Headline

Free Ransomware Decryption Tools

Tab
Overview
Tab
Virus Encyclopedia
Tab
Virus Removal Tools
Tab
Ransomware Decryption Tools
Tab
Internet Risk Level
Tab
Incorrect page rating report

Hit by ransomware? Don’t pay the ransom!

Our free ransomware decryption tools can help decrypt files encrypted by the following forms of ransomware. Just click a name to see the signs of infection and get our free fix.

Want to help prevent future ransomware infections?

Download a FREE trial of AVG Internet Security or AVG Internet Security Business Edition. Learn more about our business security solutions.

Learn more in our Ultimate Guide to Ransomware.

{#apocalypse}Apocalypse

Apocalypse is a form of ransomware first spotted in June 2016. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
Apocalypse adds .encrypted, .FuckYourData, .locked, .Encryptedfile, or .SecureCrypted to the end of filenames. (e.g., Thesis.doc = Thesis.doc.locked)
Ransom message:
Opening a file with the extension .How_To_Decrypt.txt, .README.Txt, .Contact_Here_To_Recover_Your_Files.txt, .How_to_Recover_Data.txt, or .Where_my_files.txt (e.g., Thesis.doc.How_To_Decrypt.txt) will display a variant of this message:
Apocalypse ransomware screenshot
link
https://files-download.avg.com/util/avgrem/avg_decryptor_Apocalypse.exe
text
Download Apocalypse Fix
alignment
left
alignment-mobile
left
mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_ApocalypseVM.exe
text
Download ApocalypseVM Fix
alignment
left
alignment-mobile
left

{#badblock}BadBlock

BadBlock is a form of ransomware first spotted in May 2016. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
BadBlock does not rename your files.
Ransom message:
After encrypting your files, BadBlock displays one of these messages (from a file named Help Decrypt.html):
BadBlock ransomware screenshot
BadBlock ransomware screenshot

If BadBlock has encrypted your files, click here to download our free fix:

mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_BadBlock32.exe
text
Download BadBlock Fix for 32-bit Windows
alignment
left
alignment-mobile
left
mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_BadBlock64.exe
text
Download BadBlock Fix for 64-bit Windows
alignment
left
alignment-mobile
left

{#bart}Bart

Bart is a form of ransomware first spotted at the end of June 2016. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
Bart adds .bart.zip to the end of filenames. (e.g., Thesis.doc = Thesis.docx.bart.zip) These are encrypted ZIP archives containing the original files.
Ransom message:
After encrypting your files, Bart changes your desktop wallpaper to an image like the one below. The text on this image can also be used to help identify Bart, and is stored on the desktop in files named recover.bmp and recover.txt.
Bart ransomware screen

If Bart has encrypted your files, click here to download our free fix:

mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_Bart.exe
text
Download Bart Fix
alignment
left
alignment-mobile
left
mobile
24
desktop
32

Acknowledgement: We’d like to thank Peter Conrad, author of PkCrack, who granted us permission to use his library in our Bart decryption tool.

{#crypt888}Crypt888

Crypt888 (also known as Mircop) is a form of ransomware first spotted in June 2016. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
Crypt888 adds Lock. to the beginning of filenames. (e.g., Thesis.doc = Lock.Thesis.doc)
Ransom message:
After encrypting your files, Crypt888 changes your desktop wallpaper to one of the following:
Crypt888 ransomware screenshot
Crypt888 v2 ransomware screenshot
Crypt888 v4 ransomware screenshot
Crypt888 v4 screenshot
Screenshot of Crypt888 ransomware

If Crypt888 has encrypted your files, click here to download our free fix:

mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_Crypt888.exe
text
Download Crypt888 Fix
alignment
left
alignment-mobile
left

{#legion}Legion

Legion is a form of ransomware first spotted in June 2016. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
Legion adds a variant of ._23-06-2016-20-27-23_$f_tactics@aol.com$.legion or .$centurion_legion@aol.com$.cbf to the end of filenames. (e.g., Thesis.doc = Thesis.doc._23-06-2016-20-27-23_$f_tactics@aol.com$.legion)
Ransom message:
After encrypting your files, Legion changes your desktop wallpaper and displays a popup, like this:
Legion ransomware screenshot

If Legion has encrypted your files, click here to download our free fix:

mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_Legion.exe
text
Download Legion Fix
alignment
left
alignment-mobile
left

{#szflocker}SZFLocker

SZFLocker is a form of ransomware first spotted in May 2016. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
SZFLocker adds .szf to the end of filenames. (e.g., Thesis.doc = Thesis.doc.szf)
Ransom message:
When you try to open an encrypted file, SZFLocker displays the following message (in Polish):
SZFlocker ransomware screenshot

If SZFLocker has encrypted your files, click here to download our free fix:

mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_SzfLocker.exe
text
Download SZFLocker Fix
alignment
left
alignment-mobile
left

{#teslacrypt}TeslaCrypt

TeslaCrypt is a form of ransomware first spotted in February 2015. Here are the signs of infection:

mobile
24
desktop
40
Filename changes:
The latest version of TeslaCrypt does not rename your files.
Ransom message:
After encrypting your files, TeslaCrypt displays a variant of the following message:
TeslaCrypt ransomware screenshot

If TeslaCrypt has encrypted your files, click here to download our free fix:

mobile
16
desktop
24
link
https://files-download.avg.com/util/avgrem/avg_decryptor_TeslaCrypt3.exe
text
Download TeslaCrypt Fix
alignment
left
alignment-mobile
left