Shade Ransomware Decryption Tool

Ransomware-type viruses usually encrypt files on the infected computer, asking for payment to be made in exchange for the unlock key. They also threaten to delete the locked files once the ransom deadline passes, and changes the desktop background into a warning message. In particular, the updated versions of the Shade ransomware are said to allow backdoor access to the PC without the user's consent, and deploy malicious files and Trojans to the target workstation to steal private data, display unwanted ads and break user passwords.

A decryption tool for the Shade ransomware

Part of the now widely known “No More Ransom” anti-malware campaign, the Shade Ransomware Decryption Tool is one of the proofs that security companies can collaborate to create anti-ransomware tools that can unlock infected computers.
The Shade Ransomware Decryption Tool attempts to decrypt data affected by the malevolent Shade ransomware, allowing users to regain access to their compromised files and applications. Please note that this decryption tool cannot replace a fully-featured antivirus solution that could prevent infections, rather than try to remove them.

A way to counteract the Trojan-Ransom.Win32.Shade ransomware

The Shade Ransomware Decryption Tool does not have a regular interface, as it can only be launched via the console. If you want to read usage instructions, you must enter the '--help' command.
To use it, you must first make sure you know the user ID that was assigned to your computer by the Shade ransomware. Usually, this 20-character string can be found in the ransom note (a text file on the desktop, in most cases). Once you have it, supply user ID as an argument (shadedecrypt.exe -u [User ID]).
A link to the private decryption key is displayed. You must download the generated key file to your computer and save it in the same location as shadedecrypt.exe. The key is used as an argument in a new command, alongside the location of the file to decrypt, which usually ends with a '.xtbl' extension.
The file contents and its original name are to be restored by the application. If the file name is not successfully decrypted, the output is a new file having '.decrypted' as its extension.

Try to regain control of your Shade-infected files

Prevention is the best way to protect yourself and your data against all types of malware. However, if you opened an unwanted email or got infected by any other means with the Shade ransomware, a decryption tool is what you need.
If you are dealing with the Shade ransomware and find all your files ending with the 'xtbl' extension, an application such as Shade Ransomware Decryption Tool is definitely worth trying. And although decryption might not always work, until this ransomware family is completely taken down, the hope of all victims lies in such decryption tools created by reputable security companies.