Emsisoft Decryptor for Zorab

The cyber world was threatened in the fall of 2019 by the STOP Trojan so Emsisoft’s security experts hurried to release a decryptor for it, which worked in more than 70% of the cases. Unfortunately, the masterminds behind the STOP ransomware developed a fake copy of Emsisoft’s utility, fooling victims of STOP into thinking they can get unlock their files without too much trouble. Instead, the fake decryptor deploys the Zorab ransomware, which uses the AES-256 algorithm to encrypt the files a second time. In other words, victims of STOP who fall for this scam also become the victims of Zorab.

The fake decryptor that triggers the Zorab ransomware requests the user to enter its data and press “Start Scan”. In that moment, an executable file is placed inside the “Temp” folder and Zorab starts taking action by encrypting files on the computer and appending them the “ZRB” extension. Finally, the only file that is left untouched is the ransom note.

Emsisoft’s response was to develop a new decryption tool for Zorab and advise those whose computers are infected to run scans on both decryption tools. However, since the STOP decryptor only works for some older variants of STOP, victims might still need to pay up to get a decryption key and get their data back in full.

The Emsisoft Decryptor for Zorab features a user-friendly interface that hosts a list of all the locations to analyze. Users can easily add new paths, alongside the connected drives, which are automatically inserted in the list.

Emsisoft Decryptor for Zorab looks for files that have been encrypted by Zorab and tries to get them back. After users run it, they must switch to the Emsisoft Decryptor for STOP to go further and try to get their original data back.

As cyber criminals continue to create variants of ransomware infections, the utility does not offer any guarantees. It is recommended that you also preserve the encrypted files on the local PC and not remove them, as suggested in the Options tab.

To avoid being infected by the Zorab ransomware, please download decryption tools and any other software only from authorized and trustworthy sources, such as official websites or our download library here, at Softpedia.