Infected with Osiris ransomware? Need to decrypt your files?

What is Osiris ransomware

Osiris is new crypto-virus, that belongs to Locky ransomware type. After finishing the process of encrypting files, malware adds .osiris extension and alters filenames. Your files get such names: [8_random_characters]-[4_random_characters]-[4_random_characters]-[8_random_characters]-[12_random_characters].osiris. Virus blackmails user to pay ransom of 2.5 BitCoins (~$1880) for file decryption. Osiris ransomware creates 3 files on users computers: OSIRIS.html, OSIRIS_[4_random_characters].html and OSIRIS.bmp and copies them to the folder with encrypted files. Those files contain instructions for users to pay the ransom on Bitcoin wallet. Image file is used as desktop background and also contains message with payment details. It is not recommended to pay the hackers, because payment is insecure and you put your credit card details at risk. We created this guide to help you remove Osiris ransomware decrypt .osiris files on Windows 10, 7, 8, Vista or XP.

Update: Use following service to identify the version and type of ransomware you were attacked by: ID Ransomware. Also check following website for possible decryptor: Emsisoft Decryptors.

How Osiris ransomware infected your PC

Osiris ransomware uses spam e-mail attachments to infect users computers. E-mails look like message from FedEx or DHL. It can be called “Receipt [random-number]”. Virus is hidden inside archives of xls, .tdb, .zk, .342, .343, .552 documents attached to such e-mails. Virus will run DLL files using system file Rundll32.exe. Once uses does it there is no way back because it will soon download small executable and will run it to encrypt files in user folders. Antiviruses have a small chance to catch Osiris ransomware virus as it is constantly modified. The only way to protect your computer from such threats is use antiviruses with crypto-protection like HitmanPro.Alert with CryptoGuard.

What to do if you are infected with Osiris ransomware virus?

First of all don’t panic. Follow these easy steps below.

1. Start your computer in Safe Mode with networking. To do that, restart your computer, before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the Osiris ransomware virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.

Recommended Solution:

Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to Osiris ransomware – files, folders, registry keys.

 

Download Norton*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.

Step 2: Remove following files and folders of Osiris ransomware:

Remove following registry entries:

no information

Remove following files:

OSIRIS.html
OSIRIS_[4_random_characters].html
OSIRIS.bmp


How to decrypt files infected by Osiris ransomware (.osiris files)?

Use automated decryption tools

1. Osiris decryption tool from Kaspersky

There is ransomware decryptor from Kaspersky that can decrypt .osiris files. It is free and may help you restore .osiris files encrypted by Vegclass Ransomware virus. Download it here:

Download Kaspersky RakhniDecryptor

1. Osiris decryption tool from Trend Micro

There is ransomware decryptor from Trend Micro that may decrypt .osiris files. It is free and may help you restore files encrypted by Osiris ransomware. Download it here:

Download Trend Micro Ransomware File Decryptor

There is currently no other automated decryption tool for Osiris ransomware files, but that doesn’t mean that you need to pay the ransom. We track the topic and will add any new decryption tool available in this part of the article. Now you can try to use manual methods to restore and decrypt .osiris files.

Decrypt .osiris files manually

Restore the system using System Restore

Although, latest versions of Osiris ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.

1. Initiate the search for ‘system restore‘
2. Click on the result
3. Choose the date before the infection appearance
4. Follow the on-screen instructions

Roll the files back to the previous version

Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – encrypted by Osiris ransomware). This feature is available in Windows 7 and later versions.

1. Right-click the file and choose Properties
2. Open the Previous Version tab
3. Select the latest version and click Copy
4. Click Restore

Restore .osiris files using shadow copies

1. Download and run Shadow Explorer.
2. Select the drive and folder where your files are located and date that you want to restore them from.
3. Right-click on folder you want to restore and select Export.
4. Once the scanning process is done, click Recover to restore your files.

Protect your computer from ransomware

Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.

Download HitmanPro.Alert with CryptoGuard

Information provided by: Alexey Abalmasov