If your system has been breached by malware of the Trojan-Ransom.MSIL.CoinVault family, the files on your computer will be encrypted. A notification will also appear on the screen demanding money in exchange for decrypting the files.
To remove the malware and decrypt the files:
- Scan your computer with a Kaspersky application. See the instructions below.
- Download the Kaspersky CoinVaultDecryptor tool and use it to restore your files. See the instructions below.
To learn more about the protection technologies used by Kaspersky, see the TechnoWiki page.
How to scan your computer with a Kaspersky application
- Download the installer for one of the following applications from the Kaspersky website:
- Install the application. See the instructions in the articles below:
- Update the anti-malware databases. See the instructions on the following Online Help pages:
- Run a Full Scan task and delete the detected malware. See the instructions on the following Online Help pages:
How to restore encrypted files with the Kaspersky CoinVaultDecryptor tool
The CoinVaultDecryptor tool restores the encrypted files in two ways:
- From the filelist.cvlst file. The Trojan-Ransom.MSIL.CoinVault malware creates the filelist.cvlst file on the computer. This file contains the list of encrypted files. Usually, the file is located in the temporary folder (TEMP) or in the root folder of disk С. If you search for the filelist.cvlst manually, enable the displaying of hidden files and folders. See this article for instructions.
- From the folder with the encrypted files. If you cannot find the filelist.cvlst file, create a new folder and copy the encrypted files to it.
How to restore encrypted files from the filelist.cvlst file
- Run the CoinVaultDecryptor.exe file.
- Click Start scan.
- Specify the path to the filelist.cvlst file and click Open.
- Wait until the files are found and decrypted.
The files will be restored.
To view information about the scan task, click details.
How to restore encrypted files from the folder
- Run the CoinVaultDecryptor.exe file.
- Click Change parameters.
- In the Objects to scan section, select the Folder with encrypted files checkbox and click OK.
- Click Start scan.
- Click Continue.
- Specify the folder in which you saved the encrypted files and click OK.
- Wait until the files are found and decrypted.
The files will be restored.
To view information about the scan task, click details.
How to save restored files with their original names
The Kaspersky CoinVaultDecryptor tool saves decrypted files in the format DECRYPTEDKLR. To save decrypted files with their original names:
- In the main window of the tool, click Change parameters.
- In the Additional options section, select the Replace encrypted files with decrypted ones checkbox and click OK.
The restored files will be saved with their original names.
Source : Official Kaspersky Brand
Editor by : BEST Antivirus KBS Team