Are you a victim of ransomware? Don't pay the ransom!
Our free decryptors will help you regain access to files blocked by various types of ransomware described below. Just select a name to see signs of infection and get free help.
Want to avoid future ransomware infections?
Alcatraz Locker
Alcatraz Locker is one of the ransomware programs first discovered in mid November 2016. It uses AES 256 encryption in combination with Base64 encoding.
Changing file names.
Encrypted files get the extension .Alcatraz.
Ransom message.
ransomed.html"On the desktop:
If Alcatraz has encrypted your files, click here to download our free decryptor to unlock.
Apocalypse
Apocalypse is a type of ransomware that was first discovered in June 2016. Signs of infection are described below.
Changing file names.
Apocalypse adds extensions .encrypted, .FuckYourData, .locked, .Encryptedfile or .SecureCrypted Thesis.doc.locked.)
Ransom message.
When opening a file with the extension .How_To_Decrypt.txt, .README.Txt, .Contact_Here_To_Recover_Your_Files.txt, .How_to_Recover_Data.txt or .Where_my_files.txt (eg, Thesis.doc.How_To_Decrypt.txt) a message similar to the following appears:
BadBlock
BadBlock is a type of ransomware that was first discovered in May 2016. Signs of infection are described below.
Changing file names.
BadBlock does not rename files.
Ransom message.
Having encrypted your files, the BadBlock Trojan displays one of the following messages (for example, the file Help Decrypt.html):
If BadBlock has encrypted your files, click here to download our free decryptor to unlock.
Bart
Bart is a type of ransomware that was first discovered at the end of June 2016. Signs of infection are described below.
Changing file names.
Bart adds text .bart.zip at the end of filenames (for example, instead of Thesis.doc, the file will be named Thesis.docx.bart.zip). This encrypted ZIP archive contains the original files.
Ransom message.
After the files are encrypted, Bart changes the desktop background as shown below. The text in this image can also recognize the Bart program. Text is stored on the desktop in files recover.bmp and recover.txt.
If Bart has encrypted your files, click here to download our free decryptor to unlock.
Thanks. We are grateful to Peter Konrad, the author of the PkCrack program, for allowing his library to be used in our decryptor for the Bart ransomware Trojan.
Crypt888
Crypt888 (also known as Mircop) is a type of ransomware that was first discovered in June 2016. Signs of infection are described below.
Changing file names.
Crypt888 program adds text Lock. to the beginning of file names (for example, instead of Thesis.doc, the file will be called Lock.Thesis.doc).
Ransom message.
After encrypting your files, Crypt888 changes the desktop background to one of the options below.
If Crypt888 encrypted your files, click here to download our free decryptor to unlock.
CryptoMix (standalone version)
CryptoMix (also known as CryptFile2 and Zeta) is one of the ransomware programs first spotted in March 2016. At the beginning of 2017, a new type of CryptoMix appeared, called CryptoShield. Both versions of the program encrypt files using the AES256 algorithm with a unique encryption key downloaded from a remote server. If the server is unavailable or the user does not have an Internet connection, the ransomware encrypts the files using a fixed key ("offline key").
Note. The proposed decryptor is capable of unlocking only files encrypted with the "offline key". In cases where the offline file encryption key was not used, our decryptor will not be able to restore access to the files.
Changing file names.
.CRYPTOSHIELD, .rdmk, .lesli, .scl, .code, .rmd or .rscl.
Ransom message.
After encrypting the files, the following files can be found on the PC:
If CryptoMix encrypted your files, click here to download our free decryptor to unlock.
CrySiS
CrySiS (JohnyCryptor, Virus-Encode or Aura) is one of the ransomware programs first spotted in September 2015. It uses AES256 encryption in combination with RSA1024 asymmetric encryption.
Changing file names.
Encrypted files have one of the following extensions:
[email protected]
,
[email protected]
,
[email protected]
,
[email protected]
,
.{[email protected]) .CrySiS,
.{[email protected]) .xtbl,
.{[email protected]) .xtbl,
.{[email protected]) .xtbl
Ransom message.
After encrypting your files, the program displays one of the following messages. This message is contained in a file called " Decryption instructions.txt», « Decryptions instructions.txt" or "* README.txt"On your desktop.
If CrySiS has encrypted your files, click here to download our free decryptor to unlock.
Globe
Globe is one of the ransomware programs first discovered in August 2016. It uses the RC4 or Blowfish encryption method. Signs of infection are described below.
Changing file names.
Globe adds one of the following extensions to the file name: .ACRYPT, .GSupport, .blackblock, .dll555, .duhust, .exploit, .frozen, .globe, .gsupport, .kyra, .purged, .raid, [email protected] , .xtbl, .zendrz, .zendr or .hnyear... Moreover, some versions of the program encrypt the file name itself.
Ransom message.
After encrypting the files, the program displays a message that is located in the file “ How to restore files.hta" or " Read Me Please.hta»):
If Globe has encrypted your files, click here to download our free decryptor to unlock.
HiddenTear
HiddenTear is one of the first open source ransomware, hosted on GitHub and known since August 2015. Since that time, hundreds of variants of HiddenTear have been created by open source scammers. HiddenTear uses AES encryption.
Changing file names.
Encrypted files receive one of the following extensions (but may have others): .locked, .34xxx, .bloccato, .BUGSECCCC, .Hollycrypt, .lock, .saeid, .unlockit, .razy, .mecpt, .monstro, .lok, .암호화됨 , .8lock8, .fucked, .flyper, .kratos, .krypted, .CAZZO, .doomed.
Ransom message.
When files are encrypted, a text file appears on the user's home screen (READ_IT.txt, MSG_FROM_SITULA.txt, DECRYPT_YOUR_FILES.HTML)... Various options can also display a ransom message:
If HiddenTear has encrypted your files, click here to download our free decryptor to unlock.
Jigsaw
Jigsaw is one of the ransomware programs that has been around since March 2016. She is named after the movie villain nicknamed "Jigsaw Killer" ("Saw the killer"). Some variants of this program use an image of this character on the screen, demanding ransom for unlocking.
Changing file names.
Encrypted files receive one of the following extensions: .kkk, .btc, .gws, .J, .encrypted, .porno, .payransom, .pornoransom, .epic, .xyz, .versiegelt, .encrypted, .payb, .pays, .payms, .paymds, .paymts, .paymst, .payrms, .payrmts, .paymrts, .paybtcs, .fun, .hush, [email protected] or .gefickt.
Ransom message.
When the files are encrypted, one of the screens below will be displayed:
If Jigsaw encrypted your files, please click here to download our free decryptor to unlock.
Legion
Legion is a type of ransomware that was first discovered in June 2016. Signs of infection are described below.
Changing file names.
Legion adds something like [email protected]$ .legion or [email protected]$ .cbf at the end of filenames. (For example, instead of Thesis.doc, the file will be named [email protected]$ .legion.)
Ransom message.
After encrypting your files, Legion changes the desktop background, and a pop-up window appears similar to this:
If Legion has encrypted your files, click here to download our free decryptor to unlock.
About a week or two ago, another piece of work by modern virus makers appeared on the network, which encrypts all user files. Once again, I will consider the question of how to cure a computer after a ransomware virus crypted000007and recover encrypted files. In this case, nothing new and unique has appeared, just a modification of the previous version.
Guaranteed decryption of files after the ransomware virus - dr-shifro.ru. The details of the work and the scheme of interaction with the customer are below in my article or on the website in the section "Working procedure".
Description of CRYPTED000007 ransomware virus
The CRYPTED000007 ransomware does not fundamentally differ from its predecessors. He acts almost one on one as. But still, there are several nuances that distinguish it. I'll tell you about everything in order.
It comes, like its counterparts, by mail. Social engineering techniques are used to ensure that the user is certainly interested in the letter and opens it. In my case, the letter was about some kind of court and about important information on the case in the attachment. After starting the attachment, the user opens a Word document with an extract from the Moscow Arbitration Court.
File encryption starts in parallel with opening the document. An informational message from the Windows User Account Control system starts constantly popping up.
If you agree with the proposal, then the backup copies of files in the shadow copies of Windows will be deleted and information recovery will be very difficult. Obviously, you should never agree with the proposal. In this ransomware, these requests pop up constantly, one by one, and do not stop, forcing the user to agree and delete the backups. This is the main difference from the previous modifications of ransomware. I have never come across requests to delete shadow copies without stopping. Usually, after 5-10 sentences, they stopped.
I will give you a recommendation for the future. Very often people turn off User Account Control alerts. This is not necessary. This mechanism can really help in countering viruses. The second obvious tip - do not work constantly under the computer administrator account, unless there is an objective need for it. In this case, the virus will not have the ability to do much harm. You will have a better chance of resisting him.
But even if you answered negatively to the ransomware requests all the time, all your data is already encrypted. After the encryption process is over, you will see a picture on your desktop.
At the same time, there will be many text files on the desktop with the same content.
Your files were encrypted. In order to decode ux, you need to read the code: 329D54752553ED978F94 | 0 to the email address [email protected] ... From now on you will get all the necessary controls. Try to decipher it yourself will not lead to anything, in addition to the irrevocable number of information. If you still want to try, then make sure to back up the files beforehand, otherwise, changing the decryption will no longer be possible under any circumstances. If you don’t receive a message at the above address within 48 hours (only in this case!), Use the contact form. This can be done in two ways: 1) Download u ycma and update the Tor Browser from the link: https://www.torproject.org/download/download-easy.html.en In the Tor Browser directory, enter adpеc7: http: // crypt7 .onion / and press Enter. The page with the feedback form is loaded. 2) In any browser, go to one of the addresses: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 329D54752553ED978F94 | 0 to e-mail address [email protected] ... Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), Use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http: / /cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
The postal address is subject to change. I have come across such addresses:
The addresses are constantly updated, so they can be completely different.
As soon as you find that the files are encrypted, immediately shut down your computer. This must be done in order to interrupt the encryption process both on the local computer and on network drives. The ransomware virus can encrypt all information that it can reach, including on network drives. But if there is a large amount of information, then it will take him considerable time. Sometimes, even in a couple of hours, the ransomware did not have time to encrypt everything on a network drive with a capacity of about 100 gigabytes.
Next, you need to think carefully about how to act. If by all means you need information on your computer and you do not have backups, then it is better to turn to specialists at this moment. Not necessarily for money in some companies. You just need a person who is well versed in information systems. It is necessary to assess the scale of the disaster, remove the virus, collect all available information on the situation in order to understand how to proceed.
Incorrect actions at this stage can significantly complicate the process of decrypting or recovering files. At worst, they can make it impossible. So take your time, be neat and consistent.
How the CRYPTED000007 ransomware virus encrypts files
After the virus has been started and finished its activity, all useful files will be encrypted, renamed from extension.crypted000007... Moreover, not only the file extension will be replaced, but also the file name, so you won't know exactly what kind of files you had if you don't remember yourself. The picture will be something like this.
In such a situation, it will be difficult to assess the scale of the tragedy, since you will not be able to fully remember what you had in different folders. This was done on purpose to confuse a person and induce payment for file decryption.
And if you had encrypted network folders and there are no full backups, then this can completely stop the work of the entire organization. You will not immediately understand what is ultimately lost to begin recovery.
How to clean your computer and remove the CRYPTED000007 ransomware
The CRYPTED000007 virus is already on your computer. The first and most important question is how to cure the computer and how to remove the virus from it in order to prevent further encryption if it hasn't been finished yet. Immediately I draw your attention to the fact that after you yourself begin to perform some actions with your computer, the chances of decrypting the data decrease. If you at any cost need to restore files, do not touch the computer, but immediately contact the professionals. Below I will talk about them and give a link to the site and describe the scheme of their work.
In the meantime, we will continue to independently treat the computer and remove the virus. Traditionally, ransomware is easily removed from a computer, since a virus has no task at all to remain on the computer. After complete encryption of files, it is even more profitable for him to self-delete and disappear, so that it is more difficult to investigate the initiator and decrypt the files.
It is difficult to describe the manual removal of the virus, although I tried to do it before, but I see that it is most often pointless. The names of the files and the location of the virus are constantly changing. What I saw is no longer relevant in a week or two. Usually, viruses are sent by mail in waves, and each time there is a new modification that is not yet detected by antivirus software. Universal tools that check autorun and detect suspicious activity in system folders help.
To remove the CRYPTED000007 virus, you can use the following programs:
- Kaspersky Virus Removal Tool - a utility from Kaspersky http://www.kaspersky.com/antivirus-removal-tool.
- Dr.Web CureIt! - a similar product from other web http://free.drweb.ru/cureit.
- If the first two utilities do not help, try MALWAREBYTES 3.0 - https://ru.malwarebytes.com.
Most likely, one of these products will clear the computer of CRYPTED000007 ransomware. If it suddenly happens that they do not help, try removing the virus manually. I gave the removal method using an example and you can see it there. In short, step by step, then you need to act like this:
- We look at the list of processes, having previously added a few additional columns to the task manager.
- We find the process of the virus, open the folder in which it sits and delete it.
- We clear the mention of the virus process by the file name in the registry.
- Reboot and make sure that the CRYPTED000007 virus is not in the list of running processes.
Where to download the CRYPTED000007 decoder
The question of a simple and reliable decryptor arises first of all when it comes to a ransomware virus. The first thing I recommend is to use the service https://www.nomoreransom.org. What if you're lucky they will have a decryptor for your version of the CRYPTED000007 ransomware. I will say right away that you have few chances, but the attempt is not torture. On the main page, click Yes:
Then download a couple of encrypted files and hit Go! Find out:
At the time of this writing, there was no decoder on the site.
You may be more fortunate. You can also familiarize yourself with the list of decryptors for download on a separate page - https://www.nomoreransom.org/decryption-tools.html. Maybe there is something useful there. When the virus is very fresh, there is little chance of this, but over time, something may appear. There are examples when decoders for some modifications of encryptors appeared on the network. And these examples are on the specified page.
Where else can I find a decoder, I don't know. It is unlikely that it will actually exist, given the peculiarities of the work of modern ransomware. Only the authors of the virus can have a full-fledged decoder.
How to decrypt and recover files after CRYPTED000007 virus
What to do when CRYPTED000007 virus encrypted your files? The technical implementation of encryption does not allow decrypting files without a key or a decryptor, which only the author of the encryptor has. Maybe there is some other way to get it, but I have no such information. We just have to try to recover the files by handy methods. These include:
- Tool shadow copies windows.
- Deleted data recovery software
First, let's check if we have shadow copies enabled. This tool works by default in windows 7 and higher, unless you manually disable it. To check, open the computer properties and go to the system protection section.
If during infection you did not confirm the UAC request to delete files in shadow copies, then some data should remain there. I spoke in more detail about this request at the beginning of the story, when I talked about the work of the virus.
For convenient file recovery from shadow copies, I suggest using a free program for this - ShadowExplorer. Download the archive, unpack the program and run it.
This will open the last copy of the files and the root of the C drive. In the upper left corner, you can select a backup if you have several. Check different copies for the correct files. Compare by dates, where is the more recent version. In my example below, I found 2 files on my desktop three months ago when they were last edited.
I was able to recover these files. To do this, I selected them, right-clicked, selected Export and indicated the folder where to restore them.
You can restore folders at once in the same way. If your shadow copies worked and you did not delete them, you have quite a lot of chances to recover all or almost all files encrypted by the virus. Perhaps some of them will be an older version than we would like, but nevertheless, it is better than nothing.
If for some reason you do not have shadow copies of files, the only chance to get at least something from the encrypted files is to restore them using the deleted file recovery tools. To do this, I suggest using the free Photorec program.
Run the program and select the disk on which you will recover files. Launching the graphical version of the program executes the file qphotorec_win.exe... You must select a folder where the found files will be placed. It is better if this folder is not located on the same drive where we are searching. Connect a USB flash drive or external hard drive for this.
The search process will take a long time. At the end, you will see statistics. Now you can go to the previously specified folder and see what was found there. There will most likely be a lot of files and most of them will either be damaged, or they will be some kind of systemic and useless files. But nevertheless, in this list you can find some useful files. There are already no guarantees that you will find what you will find. Images are usually best restored.
If you are not satisfied with the result, there are still programs for recovering deleted files. Below is a list of programs that I usually use when I need to recover the maximum number of files:
- R.saver
- Starus File Recovery
- JPEG Recovery Pro
- Active File Recovery Professional
These programs are not free, so I will not provide links. If you want to, you can find them yourself on the Internet.
The entire file recovery process is shown in detail in the video at the very end of the article.
Kaspersky, eset nod32 and others in the fight against Filecoder.ED ransomware
Popular antiviruses define the CRYPTED000007 ransomware as Filecoder.ED and then there may be some other designation. I went through the major antivirus forums and didn't see anything useful. Unfortunately, as usual, antiviruses were not ready for the invasion of a new wave of ransomware. Here is a post from the Kaspersky forum.
Antiviruses traditionally allow new modifications of ransomware Trojans to pass. Nevertheless, I recommend using them. If you are lucky and you receive an encryptor in your mail, not during the first wave of infections, but a little later, there is a chance that the antivirus will help you. They all work one step behind the attackers. A new version of the ransomware is released, antiviruses do not respond to it. As soon as a certain mass of material for research on a new virus accumulates, antiviruses release an update and begin to respond to it.
What prevents antivirus from responding immediately to any encryption process in the system is not clear to me. Perhaps there is some technical nuance on this topic that does not allow to adequately respond and prevent encryption of user files. It seems to me that you could at least display a warning about the fact that someone is encrypting your files, and suggest stopping the process.
Where to go for guaranteed decryption
I happened to meet one company that actually decrypts data after the work of various ransomware viruses, including CRYPTED000007. Their address is http://www.dr-shifro.ru. Payment only after complete decryption and your verification. Here's an example of how it works:
- A company specialist drives up to your office or home and signs a contract with you, in which he fixes the cost of the work.
- Launches the decryptor and decrypts all files.
- You make sure that all files are open, and you sign the delivery / acceptance certificate of the work performed.
- Payment solely upon successful decryption result.
To be honest, I don't know how they do it, but you are not risking anything. Payment only after demonstration of the decoder operation. Please write a review about your experience with this company.
Methods of protection against the CRYPTED000007 virus
How can you protect yourself from the work of the ransomware and do without material and moral damage? There are some simple and effective tips:
- Backup! A backup of all important data. And not just a backup, but a backup to which there is no permanent access. Otherwise, the virus can infect both your documents and backups.
- Licensed antivirus. Although they do not provide a 100% guarantee, the chances of avoiding encryption increase. They are often not ready for new versions of the ransomware, but after 3-4 days they begin to respond. This increases your chances of avoiding infection if you did not get into the first wave of mailing a new ransomware modification.
- Do not open suspicious email attachments. There is nothing to comment on. All the ransomware I know reached users via mail. And every time new tricks are invented to deceive the victim.
- Do not mindlessly open links sent to you from your friends via social networks or instant messengers. This is also how viruses sometimes spread.
- Turn on the display of file extensions in windows. How to do this is easy to find on the Internet. This will allow you to notice the file extension on the virus. Most often it will .exe, .vbs, .src... In everyday work with documents, you hardly come across such file extensions.
I tried to supplement what I already wrote earlier in each article about the ransomware virus. Until then, I say goodbye. I would be glad to have useful comments on the article and on the CRYPTED000007 ransomware virus in general.
Video with decryption and file recovery
Here is an example of the previous modification of the virus, but the video is completely relevant for CRYPTED000007.
Today, there are many types of ransomware known. The anti-virus company Doctor Web has been successfully fighting against such ransomware for a long time: in some cases, files encrypted by the Trojan can be recovered. This also applies to the encoder known as CryptXXX - Doctor Web specialists can decrypt files damaged by this Trojan if they were encrypted before the beginning of June 2016.
The malware Trojan.Encoder.4393, also known as CryptXXX, is a typical representative of the large group of encoder Trojans. This ransomware has several versions and is distributed by cybercriminals all over the world. In order to increase profits from their illegal activities, the virus writers organized a special service for paid decryption of corrupted CryptXXX files, which pays a certain percentage to the Trojan's distributors. All copies of CryptXXX go to a single control server, and sites offering decryption are located in the anonymous TOR network. The success of the affiliate program, most likely, partly explains the breadth of the geography of known infections, as well as the high popularity of CryptXXX among cybercriminals. Files encrypted by the Trojan are given the * .crypt extension, and the files with the ransomware requirements are named de_crypt_readme.txt, de_crypt_readme.html, and de_crypt_readme.png.
If you are a victim of this malware and the files on your computer were encrypted before the beginning of June 2016, it is possible to recover your information. The success of this operation depends on a number of factors and to a large extent on the actions of the user himself.
- Do not try to delete any files from your computer or reinstall the operating system, and do not use an infected PC until you receive instructions from Doctor Web technical support.
- If you run an anti-virus scan, do not take any steps to cure or remove detected malware - they may be needed by specialists in the process of finding a key to decrypt files.
- Try to remember as much information as possible about the circumstances of the infection: this applies to suspicious letters received by you by e-mail, programs downloaded from the Internet, sites that you visited.
- If you still have a letter with an attachment, after opening which files on your computer turned out to be encrypted, do not delete it: this letter should help specialists determine the version of the Trojan that has penetrated your computer.
To decrypt files damaged as a result of CryptXXX actions, use the special service page on the Doctor Web anti-virus company's website. Free assistance in decrypting files is provided only to holders of Dr.Web licenses who have installed Dr.Web Security Space (for Windows), Dr.Web Anti-virus for OS X or Linux at least version 10 or Dr.Web Enterprise Security Suite at the time of infection. (versions 6+). Other victims can use the paid Dr.Web Rescue Pack service through
The CRYPT file (full WhatsApp Encrypted Database File) can be generated only on the Android platform and is an encrypted database (DB). Such a file is created by the universal mobile application WhatsApp Messenger.
Basically, a CRYPT file contains text messages encrypted using 256-bit AES. Files with the CRYPT extension are stored in the internal memory or on an external SD card of an Android mobile device (depending on user settings).
In recent versions of Android, instead of the CRYPT extension, CRYPT12 is used, which is a prefix to the usual DB extension (). Ultimately, the file is named name.db.crypt12 (can be presented in conjunction with the date).
To relay the database formats (CRYPT12-\u003e CRYPT) on your mobile device, you can use the omni-crypt software module.
To view the history of user message histories, you need to find and activate the encryption key for the CRYPT12 file in the com.whatsapp / files / key directory.
Programs to open CRYPT files
To decrypt and open a CRYPT file, most users successfully use the following software plugins:
These applications will decode the CRYPT file and allow you to open the history of user messages for viewing and editing.
Converting CRYPT to other formats
The most common way to convert an encrypted CRYPT file database is to translate the data into CRYPT12 format. The Omni-crypt mobile app can be used for this. Reverse relaying of data (CRYPT12-\u003e CRYPT) using the same program is also widely used.
Why CRYPT and what are its advantages?
The scope of the file with the CRYPT extension is not so wide. However, without this format, one can imagine an unimpeded and prompt exchange of user messages based on a mobile application. Whatsapp messenger, almost impossible.
Alpha Crypt is a serious virus that must be classified as ransomware. What does it mean? This means that this program was designed to infiltrate the system, lock it, encrypt the files that are stored on it, and then ask people to pay the ransom in exchange for the decryption key. The most important fact about this ransomware is that Alpha Crypt is capable of encrypting important files that are stored in the system and devices that are inserted into the computer, including external hard drives, flash drives and other similar tools that can be used to store backup copies of important files. This means that you can easily lose your photos, music files, important documents and other files if they are stored either on your PC system or other sources. To give people the ability to decrypt their encrypted files, hackers are asking to pay a ransom, which has clearly been increasing lately. At the time of writing, this decryption key is worth 1.5 bitcoins, which is equal to 415 USA. Regardless of what it may seem like the only solution that can help you recover your files, you shouldn't pay this payment because there is no guarantee that it will help you decrypt your files. In addition, we must warn you about something else - by paying for the decryption key, you also support the scammers who are responsible for creating the AlphaCrypt virus and other hijackers. This could easily lead us to an increased occurrence of such viruses in the future. If this threat has already infected your machine and has encrypted each or some of the important files, you must use one of these decryption tools: R-Studio, Photophec or. Alternatively, you can delete malicious Alpha Crypt files using Webroot SecureAnywhere AntiVirus or.