Got hit by a nasty ransomware? Don’t worry Avast have a free solution for you how to get your data back and computer to the previous state without paying a cent to hackers.

If you never heart of ransomware, it’s a pretty bad type of malware which basically encrypts all your files, lock-down the computer and ask you the pay serious money (hundreds or even thousands of dollars) to hackers for the unlock. Yes, a pure blackmailing and you would be surprised how many users are actually paying to hackers for decryption.

Below is the example of such message from the NoobCrypt ransomware.

NoobCrypt Ransomware Message Alert

NoobCrypt Ransomware Message Alert

OUR TIP The best way to stay protected from any kind of ransomware is using latest Avast antivirus and not opening e-mail attachments from unknown senders.

If your computer is infected, the best way to tell by what kind of ransomware is through the file extensions of the encrypted files. For example Alcatraz Locker changes your files to ‘.Alcatraz‘. Below is the full-list of all Avast anti-ransomware tools for a free download and steps for removal.

How to Remove & Decrypt Alcatraz Locker Ransomware

Alcatraz Locker is around since middle of November 2016. For encrypting victim’s files is uses AES-256 encryption combined with Base64 encoding.

  • File extension: .Alcatraz
  • Ransom message: ALL YOUR DATA ARE ENCRYPTED
  • How to decrypt: Download the fix and run the file avast_decryptor_alcatrazlocker.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt Apocalypse Ransomware

  • File extension: .encrypted, .FuckYourData, .locked, .Encryptedfile, or .SecureCrypted
  • Ransom message: Your files was encrypted, you have a few days to contact me before your data will be lost forever | decryptdata@inbox.ru
  • How to decrypt: Download the fix and run the file avast_decryptor_apocalypse.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt BadBlock Ransomware

  • File extension: no file extension change
  • Ransom message: BadBlock is on the block | This machine was infected with a ransomware BadBlock
  • How to decrypt: Download the fix and run the file avast_decryptor_badblock.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.


For 32-bit Windows


For 64-bit Windows

How to Remove & Decrypt Bart Ransomware

Bart ransomware has been first spotted in June 2016. It’s specific is changing a Windows desktop wallpaper to one of the ransom message.

  • File extension: .bart.zip
  • Ransom message: All your files are encrypted | Decrypting of your files is only possible with the private key, which is on our secret server
  • How to decrypt: Download the fix and run the file avast_decryptor_bart.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt Crypt888 Ransomware

Crypt888 ransomware has been first spotted in June 2016. Sometimes also called as Microp or Locky Ransomware. It’s specific is changing a Windows desktop wallpaper to one of the ransom message. As one of a few ransomwares it doesn’t change file extensions, but add “Lock.” at the beginning of the file name.

  • File preposition: Lock. at the beginning of filenames
  • Ransom message (as a wallpaper): You’ve stolen 48.48 BTC from the wrong people | To recover your files, send an email to decrypt@keemail.me
  • How to decrypt: Download the fix and run the file avast_decryptor_crypt888.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt CrySiS Ransomware

CrySiS ransomware exists for a long time and has been first spotted in September 2015. Sometimes also called as JohnyCryptor, Virus-Encode, or Aura Ransomware. It’s specific is using AES-256 and RSA-1024 encryption. For some reason this ransomware is mostly related to free e-mail accounts at India.com (news portal for India).

  • File extension: .johnycryptor@hackermail.com.xtbl, .ecovector2@aol.com.xtbl, .systemdown@india.com.xtbl, .Vegclass@aol.com.xtbl, .{milarepa.lotos@aol.com}, .CrySiS,.Greg_blood@india.com}.xtbl, .{savepanda@india.com}.xtbl, .{arzamass7@163.com}.xtbl
  • Ransom message: To restore information e-mail technical support ecovector2@aol.com | Your files was encrypted to decrypt write to systemdown@india.comThis device is infected. To restore the data refer to the email savepanda@india.com
  • How to decrypt: Download the fix and run the file avast_decryptor_crysis.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt Globe Ransomware

Globe ransomware has been first spotted in August 2016. It’s specific is using RC4 or Blowfish encryption method.

  • File extension: .ACRYPT, .GSupport[0-9], .blackblock, .dll555, .duhust, .exploit, .frozen, .globe, .gsupport, .kyra, .purged, .raid[0-9], .siri-down@india.com, .xtbl, .zendrz, or .zendr[0-9]
  • Ransom message: Your documents, photos, data bases, save games and other important data was encrypted | Restoring data required the interpreter
  • How to decrypt: Download the fix and run the file avast_decryptor_globe.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt Legion Ransomware

Legion ransomware has been first spotted in June 2016. It’s specific is using a wallpaper to display a ransom message.

  • File extension: ._23-06-2016-20-27-23_$f_tactics@aol.com$.legion or .$centurion_legion@aol.com$.cbf
  • Ransom message: Your data is encrypted | To return the file to an email email f_tactics@aol.com
  • How to decrypt: Download the fix and run the file avast_decryptor_legion.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt NoobCrypt Ransomware

NoobCrypt ransomware has been first spotted in July 2016. It’s specific is not using any file extension or changing file names. However when infected all encrypted files are unable to open.

  • File extension: no file extension change
  • Ransom message (see the image at the top of this page): Your personal files are encrypted | Coded in R0MANIA
  • How to decrypt: Download the fix and run the file avast_decryptor_noobcrypt.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt SZFLocker Ransomware

SZFLocker ransomware has been first spotted in May 2016. Apparently the ransomware is coming from Poland as the ransom message is in Polish language.

  • File extension: .szf
  • Ransom message: Plik zasyfrowany Usluga odzyfrowania dostepna pod adresem deszyfrator.deszyfr@yandex.ru
  • How to decrypt: Download the fix and run the file avast_decryptor_szflocker.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

How to Remove & Decrypt TeslaCrypt Ransomware

TeslaCrypt ransomware exists for a long time and has been first spotted in February 2015. It’s specific is not using any file extension or changing file names.

  • File extension: no file extension change
  • Ransom message: Your documents, photos, databases and other important files have been encrypted To decrypt your files follow the instructions
  • How to decrypt: Download the fix and run the file avast_decryptor_teslacrypt3.exe. Select the drives to decrypt (typically C:\) and confirm. Add one encrypted file and one original file (not hit by Ransomware) for comparison.

Big kudos to Avast (actually all of the decryptor tools have been developed by AVG Technologies) for making these available free to the World and saving many people’s data and money.

Additional Notes

Although we have used Avast Free Antivirus 2017 screenshots in this article, these steps are also applicable for all Avast Antivirus solutions (i.e. also for Avast Pro Antivirus, Avast Internet Security, or Avast Premier) running the latest version available.

Steps are relevant for all Windows versions – Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 (including Anniversary Update).

Written by Paul B.

My name is Paul and I love Avast since the Home Edition v4.8 (2008). I am recommending it to all my friends, but I realized they don't know how to use it. So I started this site in order to help others getting maximum from this awesome antivirus. Feel free to contact me via Facebook, comments below or this form.

Leave a Comment

Your email address will not be published. Required fields are marked *