Infected with Osiris ransomware? Need to decrypt your files?

What is Osiris ransomware

Osiris is new crypto-virus, that belongs to Locky ransomware type. After finishing the process of encrypting files, malware adds .osiris extension and alters filenames. Your files get such names: [8_random_characters]-[4_random_characters]-[4_random_characters]-[8_random_characters]-[12_random_characters].osiris. Virus blackmails user to pay ransom of 2.5 BitCoins (~$1880) for file decryption. Osiris ransomware creates 3 files on users computers: OSIRIS.html, OSIRIS_[4_random_characters].html and OSIRIS.bmp and copies them to the folder with encrypted files. Those files contain instructions for users to pay the ransom on Bitcoin wallet. Image file is used as desktop background and also contains message with payment details. It is not recommended to pay the hackers, because payment is insecure and you put your credit card details at risk. We created this guide to help you remove Osiris ransomware decrypt .osiris files on Windows 10, 7, 8, Vista or XP.

Update: Use following service to identify the version and type of ransomware you were attacked by: ID Ransomware. Also check following website for possible decryptor: Emsisoft Decryptors.

osiris ransomware virus

files encrypted by osiris

How Osiris ransomware infected your PC

Osiris ransomware uses spam e-mail attachments to infect users computers. E-mails look like message from FedEx or DHL. It can be called “Receipt [random-number]”. Virus is hidden inside archives of xls, .tdb, .zk, .342, .343, .552 documents attached to such e-mails. Virus will run DLL files using system file Rundll32.exe. Once uses does it there is no way back because it will soon download small executable and will run it to encrypt files in user folders. Antiviruses have a small chance to catch Osiris ransomware virus as it is constantly modified. The only way to protect your computer from such threats is use antiviruses with crypto-protection like HitmanPro.Alert with CryptoGuard.

What to do if you are infected with Osiris ransomware virus?

First of all don’t panic. Follow these easy steps below.

1. Start your computer in Safe Mode with networking. To do that, restart your computer, before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the Osiris ransomware virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.

Recommended Solution:

Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to Osiris ransomware – files, folders, registry keys.


Download Norton*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.

Step 2: Remove following files and folders of Osiris ransomware:

Remove following registry entries:

no information

Remove following files:


How to decrypt files infected by Osiris ransomware (.osiris files)?

Use automated decryption tools

1. Osiris decryption tool from Kaspersky

kaspersky rakhni decryptor for .osiris ransomware

There is ransomware decryptor from Kaspersky that can decrypt .osiris files. It is free and may help you restore .osiris files encrypted by Vegclass Ransomware virus. Download it here:

Download Kaspersky RakhniDecryptor

1. Osiris decryption tool from Trend Micro

trendmicro Osiris ransomware decryptor

There is ransomware decryptor from Trend Micro that may decrypt .osiris files. It is free and may help you restore files encrypted by Osiris ransomware. Download it here:

Download Trend Micro Ransomware File Decryptor

There is currently no other automated decryption tool for Osiris ransomware files, but that doesn’t mean that you need to pay the ransom. We track the topic and will add any new decryption tool available in this part of the article. Now you can try to use manual methods to restore and decrypt .osiris files.

Decrypt .osiris files manually

Restore the system using System Restore

system restore

Although, latest versions of Osiris ransomware remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.

  1. Initiate the search for ‘system restore
  2. Click on the result
  3. Choose the date before the infection appearance
  4. Follow the on-screen instructions

Roll the files back to the previous version

Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged (in our case – encrypted by Osiris ransomware). This feature is available in Windows 7 and later versions.

windows previous versions

  1. Right-click the file and choose Properties
  2. Open the Previous Version tab
  3. Select the latest version and click Copy
  4. Click Restore

Restore .osiris files using shadow copies

shadow explorer gui

  1. Download and run Shadow Explorer.
  2. Select the drive and folder where your files are located and date that you want to restore them from.
  3. Right-click on folder you want to restore and select Export.
  4. Once the scanning process is done, click Recover to restore your files.

Protect your computer from ransomware

hitmanpro alert with cryptoguard

Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.

Download HitmanPro.Alert with CryptoGuard

Information provided by: Alexey Abalmasov


  1. How to decrypt files infected by Osiris ransomware (.osiris files)?
    Use automated decryption tools
    1. Osiris decryption tool from Kaspersky
    1. Osiris decryption tool from Trend Micr
    i want to decrypt the .osiris files but both kaspersky and microtrend are not supporting this files what do i wronge ?

  2. Merci pour ces tutoriels bien détaillés. Je trouve qu’il peut être supprimer à l’aide d’un antivirus alors que je pensais qu’il faut complètement de désinstaller.

  3. I am trying to decrypt the Osiris with Kaspersky but it doesn’t really work. What is the secret to use the Kaspersky decrypt tool

  4. is there any update to this thread? we’re infected with the .osiris ransomware.

    I see in the comments above that users are not having success with the decrypters-anything new, or words-of-advice?

  5. Yes, all Decryptors above doesn’t work on OSIRIS ransomware. very misleading. Hope they edit this article would be better to prevent more confused viewers.

Leave a Reply

Time limit is exhausted. Please reload CAPTCHA.