This guide provides the instructions and location for downloading and using the latest Trend Micro Ransomware File Decryptor tool to attempt to decrypt files encrypted by certain ransomware families.
As an important reminder, the best protection against ransomware is preventing it from ever reaching your system. While Trend Micro is constantly working to update our tools, ransomware writers are also constantly changing their methods and tactics, which can make previous versions of tools such as this one obsolete over time.
Customers are strongly encouraged to continue practicing safe security habits:
- Make sure you have regular offline or cloud backups of your most important and critical data.
- Ensure that you are always applying the latest critical updates and patches to your system OS and other key software (e.g. browsers).
- Install the latest versions of and apply best practice configurations of security solutions such as Trend Micro to provide mutli-layered security.
Trend Micro customers are encouraged to visit the following sites for more information on ransomware and prevention best practices:
Consumer (Home) customers may visit the following site: http://esupport.trendmicro.com/en-us/home/pages/technical-support/1099580.aspx
Corporate (Business) customers may find additional information and guides here: http://esupport.trendmicro.com/solution/en-US/1112223.aspx
DETAILS
Supported Ransomware Families
The following list describes the known ransomware-encrypted files types can be handled by the latest version of the tool.
| Ransomware | File name and extension |
|---|---|
| CryptXXX V1, V2, V3* | {original file name}.crypt |
| TeslaCrypt V1** | {original file name}.ECC |
| TeslaCrypt V2** | {original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ |
| TeslaCrypt V3 | {original file name}.XXX or TTT or MP3 or MICRO |
| TeslaCrypt V4 | File name and extension are unchanged |
| SNSLocker | {Original file name}.RSNSLocked |
| AutoLocky | {Original file name}.locky |
* – CryptXXX V3 decryption may not recover the entire file (partial data decryption). Please see the section titled Important Note about Decrypting CryptXXX V3 below.
** – Please use the separate tool TeslacryptDecryptor 1.0.xxxx MUI below for TeslaCrypt V1 and V2 files. Both tools support V3 and V4.
Obtaining and Executing the Tool(s)
- Click the Download button below to obtain the latest version(s) of the Trend Micro Ransomware File Decryptor tool. Decompress (unzip) and then launch either the included RansomwareFileDecryptor or TeslacryptDecryptor exe file.Download RansomwareFileDecryptorDownload TeslacryptDecryptor
- Upon launch, users will be required to accept the End User License Agreement (EULA) to proceed.
- After accepting the EULA, the tool will proceed to the main user interface (UI). From here, users will be presented with a step-by-step guide to perform the file decryption.
