Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh infection

 

 

Safety 101: Virus-fighting utilities

 
 
 

Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh infection

Back to "Virus-fighting utilities"
2016 Dec 20 ID: 8547
 
 
 
 

If the system is infected by a malicious program of the family Trojan-Ransom.Win32.Rannoh, Trojan-Ransom.Win32.AutoIt, Trojan-Ransom.Win32.Fury, Trojan-Ransom.Win32.CrybolaTrojan-Ransom.Win32.Cryakl or Trojan-Ransom.Win32.CryptXXX, all files on the computer will be encrypted in the following way:

  • In case of a Trojan-Ransom.Win32.Rannoh infection, file names and extensions will be changed according to the template locked-<original_name>.<four_random_letters>.
  • In case of a Trojan-Ransom.Win32.Cryakl infection, the tag {CRYPTENDBLACKDC} is added to the end of file names.
  • In case of a Trojan-Ransom.Win32.AutoIt infection, extensions will be changed according to the template <original_name>@<mail server>_.<random_set_of_characters>.
    Example: ioblomov@india.com_.RZWDTDIC.
  • In case of a Trojan-Ransom.Win32.CryptXXX infection, extensions will be changed according to the templates <original_name>.crypt, <original_name>.crypz, <original_name>.cryp1

RannohDecryptor tool is designed to decrypt files dectypted by Trojan-Ransom.Win32.Polyglot, Trojan-Ransom.Win32.Rannoh, Trojan-Ransom.Win32.AutoIt, Trojan-Ransom.Win32.Fury, Trojan-Ransom.Win32.Crybola, Trojan-Ransom.Win32.Cryakl or Trojan-Ransom.Win32.CryptXXX versions 1 and 2 and 3.

 
 
 
 
 

Disinfection

 
 
 
 
 

Command line options

 
 
 
 
 

If solution did not help

 
 
 
 
Was this information helpful?
Yes No
 

 
 

Have you found what you were looking for?

Please let us know how we can make this website more comfortable for you

Send feedback Send feedback

Thank you!

Thank you for submitting your feedback.
We will review your feedback shortly.