How to defend against Trojan-Ransom.Win32.Xorist ransomware
Do you want to prevent infections? Be safe and private with new Kaspersky applications.
XoristDecryptor is a free Kaspersky utility designed to restore the files encrypted with the Trojan-Ransom.Win32.Xorist and Trojan-Ransom.MSIL.Vandev ransomware families. To download the XoristDecryptor tool, click Download.
Malware of the family Trojan-Ransom.Win32.Xorist gains unauthorized access to the victim computer and modifies data on it. This makes the files or the whole system inaccessible. After blocking the files, malware demands ransom. The victim is supposed to deliver the ransom to criminals and receive a tool which decrypts the data or restores normal functioning of the computer.
Signs of infection
- A message is displayed on the screen demanding the user to send an SMS to decrypt the files.
- A text file is created on disk C with the name "Read Me: how to decrypt files".
![Example of a text file Example of a text file.](https://img.kaspersky.com/kb/en-ca/53281_119343_2911_6(en).jpg)
- The Windows folder contains a file with the name CryptLogFile.txt.
- The trojan program encrypts all files with the following extensions:
doc, xls, docx, xlsx, db, mp3, waw, jpg, jpeg, txt, rtf, pdf, rar, zip, psd, msi, tif, wma, lnk, gif, bmp, ppt, pptx, docm, xlsm, pps, ppsx, ppd, tiff, eps, png, ace, djvu, xml, cdr, max, wmv, avi, wav, mp4, pdd, html, css, php, aac, ac3, amf, amr, mid, midi, mmf, mod, mp1, mpa, mpga, mpu, nrt, oga, ogg, pbf, ra, ram, raw, saf, val, wave, wow, wpk, 3g2, 3gp, 3gp2, 3mm, amx, avs, bik, bin, dir, divx, dvx, evo, flv, qtq, tch, rts, rum, rv, scn, srt, stx, svi, swf, trp, vdo, wm, wmd, wmmp, wmx, wvx, xvid, 3d, 3d4, 3df8, pbs, adi, ais, amu, arr, bmc, bmf, cag, cam, dng, ink, jif, jiff, jpc, jpf, jpw, mag, mic, mip, msp, nav, ncd, odc, odi, opf, qif, qtiq, srf, xwd, abw, act, adt, aim, ans, asc, ase, bdp, bdr, bib, boc, crd, diz, dot, dotm, dotx, dvi, dxe, mlx, err, euc, faq, fdr, fds, gthr, idx, kwd, lp2, ltr, man, mbox, msg, nfo, now, odm, oft, pwi, rng, rtx, run, ssa, text, unx, wbk, wsh, 7z, arc, ari, arj, car, cbr, cbz, gz, gzig, jgz, pak, pcv, puz, r00, r01, r02, r03, rev, sdn, sen, sfs, sfx, sh, shar, shr, sqx, tbz2, tg, tlz, vsi, wad, war, xpi, z02, z04, zap, zipx, zoo, ipa, isu, jar, js, udf, adr, ap, aro, asa, ascx, ashx, asmx, asp, aspx, asr, atom, bml, cer, cms, crt, dap, htm, moz, svr, url, wdgt, abk, bic, big, blp, bsp, cgf, chk, col, cty, dem, elf, ff, gam, grf, h3m, h4r, iwd, ldb, lgp, lvl, map, md3, mdl, mm6, mm7, mm8, nds, pbp, ppf, pwf, pxp, sad, sav, scm, scx, sdt, spr, sud, uax, umx, unr, uop, usa, usx, ut2, ut3, utc, utx, uvx, uxx, vmf, vtf, w3g, w3x, wtd, wtf, ccd, cd, cso, disk, dmg, dvd, fcd, flp, img, iso, isz, md0, md1, md2, mdf, mds, nrg, nri, vcd, vhd, snp, bkf, ade, adpb, dic, cch, ctt, dal, ddc, ddcx, dex, dif, dii, itdb, itl, kmz, lcd, lcf, mbx, mdn, odf, odp, ods, pab, pkb, pkh, pot, potx, pptm, psa, qdf, qel, rgn, rrt, rsw, rte, sdb, sdc, sds, sql, stt, t01, t03, t05, tcx, thmx, txd, txf, upoi, vmt, wks, wmdb, xl, xlc, xlr, xlsb, xltx, ltm, xlwx, mcd, cap, cc, cod, cp, cpp, cs, csi, dcp, dcu, dev, dob, dox, dpk, dpl, dpr, dsk, dsp, eql, ex, f90, fla, for, fpp, jav, java, lbi, owl, pl, plc, pli, pm, res, rnc, rsrc, so, swd, tpu, tpx, tu, tur, vc, yab, 8ba, 8bc, 8be, 8bf, 8bi8, bi8, 8bl, 8bs, 8bx, 8by, 8li, aip, amxx, ape, api, mxp, oxt, qpx, qtr, xla, xlam, xll, xlv, xpt, cfg, cwf, dbb, slt, bp2, bp3, bpl, clr, dbx, jc, potm, ppsm, prc, prt, shw, std, ver, wpl, xlm, yps, md3.
How to disinfect the system
- Download the XoristDecryptor.exe file and run it on the affected computer.
- In the Kaspersky XoristDecryptor window, click Start scan.
Additional command line switches
-y — close the window after the utility work is over
-vandevf path_to_file — specify the path to ps.ce file to decrypt Vandev
-vandevp password — indicate the password to decrypt Vandev
What to do if the utility did not help
In case an unknown malicious file was detected, the XoristDecryptor utility prompts you to send the file to stopgpcode@kaspersky.com. Kaspersky specialists will analyze the file and update databases of XoristDecryptor. At the next launch, the utility will download new databases and disinfect the files.
Sending the malicious file to Kaspersky will not only solve your problem but will also help other users who may get affected by file-encrypting ransomware.
If XoristDecryptor was unable to decrypt the files, try using RectorDecryptor and RakhniDecryptor.
To eliminate the risk of being affected by ransomware, install new Kaspersky applications with the Protection against screen lockers feature.