Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh

 

General articles: Recovery tools

 
 
 

Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh

Back to "Recovery tools"
Latest update: July 01, 2021 ID: 8547
 
 

Do you want to prevent infections? Install Kaspersky Internet Security.

Kaspersky RannohDecryptor is a free tool for decrypting files affected
by Trojan-Ransom.Win32.Rannoh. To download RannohDecryptor, click Download.

 
 
 

RannohDecryptor tool is designed to decrypt files encrypted by the following ransomware:

  • Trojan-Ransom.Win32.Rannoh
  • Trojan-Ransom.Win32.AutoIt
  • Trojan-Ransom.Win32.Cryakl
  • Trojan-Ransom.Win32.CryptXXX version 1, 2, and 3
  • Trojan-Ransom.Win32.Crybola
  • Trojan-Ransom.Win32.Polyglot
  • Trojan-Ransom.Win32.Fury

In case of an infection, all files on the computer will be changed as follows:

Ransomware How files will be encrypted
Trojan-Ransom.Win32.Rannoh File names and extensions will be changed according to the template locked-<original_name>.<four_random_letters>.
Trojan-Ransom.Win32.AutoIt Extensions will be changed according to the template <original_name>@<mail server>_.<random_set_of_characters>. For example, ioblomov@india.com_.RZWDTDIC.
Trojan-Ransom.Win32.Cryakl The tag {CRYPTENDBLACKDC} is added to the end of file names.
Trojan-Ransom.Win32.CryptXXX Extensions will be changed according to the templates:
  • <original_name>.crypt
  • <original_name>.crypz
  • <original_name>.cryp1
Trojan-Ransom.Win32.Crybola Extensions will be changed according to the template <original_name>.ebola.

The other ransomware does not change file extensions.

If you want to decrypt files affected by Trojan-Ransom.Win32.CryptXXX, take into account the following: 

  • RannohDecryptor utility scans a limited number of file formats:
  • 1cd, 7z, ai, avi, bz2, cab, cdr, cdw, cdx, cf, chm, dbf, djvu, doc, docm, docx, dt, dwg, epf, eps, erf, ert, fla, flac, flv, gif, gz, html, iso, jpeg, jpg, ldf, md, mdb, mdf, mov, mp3, mp4, mxl, nef, ods, odt, ogg, pdf, php, png, ppt, pptm, pptx, ps1, psd, pst, qbb, rar, rcf, rtf, sdf, sldasm, slddrw, tib, tif, tiff, vhd, vhdx, vsd, wav, xls, xlsm, xlsx, xlt, zip.
  • It may take a long time to restore the key for decrypting files affected by Trojan-Ransom.Win32.CryptXXX version 2. In this case, the utility displays a warning:

Key recovery can take a long time warning

 
 
 
 
 

How to disinfect the system

 
 
 
 
 

How to use the tool through the command line

 
 
 
 
 

What to do if the tool did not help

 
 
 
 
Was this information helpful?
Yes No
Thank you
 
 
 

 
 

How can we improve this article?

Your feedback will be used for content improvement purposes only. If you need assistance, please contact technical support.

Submit Submit

Thank you for your feedback!

Your suggestions will help improve this article.

OK