RannohDecryptor – Tool to Decrypt files infected by Ransom Trojan

RannohDecryptor is a tool created by Kaspersky to decrypt files that are affected by ransom programs or also known as Trojan-Ransom.Win32.Rannoh. This tool is provided free and is available in Graphical User Interface (GUI) and Command Line mode.

When ransom Trojan infects a computer, two things may happen. First, it locks the computer and prevents user’s access to files and programs. Second, the threat will encrypt entire files it may find on the infected computer. To decrypt these files, user needs to pay for a ransom, which typically process online.

Not all ransom program infection can trigger file encryption. Please make sure that the infection carried out this action first.

Signs of file encryption attack

When a malware encrypts a file in the main purpose of forcing victims to pay a sum of money in order to decrypt it, you may notice changes in file extension. Typically, file name or extension name is changed with the Trojan’s specific code.

Here are some examples:
Notepad.exe is changed to Notepad.d3s (or any random extension)
Word.exe is changed to Locked-Word.pdje (or any random extension)

About RannohDecryptor

Author: Kaspersky

License: Freeware

Operating System: Windows XP/2003/Vista/Windows 7

Download Link: click Here to begin download

How to Use RannohDecryptor

1. Download RannohDecryptor for the link provided above. This will download the program from the official web site.

2. Save the file to a convenient folder or to your Desktop.

Note: Before running this tool, we highly recommend that you save a backup copy of the entire encrypted files for safety purposes.

3. Double-click on the file RannohDecryptor.exe to launch the tool.

RannohDecryptor

4. Before it starts the process, RannohDecryptor will ask you to browse at least one affected file. Original copy of at least one encrypted file is required to execute proper decryption method.

Browse encypted file

5. Next, it will search for files similar to what you have browsed earlier.

6. If you want to delete encrypted files after the tool decrypts it, please click on Change parameters and tick necessary option. Click OKto save the settings. This may be necessary to save disc space occupied by the duplicate files. On some instances, we suggest keeping the affected file for a while until proper encryption of affected files is verified.

Delete crypted file

7. Click on Start scan to begin scan and encryption process.

4 Responses

  1. revs says:

    toll absolute unusefull, if i had a virus i don’t have he original files !

  2. MdW says:

    Computer was infected with CTB locker virus. I.T guy made a clone of documents on external drive and format original drive. Got the virus via winzip file. Please assit desperate to have my exe pdf jpeg and word files back. Note: I am not a I.T guru just enough to help myself through. Please send or reply step by step instructions. I have the viruses names if it is important. Help help!!!!!

  3. Danny says:

    This doesn’t work..
    Specify the original file is nonsense as the original file is decrypted.

    Look at this:
    4. Before it starts the process, RannohDecryptor will ask you to browse at least one affected file. Original copy of at least one encrypted file is required to execute proper decryption method.

    This is just not true.
    It pops back to the start to select these files again and just do nothing.
    Thanks internet for this.

  4. Bubby says:

    Shame on those who put out fake tools:
    Danny is right:
    “Before it starts the process, RannohDecryptor will ask you to browse at least one affected file. Original copy of at least one encrypted file is required to execute proper decryption method.

    This is just not true.
    It pops back to the start to select these files again and just do nothing.:

Leave a Reply

Your email address will not be published. Required fields are marked *