Kaspersky CoinVaultDecryptor for decrypting files affected by Trojan-Ransom.MSIL.CoinVault
Latest update: September 3, 2024
ID: 13331
Do you want to prevent infections? Install Kaspersky for Windows
If your system has been breached by malware of the Trojan-Ransom.MSIL.CoinVault family, the files on your computer will be encrypted. A notification will also appear on the screen demanding money in exchange for decrypting the files.
To disinfect the system and decrypt the files:
- Scan your computer with a Kaspersky application using the instructions below.
- Download the Kaspersky CoinVaultDecryptor tool and use it to restore your files. See the instructions below.
Learn more about the technologies that Kaspersky uses to protect against malware, including encryptors, on the TechnoWiki page.
How to scan your computer with a Kaspersky application
- Download the installer for one of the applications from the Kaspersky website:
- Install the application:
- Update the databases:
- Run a Full Scan task and remove the detected malware:
How to restore the encrypted files with the Kaspersky CoinVaultDecryptor tool
The CoinVaultDecryptor restores the encrypted files in two ways:
- From the filelist.cvlst file.
The Trojan-Ransom.MSIL.CoinVault malware creates the filelist.cvlst file on the computer. The file contains the list of encrypted files. Usually, the file is located in the temporary folder TEMP or in the root folder of disk С. If you search for the filelist.cvlst manually, enable the displaying of hidden files and folders. - From the folder with the encrypted files.
If you cannot find the filelist.cvlst file, create a new folder (e.g. on the Desktop) and copy the encrypted files into it.
How to restore encrypted files from the filelist.cvlst file
- Download the CoinVaultDecryptor.zip archive and extract the files from it using the instructions.
- Open the folder with the archive files.
- Run the CoinVaultDecryptor.exe file.
- Read the License agreement carefully. If you agree to all of its terms, click Accept.
- Click Start scan.
- Specify the path to the filelist.cvlst file and click Open.
- Wait until the files are found and decrypted.
To view information about the scan task, click Details.
How to restore encrypted files from the folder
- Download the CoinVaultDecryptor.zip archive and extract the files from it using the instructions.
- Open the folder with the archive files.
- Run the CoinVaultDecryptor.exe file.
- Read the License agreement carefully. If you agree to all of its terms, click Accept.
- Click Change parameters.
- In the Objects to scan section, select the Folder with encrypted files check box and click ОК.
- Click Start scan.
- Click Continue.
- Specify the folder in which you saved the encrypted files and click ОК.
- Wait until the files are found and decrypted.
To view information about the scan task, click Details.
How to save restored files with their original names
The Kaspersky CoinVaultDecryptor tool saves decrypted files in the .decryptedklr format. To save decrypted files with their original names:
- Click Change parameters.
- In the Additional options section, select the Replace encrypted files with decrypted ones check box and click ОК.
