{"id":8363,"date":"2015-04-14T10:00:14","date_gmt":"2015-04-14T14:00:14","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=8363"},"modified":"2019-11-15T23:00:36","modified_gmt":"2019-11-15T12:00:36","slug":"coinvault-ransomware-removal-instruction","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/coinvault-ransomware-removal-instruction\/8363\/","title":{"rendered":"How to remove CoinVault ransomware and restore your files"},"content":{"rendered":"

In most cases, if you are a victim of ransomware, there\u2019s nothing you can do. Luckily, from time to time police and cybersecurity companies take down command and control servers of ransomware and retrieve information from them. This information is really useful, because it helps to create decryption tools and to recover users\u2019 files. Recently, Dutch cyber-police and Kaspersky Lab created such a solution for CoinVault victims.<\/p>\n

If you want to know more about CoinVault itself, you can read our detailed report at Securelist<\/a>. If you are interested in exactly how we created a decryption solution, we covered it in a very detailed\u00a0\u00a0blog post<\/a>. If you are looking for instruction on how to get rid of this ransomware and restore your files, then keep reading below.<\/p>\n

Step 1: Are you infected with CoinVault?<\/h3>\n

First, make sure your files are stolen by CoinVault and not by another ransomware. It\u2019s fairly easy to determine: If you are infected with CoinVault, you will see an image like below:<\/p>\n

\"How<\/a><\/p>\n

Step 2: Get the Bitcoin wallet address<\/h3>\n

In the bottom right of CoinVault you will see the Bitcoin wallet address (it\u2019s marked with a black circle\u00a0on the image above). It\u2019s very important for you to copy and save this address!<\/p>\n

Step 3: Get the encrypted file list<\/h3>\n

In the top left corner of the malware window you will see a \u2018View encrypted filelist\u2019 button (it\u2019s marked with blue circle\u00a0on the image above). Click this button and save the output to a file.<\/p>\n

Step 4: Remove CoinVault<\/h3>\n

Go to https:\/\/kas.pr\/kismd-cvault<\/a> and download the trial version of Kaspersky Internet Security. Install it and it will remove CoinVault from your system. Be sure to save all information retrieved in steps 2 and 3.<\/p>\n

Step 5: Check https:\/\/noransom.kaspersky.com<\/a><\/h3>\n

At https:\/\/noransom.kaspersky.com<\/a> you should enter the Bitcoin wallet address from step 2. If your Bitcoin wallet address is known, the IV and Key will appear on the screen. Please note that multiple keys and IVs may appear. In this case save all the keys and IVs to your computer, you will need them later.<\/p>\n

\"How<\/a><\/p>\n

Step 6: Download the decryption tool<\/h3>\n

Download the decryption tool at https:\/\/noransom.kaspersky.com<\/a> and run it on your computer. If you get an error message, as shown below, go to step 7. If not, skip step 7 and proceed to step 8.<\/p>\n

\"How<\/a><\/p>\n

Step 7: Download and install additional libraries<\/h3>\n

Go to http:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=40779<\/a> and follow the instructions on the website. Then install the software.<\/p>\n

Step 8: Start the decryption tool<\/h3>\n

Start the tool and you will see a screen like\u00a0below:<\/p>\n

\"How<\/a><\/p>\n

Step 9: Test if\u00a0the decryption works properly<\/h3>\n

When running the tool for the first time, we strongly advise you to do a test decryption. Do the following:<\/p>\n