Troldesh ransomware has already been detected and identified by Russian researchers as a file-encrypting threat. As STF researchers enclosed earlier this year, Troldesh attacks the system and encrypts the user’s files, adding an .xtbl extension to them and even renaming them completely. In exchange for their decryption, cyber criminals are demanding a ransom fee. According to new security reports, the ransomware is still active and targeting users across the Internet.
Troldesh is now known as .xtbl ransomware and Ransom:Win32/Troldesh.A. Some users refer to it as ‘.xtbl virus’.
Unfortunately, if infected users do not have their files previously backed up, the chances to restore them are minimal.
Description of Ransom:Win32/Troldesh.A
Ransom:Win32/Troldesh.A or just Troldesh is most likely distributed through spam email messages or attachments. It appears that cyber crooks are relying on the users’ unawareness. Security researchers highlight the importance of classifying or filtering email messages, and never opening the ones that seem suspicious. For the sake of security, emails sent by unknown email addresses are not to be trusted. Instead, they should be deleted permanently and immediately.
After the ‘.xtbl virus’ is executed after opening a corrupted email message, files on the system will be encrypted and the .xtbl extension will be added to them. Typically for ransomware, after the encryption has been done, the victim is left with a ransom message. Moreover, the user is being redirected to a ‘readme’ text for further information.
The requested amount of money may vary from 118 euros to 200. Supposedly, after the fee is paid, a unique key is sent to the target so that they can safely restore their files. According to some researchers, if present on the PC, Shadow Copies may be used to restore the data without paying the ransom.
Removal of Ransom:Win32/Troldesh.A
Security specialists usually don’t recommend paying the fee (unless the files are very important), since it doesn’t necessarily mean they will be put back to normal.
If your system does have Shadow Copies, the following removal manual can be followed. In future, always remember to store crucial information on an external device. This is the best measure against ransomware.
Stage One: Remove Ransom:Win32/Troldesh.A
1. First and most important – download and install a legitimate and trustworthy anti-malware scanner, which will help you run a full system scan and eliminate all threats. 
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
2. Run a second scan to make sure that there are no malicious software programs running on your PC. For that purpose, it’s recommended to download ESET Online Scanner.
Your PC should be clean now.
Stage Two: Restore the Encrypted Files
Option 1: Best case scenario – You have backed up your data on a regular basis, and now you can use the most recent backup to restore your files.
Option 2: Try to decrypt your files with the help of Kaspersky’s RectorDecryptor.exe and RakhniDecryptor.exe. They might help you in the process but keep in mind that they were not specially designed to encrypt information that was decrypted by this particular ransomware.
Option 3: Shadow Volume Copies
1. Install the Shadow Explorer, which is available with Windows Vista, Windows 7, Windows 8 and Windows XP Service Pack 2.
2. From Shadow Explorer’s drop down menu choose a drive and the latest date you would like to restore information from.
3. Right-click on a random encrypted file or folder then select “Export”. Select a location to restore the content of the selected file or folder.
Remove Ransom:Win32/Troldesh.A Automatically with Spy Hunter Malware – Removal Tool.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
