Crypto Sheriff

Crypto Sheriff is an online service which can help decrypt files that have fallen victim to a ransomware attack. See: https://www.nomoreransom.org. The “No More Ransom” project helps identify keys needed for decryption. It is a joint project of Europol, Kaspersky, McAfee, and the national police of the Netherlands. See the recommendation on the Europol site here.

Ransomware typically uses two keys - a public key to encrypt files, and a private key to decrypt files. It's sometimes possible to decrypt files encrypted with ransomware because of mistakes in how they are implemented, or because they are posted somewhere online. Law enforcement agencies also seize servers containing keys and make them known.

You use the service by uploading two files, each less than 1 MB, which have been encrypted by ransomware, and then entering an email address, Bitcoin address, or URL used in the ransomware demand that you received.

If Crypto Sheriff finds a way to decrypt your files, it will provide a link to tools you can use to access your files, and provide instructions on how to use those tools. The malware should be removed from an operating system before the files are decrypted.

Crypto Sheriff allows you to download more than 100 decryption tools, many of which are designed specifically for particular types of ransomware.