Free Ransomware Decryption Tools

Hit by ransomware? Don’t pay the ransom!

Our free ransomware decryption tools can help decrypt files encrypted by the following forms of ransomware. Just click a name to see the signs of infection and get our free fix.

Want to help prevent future ransomware infections?

Download Avast Free Antivirus.

Alcatraz Locker

Alcatraz Locker is a ransomware strain that was first observed in the middle of November 2016. For encrypting user's files, this ransomware uses AES 256 encryption combined with Base64 encoding.

Filename changes:

Encrypted files have the ".Alcatraz" extension.

Ransom message:

After encrypting your files, a similar message appears (it is located in a file "ransomed.html" in the user's desktop):

+

If Alcatraz Locker has encrypted your files, click here to download our free fix:

Download Alcatraz Locker fix

Apocalypse

Apocalypse is a form of ransomware first spotted in June 2016. Here are the signs of infection:

Filename changes:

Apocalypse adds .encrypted, .FuckYourData, .locked, .Encryptedfile, or .SecureCrypted to the end of filenames. (e.g., Thesis.doc = Thesis.doc.locked)

Ransom message:

Opening a file with the extension .How_To_Decrypt.txt, .README.Txt, .Contact_Here_To_Recover_Your_Files.txt, .How_to_Recover_Data.txt, or .Where_my_files.txt (e.g., Thesis.doc.How_To_Decrypt.txt) will display a variant of this message:

Download Apocalypse Fix Download ApocalypseVM Fix

BadBlock

BadBlock is a form of ransomware first spotted in May 2016. Here are the signs of infection:

Filename changes:

BadBlock does not rename your files.

Ransom message:

After encrypting your files, BadBlock displays one of these messages (from a file named Help Decrypt.html):

+ +

If BadBlock has encrypted your files, click here to download our free fix:

Download BadBlock Fix for 32-bit Windows Download BadBlock Fix for 64-bit Windows

Bart

Bart is a form of ransomware first spotted at the end of June 2016. Here are the signs of infection:

Filename changes:

Bart adds .bart.zip to the end of filenames. (e.g., Thesis.doc = Thesis.docx.bart.zip) These are encrypted ZIP archives containing the original files.

Ransom message:

After encrypting your files, Bart changes your desktop wallpaper to an image like the one below. The text on this image can also be used to help identify Bart, and is stored on the desktop in files named recover.bmp and recover.txt.

+

If Bart has encrypted your files, click here to download our free fix:

Acknowledgement: We'd like to thank Peter Conrad, author of PkCrack, who granted us permission to use his library in our Bart decryption tool.

Download Bart Fix

Crypt888

Crypt888 (also known as Mircop) is a form of ransomware first spotted in June 2016. Here are the signs of infection:

Filename changes:

Crypt888 adds Lock. to the beginning of filenames. (e.g., Thesis.doc = Lock.Thesis.doc)

Ransom message:

After encrypting your files, Crypt888 changes your desktop wallpaper to one of the following:

+ + + + + + +

If Crypt888 has encrypted your files, click here to download our free fix:

Download Crypt888 Fix

CrySiS

CrySiS (JohnyCryptor, Virus-Encode, or Aura) is a ransomware strain that has been observed since September 2015. It uses AES256 combined with RSA1024 asymmetric encryption.

Filename changes:

Encrypted files have many various extensions, including:
.johnycryptor@hackermail.com.xtbl,
.ecovector2@aol.com.xtbl,
.systemdown@india.com.xtbl,
.Vegclass@aol.com.xtbl,
.{milarepa.lotos@aol.com}.CrySiS,
.{Greg_blood@india.com}.xtbl,
.{savepanda@india.com}.xtbl,
.{arzamass7@163.com}.xtbl

Ransom message:

After encrypting your files, one of the following messages appears (see below). The message is located in "Decryption instructions.txt", "Decryptions instructions.txt", or "*README.txt" on the user's desktop.

+ + + + + + + +

If CrySiS has encrypted your files, click here to download our free fix:

Download CrySiS fix

Globe

Globe is a ransomware strain that has been observed since August 2016. Based on variant, it uses RC4 or Blowfish encryption method. Here are signs of infection:

Filename changes:

Globe adds one of the following extensions to the file name: ".ACRYPT", ".GSupport[0-9]", ".blackblock", ".dll555", ".duhust", ".exploit", ".frozen", ".globe", ".gsupport", ".kyra", ".purged", ".raid[0-9]", ".siri-down@india.com", ".xtbl", ".zendrz", or ".zendr[0-9]". Furthermore, some of its versions encrypt the file name as well.

Ransom message:

After encrypting your files, a similar message appears (it is located in a file "How to restore files.hta" or "Read Me Please.hta"):

+ + +

If Globe has encrypted your files, click here to download our free fix:

Download Globe fix

Legion

Legion is a form of ransomware first spotted in June 2016. Here are the signs of infection:

Filename changes:

Legion adds a variant of ._23-06-2016-20-27-23_$f_tactics@aol.com$.legion or .$centurion_legion@aol.com$.cbf to the end of filenames. (e.g., Thesis.doc = Thesis.doc._23-06-2016-20-27-23_$f_tactics@aol.com$.legion)

Ransom message:

After encrypting your files, Legion changes your desktop wallpaper and displays a popup, like this:

+

If Legion has encrypted your files, click here to download our free fix:

Download Legion Fix

NoobCrypt

NoobCrypt is a ransomware strain that has been observed since the late July 2016. For encrypting user's files, this ransomware uses AES 256 encryption method.

Filename changes:

NoobCrypt doesn't change file name. Files that are encrypted are unable to be open with their associated application, however.

Ransom message:

After encrypting your files, a similar message appears (it is located in a file "ransomed.html" in the user's desktop):

+ +

If NoobCrypt has encrypted your files, click here to download our free fix:

Download NoobCrypt Fix

SZFLocker

SZFLocker is a form of ransomware first spotted in May 2016. Here are the signs of infection:

Filename changes:

SZFLocker adds .szf to the end of filenames. (e.g., Thesis.doc = Thesis.doc.szf)

Ransom message:

When you try to open an encrypted file, SZFLocker displays the following message (in Polish):

+

If SZFLocker has encrypted your files, click here to download our free fix:

Download SZFLocker Fix

TeslaCrypt

TeslaCrypt is a form of ransomware first spotted in February 2015. Here are the signs of infection:

Filename changes:

The latest version of TeslaCrypt does not rename your files.

Ransom message:

After encrypting your files, TeslaCrypt displays a variant of the following message:

+

If TeslaCrypt has encrypted your files, click here to download our free fix:

Download TeslaCrypt Fix

Chrome browser logo

Avast recommends using
the FREE Chrome™ internet browser.