Updated on February 10, 2017

Ransomware File Decryptor is a tool developed by Trend Micro to recover files infected by specific types of ransomware. Please note that this tool may not work for all versions of ransomware. Some attackers are updating their ransom program after learning that there are free tools available to recover encrypted files. Please see the list of ransomware with corresponding versions and filenames that this tool can handle.

  • 777 – (file name).777 | Example: myfile.doc will be myfile.doc.777
  • AutoLocky  – (file name).locky | Expample: myfile.jpg will be myfile.jpg.locky
  • BadBlock (file name)
  • CERBER V1 – (10 random characters).cerber | Example: myfile.jpg will be Thd8Yhns7R.cerber
  • Chimera – (file name).crypt | Example: myfile.doc will be myfile.doc.crypt
  • CryptXXX V1, V2, V3 – (file name}.crypt, .cryp1, .crypz, or 5 random characters | Example: myfile.jpg will be myfile.jpg.crypt or myfile.jpg.G5Th4s
  • CryptXXX V4, V5 – (MD5 Hash).5 random characters
  • Nemucod – (file name).crypted | Exmaple: myfile.doc will be myfile.doc.crypted
  • Stampado – (file name).locked | Example: myfile.jpg will be myfile.jpg.locked
  • SNSLocker – (file name).RSNSLocked | Example: myfile.doc will be myfile.doc.RSNSLocked
  • TeslaCrypt V1 – (file name).ECC | Example: myfile.jpg will be myfile.jpg.ECC
  • TeslaCrypt V2 – (file name).VVV, .CCC, .ZZZ, .AAA, .ABC, .XYZ | Example: myfile.doc will be myfile.doc.VVV or myfile.doc.XYZ
  • TeslaCrypt V3 – (file name).XXX, .TTT, .MP3, or .MICRO | Example:  myfile.jpg will be myfile.jpg.XXX
  • TeslaCrypt V4 – No changes on file name and extension
  • XORIST – (file name).xorist or random extension | Example: myfile.doc will be myfile.doc.xorist
  • XORBAT – (file name}.crypted | Example: myfile.jpg will be myfile.jpg.crypted

How to Download and Use Ransomware File Decryptor Tool

Disclaimer: By downloading and using this tool, you are considered to have read the publisher’s disclaimer and agreed to terms and conditions as declared on the official web site.

1. Click on the link below to download Ransomware File Decryptor from Trend Micro web site.
RansomwareFileDecryptor Official Site (this will open on a new window)

2. Save the file to your hard drive, Desktop, or any location on your hard drive.

3. Once the download completed, decompress the file and double-click to run.

4. If it prompts for End User License Agreement (EULA), please Accept to proceed.

5. The tool will launch the main user interface. Click on Select button.

RansomwareFileDecryptor

6. Under “Select Ransomware Name“, please choose Ransomware type. Then, press OK to save your choice. If you are unsure of which ransomware hits your computer, please look at the file name of infected files and refer to the list above. You may also refer to a text file, html file, or documented ransom notes placed by the malware on various locations of the computer. This tool may also help you identify ransomware type by clicking on “I don’t know the ransomware name” link.

Cerber Decryptor

7. On main interface, click on Select & Decrypt button. See image below for reference.

Decrypt Cerber

8. Select a file or Folder that was encrypted by ransomware. This tool can either decrypt single file or all files inside the folder and sub-folders.

Scan Cerber

9. This ransomware file decryptor tool will start scanning the computer and immediately decrypt files. Recovery time may vary depending on quantity of affected files and folders.

Decrypted file will be retain the previously encrypted file name. For files that were not changed by ransomware, the new decrypted file name will be (filename)decrypted.extension.

35 thoughts on “Ransomware File Decryptor Tool – Download and Usage

  1. amit ahirwar

    my files are encrypted with exteension name .CERBER3 IS IT NEW TYPE OF CERBER RANSOMWARE BECAUSE IT IS NOT DECRYPTED WITH THIS SOFTWARE. PLEASE HELP ME REGARDING THIS

  2. Abhishek

    my files are encrypted with exteension name .CERBER3 IS IT NEW TYPE OF CERBER RANSOMWARE BECAUSE IT IS NOT DECRYPTED WITH THIS SOFTWARE. PLEASE HELP ME REGARDING THIS

  3. AJIT

    my files are encrypted with exteension name .CERBER3 IS IT NEW TYPE OF CERBER RANSOMWARE BECAUSE IT IS NOT DECRYPTED WITH THIS SOFTWARE

  4. lalit tanwar

    my files are encrypted with exteension name .CERBER3 IS IT NEW TYPE OF CERBER RANSOMWARE BECAUSE IT IS NOT DECRYPTED WITH THIS SOFTWARE

    Tried renaming the file extention to .Cerber still no luck.

    Please assist. My no is 9654379403

  5. Mr Aslan

    My files are encrypted with extension name .CERBER3. IS IT NEW TYPE OF CERBER RANSOMWARE BECAUSE IT IS NOT DECRYPTED WITH THIS SOFTWARE. PLEASE HELP ME REGARDING THIS.

  6. Aman

    Please help me with my data which is encrypt with .cerber3. Give me the link of software from which I can decrypt my data urgent.

  7. RASHID

    Please help me with my data which is encrypt with .cerber3. Give me the link of software from which I can decrypt my data urgent.

  8. RAnGO

    MY PROBLEM IS SAME LIKE OTHER PEOPLE.
    PLEASE HELP ME FROM .CERBER3
    WHICH SOFTWARE IS GOOD FOR CERBER3 VIRUS?
    PLEASE HELP US!!!

  9. Soulstrikexx

    any decryption tool for .zepto virus? my files has been affected by zepto virus.

  10. Moulouk

    Please Help ! i copied this from Malwarebyte log file after removing a virus that infected my computer (the background changed and it had a green text saying it was a CERBER virus and i must pay to get files back) the file name is 10 random characters but the extension is “9c4c” please help me ID the ransomware
    ————————————————————–
    Processes: 2
    Trojan.Injector,
    Ransom.Cerber.NSIS,
    ….etc

  11. Tim

    Help! Not sure which Ransomware i was infected with, but it added the .30248997 extension to all of my document, picture, and most video files on my computer and every mapped network drive..

    Need to know the Name and find a Decrypter!

  12. soundrapandian

    MY PROBLEM IS SAME LIKE OTHER PEOPLE.
    PLEASE HELP ME FROM .CERBER3
    WHICH SOFTWARE IS GOOD FOR CERBER3 VIRUS?
    PLEASE HELP US!!

  13. Muhammad Areeb

    My files are encrypted by extension .9986 , this is may be the latest Cerber Ransomware extension.
    what should I do?

  14. chidananda

    My files are encrypted by extension .982e Cerber Ransomware extension.
    what should I do?

  15. Gordon

    I am trying to pay, but their free trial is not working. They don’t want the money?

  16. Tim

    My files are encrypted by *****.b1ef Cerber Ransomware.

    How can you solve this Problem?

  17. Steven Ponjel

    My files are encrypted by **********.9B72
    I am sure the Cerber Ransomware is at fault and need to decrypt my files. What should I do after I removed the viruses?

  18. Diego

    KN33WR9Z-DMK3-KYUF-3B4A-8FEF253DDD34.zzzzz all my files in that format -.-‘ what’s the name of that variant ?

  19. sidhu

    My files are encrypted by the name of .bfcd file. How to solve this problem, please help me. I tried all ransomware software but there is no use.

  20. wego

    Please HELP US Ransomware victims…
    Please create a Decryptor for .CERBER3

  21. mesfin

    Dear All,

    My file is encrypted by CERBER ware with an extension .8593
    Please HELP.
    Mesfin/ETHIOPIA

  22. Rinkal

    Please suggest any tool to decrypt files with extension .8b36. I can’t decrypt it. I have tried all software and tools but to no avail. Please help me.

  23. RS Srinivas

    I am Srinivas from Hyderabad. My pictures and viedos are encrypted by cerber Ransomware. Can anyone please help me how to decrypt. My mail id is ramussrinivas@gmail.com

  24. Dave Squire

    Found Riskware.IFEOHijack and files now have a crypt extension.

    Tried to decrypt on the desktop folder of the user I am signed on as and other users not signed on. No effect.

    Any advise appreciated.

  25. M.Cihan Erdem

    @Diego, you got hit by Locky and there is currently no way for decryption.

  26. Joe Justine

    Please help,my files are encrypted with Cerber Ransomware in a format .97a7.
    All of my files are in this format, can you help please me?

  27. Bourhane

    Hi everybody,

    I’ve download the decryptor tool, i tried it and no positive results for me.
    I’ve an cerber ransomware and my files are like this for example: hhjxxjzjfjjf.af88.

    I’ve never seen an (.af88) after, globally there are on (.cerber) files or other else but not like mine.
    So, nowaday there’s not exist an decryptor for my files and rarely the others ransomware locked files.

    Since today, let’s takes our files on external hard drive or take them on cloud for more security.

    Good lucks !

  28. Biju K

    Please help, My file are encrypted with .wallet Ransomware

Leave a Reply

Your email address will not be published. Required fields are marked *