Their are currently Three tools available. ONLY run these once the virus is removed


Talos Group was able to develop a tool which decrypts the files encrypted by the TeslaCrypt ransomware. The TeslaCrypt Decryption Tool is a command line utility. It needs the “key.dat” file to properly recover the master key used for file encryption. Before it begins execution, it searches for “key.dat” in its original location (the user’s Application Data directory), or in the current directory. If it isn’t able to find and correctly parse the “key.dat” file, it will return an error and exit.

  1. To use this tool, download the file.
  2. Copy the “key.dat” (from Application Data directory) file into the tool’s directory
  3. Then specify either the encrypted file or a directory containing encrypted files.


The RannohDecryptor utility was initially created to decrypt files, which suffered from Rannoh ransomware. In time it acquired additional and useful features. Now it can be used to cure your files from CryptXXX activity.

  1. Download the tool and launch it.
  1. Open Settings and choose drive types (removable, network or hard drive) for scanning. Don’t check the “Delete crypted files after decryption” option until you are 100% that decrypted files open properly.



  1. Click the “Start scan” link and choose where the encrypted .crypt file lies (that file, for which you have an unencrypted copy as well).
  1. Then the tool will ask for the original file.
  1. After that RannohDecryptor starts searching for all other files with “.crypt” extension and tries to decrypt all files, which weigh less than your original. The bigger file you’ve feed to the utility — the more files would be decrypted.

Emsisoft Decryptor

Emsisoft Decryptor has a range of tools for different types of crypto viruses. Unfortunately they do not have decryption for the latest version of Crypto virus and may fail to recover if you do not know the type of virus you are infected with. Information about the Types of crypto virus