Ransomware Decryption Guideline

If computer or smart device were infected with ransomware, please do not pay the ransom. Users can search for the decryption tool in the following webpage:

https://www.nomoreransom.org/en/decryption-tools.html

Most ransomware variants do not have any decryption tool, it is not guarantee that the tool(s) above can recover the file(s) successfully. If the tool is not working, apart from using offline backup files for recovery, there is no other solution at this moment.

In addition, do not use unauthenticated decryption software which searchable online, you may be infected with other malwares at your own risk.

The steps you may follow for decryption:

1. Disconnect the infected computer from network (LAN and WiFi) and external hard disk to avoid further infection;
2. Copy the encrypted files to an empty storage device;
3. Use a clean computer and tool(s) above to decrypt the files;
4. The steps of using the decryption tool(s) can refer to the user manual of the tool.

To learn how to prevent ransomware infection, you can browse the following page:

https://www.hkcert.org/ransomware.hk/ransomware-basic.html

More information about ransomware can be found here:

https://www.hkcert.org/ransomware.hk/