Decrypt Files Encrypted by Shade .Xtbl Ransomware - How to, Technology and PC Security Forum |

Decrypt Files Encrypted by Shade .Xtbl Ransomware


with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by Shade Ransomware and other threats.
Threats such as Shade Ransomware may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

ransomware-encryption-explained-stockhoto-stforumFile extensions .better_call_saul;.breaking bad;.heisenberg;.xtbl;.ytbl are just some of the expansions associated with the nasty Shade ransomware virus. There have been many variants ever since one of the first CrySiS variant has appeared, and many have the reason to believe that all variants associated with this virus have been created by the very same hacking team for one thing – profit. Malware researchers continue to discover even newer variants of the virus, all with different modifications distinguishable to them. The good news is that Kaspersky malware researchers have successfully created ransomware decryptor for the Share ransomware which should be able to recover files encoded by this virus successfully. This is where we have decided to create instructions on how to use Kaspersky’s Shade Decryptor and hopefully decrypt your files in case they have been encoded by this crypto virus.

Shade Ransomware – A Bit Of Background

The Shade also known as Troldesh Ransomware is a virus that has been first detected in September 2015. Back then, the virus used the discontinued now Nuclear Exploit Kit to infect users on a massive scale. Nuclear EK is now dead, but Shade is long from being that. Many new variants of this virus have now appeared, and they use new techniques, like modified EK and even brute forcing to infect your computer. Here are some of the viruses related to Shade:

These many viruses may be very different, but there are several symptoms like the encryption used, the files created by them and some folders they are dropped in, that unify them, driving researchers into believing that they are all Trolldesh / Shade ransomware variants. Luckily Kaspersky has released a decryptor for those viruses and victims by them may be in luck.

Shade Ransomware – Removal and Decryption Instructions

Phase 1 – Removal

Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Shae ransomware virus before starting the decryption process.


  1. Manish Singh

    The kaspersky Shade decryptor does not work. It even cannot identify that the file is encrypted.

    1. Vencislav Krustev

      Hello, Manish, it is very unfortunate that it does not work for you. Since your variant may be diferent than the conventional Shade viruses, I urge you to try EmsiSoft’s decrypter:

      Get back to us with your experience!


Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share