In case of an infection, all files on the computer will be changed as follows:

The other ransomware does not change file extensions.

If you want to decrypt files affected by Trojan-Ransom.Win32.CryptXXX, take into account the following: 

• The RannohDecryptor tool scans a limited number of file formats:
  1cd, 7z, ai, avi, bz2, cab, cdr, cdw, cdx, cf, chm, dbf, djvu, doc, docm, docx, dt, dwg, epf, eps, erf, ert, fla, flac, flv, gif, gz, html, iso, jpeg, jpg, ldf, md, mdb, mdf, mov, mp3, mp4, mxl, nef, ods, odt, ogg, pdf, php, png, ppt, pptm, pptx, ps1, psd, pst, qbb, rar, rcf, rtf, sdf, sldasm, slddrw, tib, tif, tiff, vhd, vhdx, vsd, wav, xls, xlsm, xlsx, xlt, zip.
• It may take a long time to restore the key for decrypting files affected by Trojan-Ransom.Win32.CryptXXX version 2. In this case, the tool displays a warning:

1. Download the RannohDecryptor.zip archive and extract the files from it using the instructions.
2. Open the folder with the archive files.
3. Run the RannohDecryptor.exe file.
4. Read the License agreement carefully. If you agree to all of its terms, click Accept.
5. If you want the utility to automatically remove the decrypted files, do the following:
   1. In the main window, click Change parameters.

   2. After successful decryption, select the Delete crypted files after decryption check box and click OK.

   3. 
6. Click Start scan.

7. Specify the path to the encrypted file. 
8. To decrypt some files, the utility will request the original (not encrypted) copy of one encrypted file. You can find such a copy in your mail, on a removable drive, on your other computers, or in cloud storage. Click Continue and specify the path to the original file.
   If the file is encrypted by Trojan-Ransom.Win32.CryptXXX, indicate the largest files. Only the files of this size or smaller ones will be decrypted.

9. Wait until the encrypted files are found and decrypted. 

If the file was encrypted by Trojan-Ransom.Win32.Cryakl, Trojan-Ransom.Win32.Polyglot, or Trojan-Ransom.Win32.Fury, the tool will save the file at its previous location with the extension .decryptedKLR.original_extension. If you selected the Delete crypted files after decryption check box, the tool will save the decrypted files with their original name.

If the file was encrypted by Trojan-Ransom.Win32.Rannoh, Trojan-Ransom.Win32.Cryakl, Trojan-Ransom.Win32.AutoIt, Trojan-Ransom.Win32.CryptXXX, Trojan-Ransom.Win32.Crybola, or Trojan-Ransom.Win32.Yanluowang, the tool will save the file at its previous location with the original extension.

By default, the tool log is saved on the system disk with the operating system installed. The log file name is: UtilityName.Version_Date_Time_log.txt. For example, C:\RannohDecryptor.1.1.0.0_02.05.2012_15.31.43_log.txt

If RannohDecryptor did not succeed in file decryption, download and launch the XoristDecryptor or RectorDecryptor tool.

To protect your computer from ransomware, download and install new Kaspersky applications.