"Avira Ransom File Unlocker" is a tool written in .NET 2.0 to decrypt
files encrypted by a ransom malware claiming the files have been
encrypted with a 2048 PGP key. In fact it's RC4, so with a given
original file (from a backup or any other source like a digital camera
or a music player) to an encrypted file, it is possible to decrypt all
files. The tool will not change or delete the encrypted files, to avoid
data loss in case the decryption didn't work probably due to a new
variant of the malware.

The tool tries to derive the key from some files commonly found in the
encrypted directories.
If no key is found automatically, the user has to choose an encrypted
file from the HDD disk and the original version of this file from the
HDD or from another source. It's absolutely necessary that the original
version is an exact copy of the encrypted file before the user was
infected, otherwise the tool won't work correctly.

After that the user has to choose an encrypted file or a directory with
encrypted files he wants to decrypt. To be on the safe side, you should
work on a copy of the locked directories. If unlocking fails, it will be
much easier to get rid of the incorrectly decrypted files.

Be aware, that if the computer was rebooted during infection, the files
may have been encrypted with different keys.
