If your files have been scrambled by an encryption virus or ransomware virus, we understand the panic you may be experiencing.

There is hope.

How to Decrypt Ransomware Infected Files

Below are some essential instructions for dealing with the virus as well as the encrypted files.

Need Personalized Virus Removal Assistance?

Get expert help today.

If you're not already a VirusRepairNow.com customer, our Certified Virus Removal Experts are available to clean, optimize and secure your system. Call 1-855-868-4787 or click to schedule an appointment with VirusRepairNow.com today!

Start with the first section and exhaust all efforts then if you have no luck, move to the next section.

Pay close attention to when and when not to remove the virus.  A common mistake is removing the virus before understanding how to remove it.

PRO TIP: Read all of the following before taking any action.

BEST: I have a Backup that is Not Connected to the Computer.

If this is you, start here.  If you don’t have a backup, skip to the next section.

STEP 1: Get rid of the virus. Otherwise any actions you take could result in the backup and your restored data becoming compromised.

STEP 2: Once the virus is for sure removed, simply restore your backup.

STEP 3: Get better comprehensive protection to protect yourself from modern threats. Anti-virus protection is no longer enough.

SECOND BEST: I have Online Backups.

If this is you, start here.  If not, skip to the next section.

STEP 1: Lock or disable any further backups. Otherwise your computer will backup the encrypted files.

STEP 2: Likely the encrypted files were backed up.

a) You must determine if your online backups are your original unencrypted files.

b) If the online backups are encrypted, check to see if the online backup service keeps older versions that wouldn’t be encrypted. Some online backup services call this “versioning”, meaning when a file is backed up with the same filename that already exists at the online backup service, they keep the older version as well for a time.

c) If the online backups are encrypted, skip to the next section in caps.

Only continue in this section if your online backup service keeps a history of files changed or your online backup

STEP 3: Get rid of the virus. Otherwise any actions you take could result in the backup and your restored data becoming compromised.

STEP 4: Once the virus is for sure removed, simply restore your backup from your online backups.

STEP 5: Get better comprehensive protection to protect yourself from modern threats. Anti-virus protection is no longer enough.

FINALLY:  I have No Backups.

If this is you, start here.

STEP 1: First if the damage is already done, do NOT delete the virus.

It’s important to know which virus you have been infected by based on it’s behavior. Otherwise, you won’t know which method will help you potentially restore your files.

STEP 2: Identify the ransomware based on the ransom note and one of the encrypted files here:  https://id-ransomware.malwarehunterteam.com

There are hundreds of known ransomwares.  It’s important to identify the specific type of ransomware as each has a different removal and decryption of files instructions.

STEP 3: One you identify your specific ransomware, search online for specific removal instructions and any possible decryption of files instructions.  Since there are hundreds of variations, we only list below specific links to some of the more common ransomware.

STEP 4: Unless the removal instructions advise otherwise, remove the virus.

STEP 5: Attempt decryption.

RANSOMWARE REMOVAL NOTES:

  • The instructions on this page are technical in nature as decryption is fairly complicated.
  • There are 100’s of strains of encrypting viruses.
  • You should have a good working knowledge and understanding of your operating system.
  • Backup your files and computer before attempting any method on this page or the listed pages.

How To Decrypt TeslaCrypt
The following method and software potentially allows you to decrypt files encrypted by TeslaCrypt that end in .ecc, .exx, and .ezz file extensions:

http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/

How to Decrypt TeslaCrack
The following is a method and software to provide the secret key for your files if your files are encrypted (scrambled) with TeslaCrack:

https://github.com/Googulator/TeslaCrack

How to Decrypt HydraCrypt & UmbreCrypt
Emsisoft has released a free decrypter for HydraCrypt and UmbreCrypt. Please find the instructions and software here:

http://blog.emsisoft.com/2016/02/12/decrypter-for-hydracrypt-and-umbrecrypt-available/

Roger Whittaker

Roger Whittaker

Head Computer-Virus-Removal-Expert-Dude at VirusRepairNow.com
My name is Roger and I run a small family owned expert virus removal company.

We serve computer users anywhere in the US that have virus infections using a remote connection over the Internet for immediate service.

I enjoy delivering expert quality and value to all my customers. In fact, I work extra hard so every virus removal is a 5 star experience!
Roger Whittaker