what is Trend Micro suggestion for users infected with ransomware ?

Hi Amir,

We have a free tool to attempt to decrypt files encrypted by some ransomware families. Information about this tool can be found here.

Or try to manually restore encrypted files as instructed here.

If that doesn't work, you can download our Ransomware Collector at the bottom of this page. Contact and submit it to Support Team for analysis.

^erza

Hi @Amir,

Thank you for your post and welcome to the community!

For computers infected with ransomware, we have a free decryptor tool available that you can make use of. Please take note that our decryptor tool can support only a limited number of ransomware files, but we update this daily to protect you against ransomware. 

For more details, you may refer to the link below to take advantage of our Ransomware File Decryptor Tool:

Downloading and Using the Trend Micro Ransomware File Decryptor

Ransomware usually comes in the form of an email that may seem legit. The sender attaches a ZIP file that, once uncompressed, the ransomware starts encrypting files and deletes itself to erase any traces of the original file. We do advise that you be careful of the emails you open and reply to, and make sure that you are familiar with the sender before opening any attached files that are sent with the email. We also advise that you update your operating system to a later version, since ransomware usually looks for vulnerabilities in operating systems to infect it.

If you have any other inquiries, please don't hesitate to contact us again and we will be glad to assist you.

Have a great day!

Trend Micro Home User Community

Thank you so much @TM_Nicole and @erza 

i need know " Trend Micro Ransomware File Decryptor " can clean system and then recovery files from external backup drive or cloud storage ?

or users must use clean scanner same housecall or ATTK ?

Regards ,

Amir

Hi Amir,

File Decryptor Tool can only restore locally stored files including local copies of installed cloud storage clients.

To clean the system, yes, you need to run scan of Trend Micro Security and/or ATTK, that will do the job (except for ransomware notes which needs to be manually removed).

^erza

Thank you Dear @ezra 

This means after use ATTK , must remove manualy Ransomware files & registery keys  and ATTK or Housecall and not repair or correct registery and remove ransomware files ?

Regards ,

Amir

Hi Amir,

ATTK should be able to remove/repair registry keys. Only ransomware notes have to be manually removed, these are .txt/.html/etc left in folders where a file was encrypted.

^erza