How to Decrypt Ransomware: A full guide

How to decrypt and recover your ransomware encrypted files. In this video we cover all the facts and science behind decrypters, forsensics and data recovery services after ransomware attacks.
Try Emsisoft: www.emsisoft.com/en/?ref=tpsc
This video was made in partnership with Emsisoft.
Emsisoft keeps Windows computers free from malicious and unwanted software, and reliably prevents phishing and ransomware attacks.
Update regarding Emsisoft videos on the channel:
www.thepcsecuritychannel.com/...
Want to know if your business is suscpetible to ransomware attacks? Get tested with our cybersecurity testing services. Learn more here: www.thepcsecuritychannel.com/...
Need help with Ransomware? Check out Emsisoft Decryption tools & No More Ransom:
www.emsisoft.com/ransomware-d...
www.nomoreransom.org/
Dealing with a Ransomware attack (video):
• Dealing with a Ransomw...
What is Encryption? (video):
• What is Encryption? Yo...
🔥 Buy the best antivirus/security products with exclusive discounts and support this channel:
www.thepcsecuritychannel.com/buy
🔥 Want to join the community and participate?
www.thepcsecuritychannel.com/...
▶️ See how your product performs in a Test vs Malware:
www.thepcsecuritychannel.com/...
▶️ Want to learn cybersecurity? Get started here:
www.thepcsecuritychannel.com/...
⭐️Want us involved in the cybersecurity of your business? Interested to sponsor or work with us? Check out the business section at: www.thepcsecuritychannel.com

[@TheawesomeMCB]

Also how to prevent getting ransomware: 1. Run a modern operating system. 2. Make sure you’re running the latest version with the latest security patches. 3. Run a AV with behavior detection and keep it up to date. 4. Don’t click on links you don't trust. 5. Have some common sense. Bill gates didn't choose to give you 1 million dollars.

[@starnice5559]

dont use pirated stuff

[@mstech-gamingandmore1827]

@@starnice5559 TLauncher? Hell yeah... Oh, wait! Virus? Jigsaw? Noooooo!

[@vtbbbnk]

@@starnice5559 impossible to not use pirated stuff , not everyone is rich to buy every game and software they need

[@TheawesomeMCB]

fares ayham Yeah but at that time Windows 7 was still being supported. And avast most likely had wannacry in their signatures pretty fast.

[@marcosgarcia8018]

@fares ayham That's why you use trusted and updated AV. Anyone who says AV doesn't work is a fucking retard and their computer is probably filled with malware that they aren't even aware they have.

[@Capt-Intrepid]

Prevention and Backup are equally important. If you value your data and don't use both, you're negligent. Be sure to use a backup solution that protects your backup files from deletion, such as Macrium Reflect.

[@RobertKeenanComp-U-Right]

Great Information, and loved the Humor as well.

[@pedrochip]

so our pcs at work got ransomware. i got lucky and shutdown pc. i popped out harddrive and browsed files on another pc and noticed half my files were encrypted and the other half were ok...i could open them fine. question is there a possibility the ransomware could re infect another pc if i copy the un encrypted files to a new pc? what would be the best way to verify the non-encrypted files are safe?

[@TheHuskyGuyMotoVlogs]

There is another option often not mentioned, data recovery from the hard disk. Generally the ransomware will read a file encrypt it and delete the source, leaving this way the data on the disk.

[@xbotscythe]

I can read ransomware infected files. It says, uh, give me like 50 yrs

[@hadockk]

ScytheBlader ツ lol

[@2horneddemon842]

ツ

[@zoastro]

Loved the LotR reference! On a different note, could you do a series on the effectiveness of different AV recovery CD (when you need to desinfect a critically infected computer)? Could you start with Kaspersky's tool? Thanks

[@ArthursHD]

Thanks! Will narrow down the time of the attack to minutes and do a memory dump. Sadly decryptor is not jet available.

[@rockspoon6528]

Joke's on them, I needed those files destroyed anyway.

[@EnglishLaw]

That's the spirit.

[@hadockk]

WWG1WGA UK exactly

[@flame2385]

nooooooo my homework folder

[@Jiemaimah]

You're lucky in this situation but for most people this is really depressing.

[@vmayuri1702]

@jiya sharma omg just happend to me a few mins ago hahah

[@haydene3802]

Great video. Appreciate the info. I’m interested in practicing this, where did you download the jigsaw ransomware from and did you run it in a vm?

[@massimo4935]

Hello Leo! Can you make a video of how to make your own VM for testing whiteout damage your PC or Network?

[@maxi3654]

I got a .kasp virus on ALL my files, and scanned with Emsisoft and sadly did not work. Great explanation though, and are there any fixes for me?

[@ericj4094]

You might be able to recover the files if the program didn't overwrite them, or get a kernel extension that stores files after they are deleted

[@studyrelaxwithme4564]

Greetings, i got infected with a new version of Stop / djvu (.powd) with encryption key online, so emisoft decryotor does not go. Digging a bit, I managed to recover two text files, one with the "public key" and one with the personal id (not the ransom note id), the file is called personalID.txt. Having these two pieces of information, can I get to the private key? Or, when the virus does all its work, is there an exact moment when it creates the private key in some file (like for the public one) and sends it to its server before deleting it? Thank you.

[@md-kz1ks]

I always keep a copy of my data in an external HDD, not one but 2. Just encase....

[@ArthursHD]

If it is plugged and the ransomware gets permissions to it. It is not going to help.

[@babulsingh7521]

Who you lieing

[@samuelsamuel4099]

Having my MS Paint-Projects in a separate 20TB Raid5 Storage. Just in case.

[@Reichsleiter]

"encase" LULW

[@Reichsleiter]

@@babulsingh7521 "who you lieing" OMEGALUL

[@suryaadi7747]

Hello, my pc just encrypted by MKP ransomware and i lost all of my data Since i didn't have any back up from last year. Can you decrypting MKP files too?

[@JoeNuts42]

the first method is literally:meet the engineer

[@rash-i]

thanks so much u just saved me from my moms belt since she uses my pc to use her Pc files (shes a teacher and uses my pc to do her job) Thanks again!

[@samtheruby]

My Man Says GTX 2080! 🤣🤣🤣 Great video though!!!

[@trasivoulostrasivoulos8033]

Hello can you help me i lost all of dnSpy options and i cant recover them ??

[@guiorgy]

Or just have a number of backups of the critical data, and you won't even care if it gets encrypted. Just annoying to have to reinstall the os and restore the data, but that's all.

[@anthonyperkins5856]

How to remove zepto. files. have important photos and somehow a-lot of them have this zepto. at the end of them. How do. I get around this? please help! thanks

[@vipinvipin9767]

In my case file extension is. moqs how decrypt?? Plz hlp

[@hagar7519991]

Hi .. does this work for hoop virus i was attacked by online id and emisoft cant decrypt the files .. so my question can i get the key this way from online attacker ? And then use emisoft ? Note: i installed new windows to remove the virus as it got my whole system

[@danielseifu1172]

What should I do if the encrypted files are with Online-ID?? I have asked the support assistant of emsisoft and spyhunter and they can't decrypt it. Any suggestion before I format and reinstall my pc? The infection is already quarantined by spyhunter and I just need to get my files back.

[@naveensubramanian7747]

Emisoft says online id and impossible decryption !any help for me to save my files?

[@blazingphantom7929]

Uninstalling all my programs that are infected. Will that recover from the Ransomware Virus? Also, is Restarting my PC in Safe Mode, safe?

[@sanjayk2444]

pls help me i got attack by nile my files i important how to i fix

[@royalstranger]

Pls help me on this Virus - Stop (Djvu). It's in .enfp format

[@abdullahmunir9838]

Hey, great video Leo! You showcase and review a lot of antiviruses and stuff, but what antivirus do you personally use? Thanks.

[@alan_magic_3602]

i think he uses Emsisoft Anti-malware, according to his Windows Defender and some other videos.

[@dr.athersaifuddin4835]

im not able to decrypt .voom extension files its an offline type of key i used emisoft still its is not decrypting help me please

[@mdnahidalraj_5395]

Online key, Moqs ransomvirus attrack.what i do for decript

[@blackwalker4157]

Good evening guys. Please I need help, some virus infected my computer but I deleted it. However I can't read all my files because they extend to .ytbn PLEASE HELP ME.

[@blackwalker4157]

I used decrypSTOPDjvu like Emsisoft but no action, the App says " Decrypt files is impossible"

[@garymarrs2270]

I got hit by Phobos a week ago. Couldn't I just run a recovery tool for instances Recuva?

[@ItsOnlyLogixal]

I've been thinking and wouldn't a database of all known encryption results of a standard system file allow you to brute force ransomware?

[@___GH0ST__]

infected by avaddon ransomeware....but no decryptor is available there plz help!

[@malwaretestingfan]

Detailed and informative guide.

[@nileshparmar488]

sir what about .npsk Ransomewar it not remove my system how to remove it any tools for decrypt my all data ?

[@NiaMarco01]

@The PC Security Channel It's been more than 6 months i guess and i am still waiting for the decryptor of Lolkek/Bitransomare from Emsisoft or any other source. I hope someone is on it and creates one soon enough :(

[@yoshibros1111]

any way to decrypt makop ransomware?

[@sohidujjamansumon1396]

My file encrypted with ransomware virus.. I cant do anything.. vvoa extention. Give me advice please

[@kingalano9521]

Where did you get the sample malwares? Need to get for my lab study.

[@rainierlequigan3701]

when i clicking the .exe nothing happen, even i run it as administrator, Please help!

[@Bazzemboi]

It is perfect that people are still finding ways to go through ransomware lets teach them to stop missing with innocent people

[@yousufp]

.rugj file, i cannot open my files, all files are rugj file, how to recover it, i am re istalled windows, but same issue

[@rajkumarchithari1507]

My system files is encrypted with ransomware mado file extension . please help me out to decrypt

[@helloneighbor975]

please tell about .docx,jpj etc .mrv ransomeware

[@amirulislam-dm7cj]

Can I store some important "Ransomware (phobos) encrypted files" in another pc for further/future decryption without being infected??

[@pedrochip]

id like to know this as well.i guess you could alqays store it on an external drive to be safe

[@nathannchor489]

Guys I need help . I've been attacked my a ransomware which turns my files into .vpsh files . I really need my files back , can anyone help me ?

[@darielmosquera9136]

Need help just recently affected by ransomware .igdm, cant log in to emails and files were encrypted

[@GhostySweep]

I run all of my files in a VM to hopefully stop ransoms and viruses and stuff

[@NITINVERMADICKY]

.ogdo file extension infected my system. Please give solution

[@lemilsonmorais4166]

I don't see any link to download this software. Please can anyone help me with it??

[@shoaibhussainqadri2091]

Hi Please help me decrypt my files attacked by ransomware .zwer

[@STVN20]

May I ask if I can still Decrypt Nile Ransomeware???

[@mridulgupta2002]

can .plam file be recovered? please help

[@mysteryunknown1139]

What happens if they do something like salt the key or the info?

[@jatinkumar1894]

please help for .rrbb ransome

[@Paulgibbs99]

Hi I store all my important files on an pc connected to my home network running truenas, If I make access to these files read only but allow copying to the workstation pc as many cannot be worked on while on the server anyway , will this stop a ransomware attack being able to encrypt these files while they are on the trunas server . Unless you log in to the server as root then you cannot change the permissions so I would have thought they would be safe. I also add the mapped drives to the protected folders area on Microsoft Defender , and Run Defender only ( Tried out bitdefender and hated it , and kaspersky worries me ATM ) with the security Tweaks you described in you video about making "Defender Harder " I cant say I have noticed any performance loss in daily use on my PC ( Ryzen 5 1500x , 8GB, EVO NVME ) . A test on this would be a great video and I feel worth exploring. Keep up the great work >>

[@TheRandomRager]

The dealing with ransonware video is on up next lol

[@actionnew]

Instagram windows 11. In a virtual machine and still got ransom wear with protection

[@edwportugues3815]

Any ways to decrypt sodinikibi ransomware infected files, please help thanks.

[@jwork5680]

Does online ID ransomware still have their keys hardcoded on the exe?

[@joesaf2690]

I need help, i did decrypt the encrypted files but, nothing happens...its just says Starting... Finish!!!

[@TheKillerZmile]

I clean installed windows 10 twice now this week. Im getting malware that disables windows update and windows defender and uninstalled my antivirus kaspersky and bitdefender. i found out that Hitman Pro removal tool gave me the virus. idk why virus removal giving me virus lmao

[@tallpaul9475]

What are you doing to get malware on your system? Turn on Windows Firewall, and get a good router firewall.

[@TheKillerZmile]

Tall Paul PDK i think its the samsung magician app for my ssd. When i install it, smartscreen will prompt like do u need to run this? As i thought why wouldnt i? I downloaded it from official website then i installed that shit and after i restart my computer i got malwares i noticed when my antivirus is not opening. I dont even have pirated games

[@tallpaul9475]

@@TheKillerZmile that's funny, since I have that same software on three systems for years without a problem yet

[@EnglishLaw]

@@TheKillerZmile worth testing malware bytes. that has good reviews. although I use webroot and heimdal together and I can get up to all sorts.

[@SuperDilberjani]

Good way don't open unknowns email. If accidently you open then don't click any unknown link..

[@rizkiyudi]

Can some files encrypted twice with different attacker?

[@Jetsalmon8]

I got a Trojan virus a few days ago and it got into my accounts but 2 minutes after it got in I deleted it but I think my files are encrypted

[@thoughtalchemist101]

It says that the “ Id appears to be an online ID , Decryption is impossible “ Can you suggest something please ? There are some important in files in there .

[@mehedi1178]

If you want you can use shadow explorar to recover some of thise files.

[@Rom_Jujhar]

emisoft is not working for the extention i have

[@ninjaplays3747]

Sir my all data encryted into davda file Please help me

[@kenken8865]

Here i have STOP (DJVU) is it worse than Jigsaw?

[@NaitorStudios]

If you have a exact unencrypted copy of a file, could you somehow find the key with it?

[@eness379]

Yesn't

[@malwaretestingfan]

If the malware author has not randomized the IV or uses ECB, or uses XOR then it may work, i think.

[@Demonslay335]

Depends on the ransomware. If they implement crypto properly, then no. This is already something we factor when trying to develop decryptors.

[@Demonslay335]

@@malwaretestingfan Just because it's ECB block mode or a static IV doesn't mean you can recover the key thru a known-plaintext attack.

[@simon_roy]

I have the key! Now how do I decrypt files ?

[@bandersj]

Hello Leo, please review and test the new gdata internet security.

[@farhanffaa]

i have .orkf file extenion i want to decrypt files fplease help me

[@veskobelchev]

Hello, on 19.11.2020 I was infected with .makop virus and all my childhood photos were encrypted. I sent a decryption file to the hackers and they returned it fixed for me. For other information, they asked me for an unaffordable amount of money, which I did not pay. I copied all the infected files to an external hard drive. I bought a new hard drive and installed a new Windows. Is it possible to decrypt encrypted photos from childhood?

[@veskobelchev]

@Message Raimotechnic on Instagram Thank you very much. I'll try. You are very good people. Can you tell me how to contact them?

[@GGRTL1]

My external hard drive was affected back in 2016 by CryptXXX. I have the tools but it said I need the original files for it to work. That I do not have because they're on my external hard drive. is there another way to get them decrypted? All of these are photos and videos from a good chunk of my life.

[@hamzakhalid6141]

how to decrypt files encrypted by ransomware maas ???

[@kumarbiswasamparkkhatai8512]

What about virus total fr finding the AV performance!!!

[@victorvalencia680]

So I found a file that had a password on it on a drive that they luckily weren't able to encrypt in time. Could this potentially be the key to decrypt? Also what program would I use to decrypt?

[@anonyash]

did it worked? and where you found that key?

[@jiyusiew]

My company infected by exile ransomware. Are you able to help?

[@KATIENERDGIRL]

they have me a pc and hdd with a 2016 cryptlocker ransomware (yes the owners never noticed, until I told them it was a virus), who still struggle to recover the files, the pc has been infected 03/02/2016 and I realized why even the recovery image of windows 7 from 12gb, has been infected with. encrypted, and although the pc has avas installed, bitdefender.mcfee. they caught the virus, I tried various file recovery and decrypt tools, but nothing doesn't work, this 2016 cryptolocker that encrypts files with the .encrypted extension is among the deadliest they have created and not even bleeping computer ones have managed to decrypt the files, if they have created something to do decrypt for .encrypted I want to know, jigasaw and other recovery tools have not succeeded, also before I was using PHOTREC testdisk and at the moment of saving the file from error, however I just have to recover the photos from that hdd always if possible

[@treverclinton142]

.nelasod virus file fix tutorial video Please help me....

[@jeanlylabrador-doctor9341]

My files cannot be encrypted 😭 im stressed out since I cannot open my school files on online clase because of this .wrui. i dont have any more choice but to format my laptop huhu 😭😭

[@confidenceakinyeleomofeago1673]

I had same issues, a friend introduced me to LULZSECHACKS on Instagram who helped me fix the issue

[@RasishSubedi]

yeah same happened to mine, I got some of my files back, use file recovery on your hardrive after disinfecting all the ransomeware, it will find them

[@smoker4784]

.boop offline encryption but i can't decrypt them

[@jessicatale9909]

I have a question... What if (as a prevention) we keep a copies of a few files in our PC. Is there like a program that can (when we get ransomware) compare 2 of the same file (maybe even multiple pairs) and figure out the key ?

[@pcsecuritychannel]

No. You can’t find an encryption key just by comparing changes.

[@Johnemmanueal]

I am attacked with an extension sspq ransomware anybody can help me out????

[@wasimmisaaw]

How to decryption .jope format ransomware virus...????

[@Oldsnakedp1985]

Forse cercavi: funziona anche con file in ftcode? 35/5000 does it also work with files in fttcode? thk :)

[@shubhmohaje5507]

Can u please tell me how to decrypt, .VARI files?

[@aljaffar6400]

How to decrypt repp. Files

[@nightmarenova6748]

Installed Manjaro 8months ago, using brain.exe,going well so far!

[@moemyintmaung9891]

i can't get to the emsisoft site

[@choukriderki3245]

How about for TOPI ransomware ?

[@rutulshah1100]

Hey very very nice & informative video, can you please share me link to decompiler

[@rogerdice9218]

does this apply to .SGHL ransomware

[@nk3d761]

My pc is attacked by moba virus I remove the virus But I can't decrypt my file When I use decrypt tool it say this is encrypted online

[@nk3d761]

Help

[@imremu]

I got a lisp ransomware and I cant decrypt the files... I tried emisoft and I cant decrypt them even if I'm in safe mode or offline

[@diegog.borges6936]

I have a friend who is also having this problem. Did you find any solution?

[@charlestapulayan4014]

Hey we need .QEWE RANSOMWARE DECRYPTOR

[@DPLearner]

Dear sir... Can decrypt .wnln files...