It is indeed that the web is being dominated by various malware attacks and one type that can cause individual or company a costly losses is through the notorious ransomware infection. The specific type of this malware that was clearly created to demand money from victims by locking their files is dubbed as crypto-virus. By applying a sophisticated encryption algorithm, attackers can keep users data inaccessible and through this operation, they can request ransom money as payment for private key and decryption software.
To help victims in recovering files that were encrypted by various ransomware, we are dedicating this page to showcase a collection of various free decryption software. Malware researchers and computer security vendors provided these tools free of charge so there is no better option in recovering encrypted files other than the programs listed on this page.
Please choose specific variants that affects your data and click on assigned link to open the official download page.
Cannot Identify the Ransomware?
Most ransomware attack leaves notes or traces for its identity. Some are appending the file with a unique extension, while others can be identified with the given name as it is stated in the ransom notes. Hence, this is not the case on some ransomware infections because there are attacks that left victims with nameless type. Other attackers intentionally do this to prevent users from downloading necessary decryption software and removal tools.
If in case, you cannot identify the specific ransomware that infects the files, you can use the service from ID Ransomware by visiting this link. On this site, they can analyze the specific ransomware that attacks the computer simply by uploading a sample ransom note or the exact encrypted file.
List of Decryption Tools (Download Section)
Below is a list of ransomware with specific decryption tools that we have collected so far. We will update the list and the version of the recovery tool if the there are available. Remember, choose the appropriate ransomware that attacks your computer and download the assigned decryption software for that threat.
AURORA
This family of ransomware are using XTEA and RSA encryption technology to lock files from an infected computer. It is also known a Zorro, Desu, and AminusLocker
File Extensions: .animus, .aurora, .infected, .isolated, .locked, .oni, .peekaboo, and .nano.
STOP (DJVU)
Originating from STOP and DJVU versions, this malware family has grown to be one of the most widely spread ransomware. It has hundreds of variants and attackers shows no sign of slowing down.
File Extensions: .STOP, .SUSPENDED, .WAITING, .PAUSA, .CONTACTUS, .DATASTOP, .STOPDATA, .KEYPASS, .WHY, .SAVEfiles, .DATAWAIT, .INFOWAIT, .puma, .pumax, .pumas, .shadow, .djvu, .djvuu, .udjvu, .djvuq, .uudjvu, .djvus, .djvur, .djvut .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .promoz, .promock, .promoks, .promorad, .promorad2, .kroput, .kroput1, .charck, .pulsar1, .klope, .kropun, .charcl, .doples, .luces, .luceq, .chech, .proden, .drume, .tronas, .trosak, .grovas, .grovat, .roland, .refols, .raldug, .etols, .guvara, .browec, .norvas, .moresa, .verasto, .hrosas, .kiratos, .todarius, .hofos, .roldat, .dutan, .sarut, .fedasot, .forasom, .berost, .fordan, .codnat, .codnat1, .bufas, .dotmap, .radman, .ferosas, .rectot, .skymap, .mogera, .rezuc, .stone, .redmat, .lanset, .davda, .poret, .pidon, .heroset, .myskle, .boston, .muslat, .gerosan, ,vesad, .horon, .neras, .truke, .dalle, .lotep, .nusar, .litar, .besub, .cezor, .lokas, .godes, .budak, .vusad, .herad, .berosuce, .gehad, .gusau, .madek, .tocue, .darus, .lapoi, .todar, .dodoc, .bopador, .novasof, .ntuseg, .ndarod, .access, .format, .nelasod, .mogranos, .cosakos, .nvetud, .lotej, .kovasoh, prandel, .zatrov, .masok, .brusaf, londec, .krusop, .mtogas, .coharos, .nasoh, .nacro, .pedro, .vesrato, .masodas, nuksus, .cetori, .stare, .carote.
Emsisoft Decryptor for STOP Djvu (Formerly STOPDecrypter): Click here to visit official page (Discontinued)
Note: STOPDecrypter is no longer available, instead, it was replaced by Emsisoft Decryptor for STOP Djvu, which was developed by Emsisoft and Demonslay335. It can only decrypt files if during the encryption process, the virus cannot communicate to command-and-control server for some reasons and instead, resorted to utilize an offline key. In this case, Emsisoft Decryptor for STOP Djvu contains specific pair of keys to unlock the encrypted files.
