Emsisoft Decryptor for Zorab helps neutralize the Zorab strain of ransomware that pretends to be a decryption tool but will instead re-encrypt your files.

Zorab is a nasty little piece of ransomware for unknowing victims that think they are utilizing an actual decryptor. It uses AES-256, and adds the extension ".ZRB" to the ransomed files.

The ransom note titled --DECRYPT--ZORAB.txt will contain the following text:



As with most of their other decryptors, Emsisoft Decryptor for Zorab pre-populates the locations to decrypt with the currently connected drives and network drives. Additional locations can be added via the Add button.

Emsisoft Decryptor for Zorab requires access to a file pair consisting of one encrypted file and the original, unencrypted version of the encrypted file to reconstruct the encryption keys needed to decrypt the rest of your data. Do not change the file names of the original and encrypted files. This fact is because the decryptor may perform file name comparisons to determine the correct file extension used for encrypted files on your system.

Run the RedRum decryptor, and select your file pair. Then click the Start button. The decryptor will start to reconstruct the required encryption parameters. Depending on the ransomware and your computer, this process can take a significant amount of time.

Emsisoft Decryptor for Zorab will inform you that the decryption process is complete. If you require a report for your records, you can save it by clicking the Save Log button. You also have the option to copy it straight to your clipboard for use in emails, forum posts, etc., if needed.

Similar:

Which Anti-Malware App Is Best and Can It Run Alongside My Antivirus

What's the Best Antivirus and Is Windows Defender Good Enough?

Windows Device Performance & Health Explained

How to Tell the Difference Between a Virus and a False Positive

How to Manage Windows Defender Antivirus Found Threats

What to Do When Your Norton or McAfee Antivirus Expire