File extensions .better_call_saul;.breaking bad;.heisenberg;.xtbl;.ytbl are just some of the expansions associated with the nasty Shade ransomware virus. There have been many variants ever since one of the first CrySiS variant has appeared, and many have the reason to believe that all variants associated with this virus have been created by the very same hacking team for one thing – profit. Malware researchers continue to discover even newer variants of the virus, all with different modifications distinguishable to them. The good news is that Kaspersky malware researchers have successfully created ransomware decryptor for the Share ransomware which should be able to recover files encoded by this virus successfully. This is where we have decided to create instructions on how to use Kaspersky’s Shade Decryptor and hopefully decrypt your files in case they have been encoded by this crypto virus.
Shade Ransomware – A Bit Of Background
The Shade also known as Troldesh Ransomware is a virus that has been first detected in September 2015. Back then, the virus used the discontinued now Nuclear Exploit Kit to infect users on a massive scale. Nuclear EK is now dead, but Shade is long from being that. Many new variants of this virus have now appeared, and they use new techniques, like modified EK and even brute forcing to infect your computer. Here are some of the viruses related to Shade:
- [email protected] Ransomware
- Malevich Ransomware
- Fantom Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- [email protected] Ransomware
- Centurion_Legion Ransomware
- Better_Call_Saul Ransomware.
- Da_Vinci_Code Ransomware.
- Veracrypt Ransomware.
- DrugVokrug727 Ransowmare.
- Grand_car Ransomware.
- Meldonii Ransomware.
- Makdonalds Ransomware.
- SystemDown Ransomware.
- Radxlove7 Ransomware.
- [email protected]
- [email protected] Ransomware.
These many viruses may be very different, but there are several symptoms like the encryption used, the files created by them and some folders they are dropped in, that unify them, driving researchers into believing that they are all Trolldesh / Shade ransomware variants. Luckily Kaspersky has released a decryptor for those viruses and victims by them may be in luck.
Shade Ransomware – Removal and Decryption Instructions
Phase 1 – Removal
Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Shae ransomware virus before starting the decryption process.
The kaspersky Shade decryptor does not work. It even cannot identify that the file is encrypted.
Hello, Manish, it is very unfortunate that it does not work for you. Since your variant may be diferent than the conventional Shade viruses, I urge you to try EmsiSoft’s decrypter:
https://decrypter.emsisoft.com/globe
Get back to us with your experience!