It is indeed true that the web is being dominated by various malware attacks, and one type that can cause individuals or companies costly losses is the notorious ransomware infection. The specific type of malware that was clearly created to demand money from victims by locking their files is dubbed a crypto-virus. By applying a sophisticated encryption algorithm, attackers can keep user data inaccessible, and through this operation, they can request ransom money as payment for private key and decryption software.
To help victims recover files that were encrypted by various ransomware, we are dedicating this page to showcasing a collection of various free decryption software. Malware researchers and computer security vendors provided these tools free of charge, so there is no better option for recovering encrypted files than the programs listed on this page.
Please choose specific variants that affect your data and click on the assigned link to open the official download page.
Cannot identify the Ransomware?
Most ransomware attacks leave notes or traces of their identity. Some are appending the file with a unique extension, while others can be identified by the given name as stated in the ransom notes. Hence, this is not the case with some ransomware infections because there are attacks that leave victims with nameless names. Other attackers intentionally do this to prevent users from downloading the necessary decryption software and removal tools.
If in case, you cannot identify the specific ransomware that infects the files, you can use the service from ID Ransomware by visiting this link. On this site, they can analyze the specific ransomware that attacks the computer simply by uploading a sample ransom note or the exact encrypted file.
List of Decryption Tools (Download Section)
Below is a list of ransomware with specific decryption tools that we have collected so far. We will update the list and the version of the recovery tool if they are available. Remember, choose the appropriate ransomware that attacks your computer and download the assigned decryption software for that threat.
Aurora
This family of ransomware uses XTEA and RSA encryption technology to lock files on an infected computer. It is also known as Zorro, Desu, and AminusLocker.
File Extensions: .animus, .aurora, .infected, .isolated, .locked, .oni, .peekaboo, and .nano.
CryptoMix
CryptoMix, commonly known as CryptFile2 or Zeta, is a ransomware variant discovered in March 2016. CryptoShield, a new variation of CryptoMix, debuted in early 2017. Both strains use AES256 encryption with a unique encryption key obtained from a distant server to encrypt data. If the server is unavailable or the user is not connected to the internet, the ransomware will encrypt files using an offline key.
File Extensions: MOLE, .CRYPTOSHIELD, .rdmk, .lesli, .scl, .code, .rmd, or .rscl
CryptoMix Fix by Avast: Click here to visit official page
CrySis
A ransomware outbreak called CrySiS, also known as Dharma, JohnyCryptor, and Aura, has been noted since September 2015. AES-256 and RSA-1024 asymmetric encryption are used.
File Extensions: .xtbl, .CrySiS, .wallet, .arena, .adobe, .money, .4help, .hub, .aol, .14x, .dis, .Avaad, .crypt, .22btc, .TomLe, .wcg, .con30, .text, .word, .LOTUS, .pauq, .four, .clman, .ORAL, .urs, .Jessy, .ROG, .biden, .eofyd, .duk, .LAO, .pirat, .liz, .bqd2, .4o4, .ctpl, .2122, .HPJ, .bdev, .eye, .root, .rxx, .back, .zphs, .gold, .error, .rdp, .cnc, .PARTY, .DT, .nmc, and so on.
CrySis Fix by Avast: Click here to visit official page
LambdaLocker
LambdaLocker is a ransomware version that started its operation in May 2017. It is developed in the Python computer language, and some of its most common variations are decryptable.
File Extensions: .MyChemicalRomance4EVER
LambdaLocker Fix by Avast: Click here to visit official page
STOP (DJVU)
Originating from STOP and DJVU versions, this malware family has grown to be one of the most widely spread ransomware. It has hundreds of variants, and attackers show no sign of slowing down.
File Extensions: .STOP, .SUSPENDED, .WAITING, .PAUSA, .CONTACTUS, .DATASTOP, .STOPDATA, .KEYPASS, .WHY, .SAVEfiles, .DATAWAIT, .INFOWAIT, .puma, .pumax, .pumas, .shadow, .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promoks, .promorad, .promorad2, .kroput, .kroput1, .charck, .pulsar1, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden, .drume, .tronas, .trosak, .grovas, .grovat, .roland, .refols, .raldug, .etols, .guvara, .browec, .norvas, .moresa, .verasto, .hrosas, .kiratos, .todarius, .hofos, .roldat, .dutan, .sarut, .fedasot, .forasom, .berost, .fordan, .codnat, .codnat1, .bufas, .dotmap, .radman, .ferosas, .rectot, .skymap, .mogera, .rezuc, .stone, .redmat, .lanset, .davda, .poret, .pidon, .heroset, .myskle, .boston, .muslat, .gerosan, ,vesad, .horon, .neras, .truke, .dalle, .lotep, .nusar, .litar, .besub, .cezor, .lokas, .godes, .budak, .vusad, .herad, .berosuce, .gehad, .gusau, .madek, .tocue, .darus, .lapoi, .todar, .dodoc, .bopador, .novasof, .ntuseg, .ndarod, .access, .format, .nelasod, .mogranos, .cosakos, .nvetud, .lotej, .kovasoh, prandel, .zatrov, .masok, .brusaf, londec, .krusop, .mtogas, .coharos, .nasoh, .nacro, .pedro, .vesrato, .masodas, nuksus, .cetori, .stare, .carote, and a lot more.
Emsisoft Decryptor for STOP Djvu (Formerly STOPDecrypter): Click here to visit official page (Discontinued)
Note: STOPDecrypter is no longer available, instead, it was replaced by Emsisoft Decryptor for STOP Djvu, which was developed by Emsisoft and Demonslay335. It can only decrypt files if during the encryption process, the virus cannot communicate to command-and-control server for some reasons and instead, resorted to utilize an offline key. In this case, Emsisoft Decryptor for STOP Djvu contains specific pair of keys to unlock the encrypted files.
