Kaspersky CoinVault Decryptor is a free tool which may help victims of the CoinVault ransomware to decrypt their files.

For the program to work, you'll need both the Bitcoin wallet address where the malware is requesting payment, and the list of encrypted files. Once you've got those, use an antivirus engine to remove CoinVault (Kaspersky understandably recommends Kaspersky Internet Security, although you don't actually need to buy it - the trial version will do).

Once CoinVault has gone, enter the malware's Bitcoin address at If the program can decrypt your files then you'll see a list of keys and IVs (initialisation vectors). Save those locally.

Now you can download the decryptor and try a sample decryption: choose a file, enter the IV and key, click Start, and check the resulting file to make sure all is well.

If the file has been successfully decrypted, and Kaspersky's website only gave you a single IV/ key, then you can point the Decrypter at your file list, check the Overwrite option and click Start again. It should recover all your files.

If the first file hasn't been successfully decrypted, but the website gave you multiple keys/ IVs, then you can try another pair, repeating the process with other files.

If you need more help then Kaspersky has a Decryptor manual available here.

Verdict ratingsratingsratingsratingsratings

We don't know how many users Kaspersky CoinVault Decrypter will help, but if you've been infected, good luck finding your keys.