Panda Ransomware Decrypt Tool – Restore Encrypted Files


Panda Ransomware Decrypt Tool is a small, and freeware software that allows you to restore files that were renamed or encrypted on your client’s computer due to a virus infection.

Here’s the scenario; you have already removed a virus from your client’s computer, but some of the files that were affected can no longer be opened or accessed. Panda Ransomware Decrypt Tool allows you to restore and decrypt these files so they can be used.

Removing a virus from a client’s computer is almost never an easy or clean process, and sometimes, even after you have removed the threat, some of your client’s files may have been renamed or encrypted, preventing them from being used.
This renaming most commonly affects .exe, .doc, and .pdf files, but can happen to any file type. An example would be a Word document that would change from “Document1.doc” to “locked-Document1.doc.xxxx” where “xxxx” could represent any random string of characters.

Panda Ransomware Decrypt Tool has been specially designed to decrypt files that were altered because of a malware and/or ransomware infection. It will not be able to restore any other type of encrypted file. Panda’s technicians are available to help in the event of an error or if decryption fails. As always, a backup of all files you attempt to restore and decrypt should be kept in the event something happens.

The interface of Panda Ransomware Decrypt Tool is fairly simple. After downloading and running the executable, click the “Select Folder” option to select a folder or drive, then click “Start.” This process usually takes between one to five minutes. If normal mode is unable to restore and decrypt the files, try using advanced mode. Advanced mode requires you to locate the original version of at least one of the encrypted files before it was renamed.

Viruses, and Ransomware can be very difficult to deal with and remove. Hopefully, this tool will make it a little bit easier to help get your client back up and running. Have you used Panda Ransomware Decrypt Tool in the past? Do you know of any other alternatives? Please share your experiences in the comments below.

Screenshots: Panda-RDT-1


Download from Official Site – 2.8mb

About the Author

Husayn Jamal
More articles by me...
Husayn Jamal is a Canadian computer technician and is the creator and owner of the MyITtech YouTube Channel. In 2009, he opened a local computer support business at age 10 and continues operating it to this day. He is an honours student and will be entering the International Baccalaureate High School Program in 2013.

Comments (10)

  • Brian M says:

    This tool looks great, but unfortunatley, it will not work for the CryptoLocker virus. We will still need to use Shadow Copies and backups to restore those files.

  • Adewale says:

    It’s a great tool.I will try it.

  • Scott says:

    Maybe I’m missing something here…

    “Advanced mode requires you to locate the original version of at least one of the encrypted files before it was renamed.”

    If I have the original version of the file, why would I need the decrypt tool?

    • Galen says:

      Scott, that’s exactly what I was thinking. My only guess is that if you could find an original perhaps a duplicate on a flash drive, that you could use it to create a decrypt key for the rest. The odds of your average consumer having such a file are likely under 10% imo, but if successful at least you could make that percentage happy.

    • Phil says:

      It’s probably using Known Plaintext Attack ( ) for most modern encryption schemes this doesn’t work anyway. Although most malware attacks are looking for a quick and dirty way to lock you out of the files so this might actually work in some cases. I’ve never encountered malware that encrypts the user’s files though, so maybe I’ve just been lucky.

    • Scott says:

      That’s exactly what I thought as well. Does having the original version allow you to decrypt the encrypted file, or does it just restore the original back to the new one? Will you lose the changes that have been made to the original that are now part of the encrypted one?

      • Robert says:

        If you did happen to find an “original file” to compare the encrypted one and used the advanced option in Pandaransom it still wouldn’t give you the correct key. The virus uses 2 different keys, one to encrypt and one to decrypt. There is no way to get the decryption key without paying them.

    • Chris says:

      If you have a partial backup lets say and have one original file. I did this though and it will not work for the crypto virus.

  • TechAddict says:

    I must say that I agree with Scott; if I already have the original files, why would I want go through all of this ?!!

  • Loser says:

    Paying the ransom definitely works for CryptoLocker. It’s the only thing that works for CryptoLocker if you don’t have proper backups.