The Kaspersky XoristDecryptor tool for decrypting files affected by Trojan-Ransom.Win32.Xorist
Do you want to prevent infections? Install Kaspersky for Windows
Malware of the Trojan-Ransom.Win32.Xorist family gains unauthorized access to the victim’s computer and modifies data on it without user’s knowledge. As a result, the user's files or the entire system become inaccessible. A message appears on the screen demanding a ransom and promising to restore the data or normal operation of the device.
To decrypt the files, use the Kaspersky XoristDecryptor tool.
Signs of infection
- A message appears on the screen demanding the user to send an SMS to decrypt the files.
- A text file is created on drive C with the name "Read Me: how to decrypt files".
-
.jpg "The text file example")
- The Windows folder contains a file with the name CryptLogFile.txt.
- The trojan encrypts all files with the following extensions:
doc, xls, docx, xlsx, db, mp3, waw, jpg, jpeg, txt, rtf, pdf, rar, zip, psd, msi, tif, wma, lnk, gif, bmp, ppt, pptx, docm, xlsm, pps, ppsx, ppd, tiff, eps, png, ace, djvu, xml, cdr, max, wmv, avi, wav, mp4, pdd, html, css, php, aac, ac3, amf, amr, mid, midi, mmf, mod, mp1, mpa, mpga, mpu, nrt, oga, ogg, pbf, ra, ram, raw, saf, val, wave, wow, wpk, 3g2, 3gp, 3gp2, 3mm, amx, avs, bik, bin, dir, divx, dvx, evo, flv, qtq, tch, rts, rum, rv, scn, srt, stx, svi, swf, trp, vdo, wm, wmd, wmmp, wmx, wvx, xvid, 3d, 3d4, 3df8, pbs, adi, ais, amu, arr, bmc, bmf, cag, cam, dng, ink, jif, jiff, jpc, jpf, jpw, mag, mic, mip, msp, nav, ncd, odc, odi, opf, qif, qtiq, srf, xwd, abw, act, adt, aim, ans, asc, ase, bdp, bdr, bib, boc, crd, diz, dot, dotm, dotx, dvi, dxe, mlx, err, euc, faq, fdr, fds, gthr, idx, kwd, lp2, ltr, man, mbox, msg, nfo, now, odm, oft, pwi, rng, rtx, run, ssa, text, unx, wbk, wsh, 7z, arc, ari, arj, car, cbr, cbz, gz, gzig, jgz, pak, pcv, puz, r00, r01, r02, r03, rev, sdn, sen, sfs, sfx, sh, shar, shr, sqx, tbz2, tg, tlz, vsi, wad, war, xpi, z02, z04, zap, zipx, zoo, ipa, isu, jar, js, udf, adr, ap, aro, asa, ascx, ashx, asmx, asp, aspx, asr, atom, bml, cer, cms, crt, dap, htm, moz, svr, url, wdgt, abk, bic, big, blp, bsp, cgf, chk, col, cty, dem, elf, ff, gam, grf, h3m, h4r, iwd, ldb, lgp, lvl, map, md3, mdl, mm6, mm7, mm8, nds, pbp, ppf, pwf, pxp, sad, sav, scm, scx, sdt, spr, sud, uax, umx, unr, uop, usa, usx, ut2, ut3, utc, utx, uvx, uxx, vmf, vtf, w3g, w3x, wtd, wtf, ccd, cd, cso, disk, dmg, dvd, fcd, flp, img, iso, isz, md0, md1, md2, mdf, mds, nrg, nri, vcd, vhd, snp, bkf, ade, adpb, dic, cch, ctt, dal, ddc, ddcx, dex, dif, dii, itdb, itl, kmz, lcd, lcf, mbx, mdn, odf, odp, ods, pab, pkb, pkh, pot, potx, pptm, psa, qdf, qel, rgn, rrt, rsw, rte, sdb, sdc, sds, sql, stt, t01, t03, t05, tcx, thmx, txd, txf, upoi, vmt, wks, wmdb, xl, xlc, xlr, xlsb, xltx, ltm, xlwx, mcd, cap, cc, cod, cp, cpp, cs, csi, dcp, dcu, dev, dob, dox, dpk, dpl, dpr, dsk, dsp, eql, ex, f90, fla, for, fpp, jav, java, lbi, owl, pl, plc, pli, pm, res, rnc, rsrc, so, swd, tpu, tpx, tu, tur, vc, yab, 8ba, 8bc, 8be, 8bf, 8bi8, bi8, 8bl, 8bs, 8bx, 8by, 8li, aip, amxx, ape, api, mxp, oxt, qpx, qtr, xla, xlam, xll, xlv, xpt, cfg, cwf, dbb, slt, bp2, bp3, bpl, clr, dbx, jc, potm, ppsm, prc, prt, shw, std, ver, wpl, xlm, yps, md3.
How to restore encrypted files with the Kaspersky XoristDecryptor tool
- Download XoristDecryptor.
- Run the XoristDecryptor.exe file on the infected computer.
- Read the License agreement carefully and click Accept if you agree to all of its terms.
- Click Start scan.
- Specify the path to one of the encrypted files.
- Restart your computer if the tool prompts you to do so.
How to use the tool through the command line
| Parameter | Value |
|---|---|
| -l <file_name> | Save the report to a specified file. |
| -y | Close the window after the tool finishes its work. |
| -vandevf <path_to_file> | Specify the path to the ps.ce file to decrypt Vandev. |
| -vandevp <password> | Specify the password to decrypt Vandev. |
What to do if the issue persists
If the XoristDecryptor tool did not help decrypt the files, try RectorDecryptor and RakhniDecryptor.
In case an unknown malicious file is detected, the XoristDecryptor tool will prompt you to send the file to [email protected]. Kaspersky specialists will analyze the file and update XoristDecryptor databases. At the next launch, the tool will download new databases and disinfect the files. Sending information about a malicious file to Kaspersky will not only solve your problem but will also help other users who may get affected by file-encrypting ransomware.