How to recover
Files Encrypted by Arena Ransomware
from Windows

I got infected with a strange virus, most likely ransomware. All my files now have .arena file extensions. Any ideas how to get access to the data and delete this virus? Thanks in advance.

Files with .arena extension may indicate that either of the new versions of CryptoMix, which is called CryproMix Arena, or Dharma variant, which tends to append the same extension, has occupied the PC.

Though both of them are ransomware viruses, the removal and data recovery procedures slightly differ. First, you need to identify which crypto-malware[ref en-1] you are dealing with.

Take a closer look to the encrypted data. If the original file names have been changed to a numeric code with the .arena at the end, then, CryptoMix Arena ransomware has infiltrated the system. You will also see its _HELP_INSTRUCTION.txt file which suggests further actions. The GUI[ref en-2] presents [email protected] email address for contact information.

Unfortunately, the peculiarities of the malware permit it to function successfully offline. Though virus developers try to outwit IT experts by releasing more destructive versions, it is likely that this free decrypter might be of benefit to you.

If files contain .id-[id].[email].arena file extension, then, you are likely dealing with Dharma Arena ransomware version. You can also identify it by the email addresses: [email protected]p and [email protected]. Unfortunately, this version deletes volume shadow copies[ref en-3] – one of the few ways to decode files for free.

However, sooner or later the decrypter key will be created as a few months ago the master keys for Crysis/Dharma ransomware were released. Now, let us discuss file recovery options.

You should proceed to this procedure only after you eliminate the malware. Reboot the system in Safe Mode and eliminate the malware with [d1]. MalwareBytes Anti-Malware might be of assistance as well.

Option 1. Use an Official Decrypter

Naturally, if ransomware has corrupted your files, you might be looking desperately for a way to retrieve the files. Let us remind you not to get tempted to purchase CryptoMix Arena or Crysis Arena decryption tools offered by the perpetrators as the software may only make matters worse.

They might create more system vulnerabilities for a future hijack. In the case of CryptoMix, you can use the official decryption tool.

Option 2. Restore Data from Backups

It is by far the most viable method of data recovery. Create additional copies and keep them in different places. Since Crysis version deletes shadow volume copies, having cloud-based copies might be one of the few solutions when dealing with ransomware.

Option 3. Make Use of Data Recovery Pro

This is the tool created for recovering data if it was damaged due to a system error. However, if you have run out of options, try the files affected by Arena ransomware with the software.

1. Download [rev id=”Data Recovery Pro”].
2. Install the application using guidelines provided in the installation wizard.
3. Launch it and perform a system scan with it. The program will detect the encrypted data and attempt to recover it.

Method 4. Restore Files with Shadow Explorer Software

1. Download the tool and run ShadowExplorer installation wizard.
2. Open the program and click the button in the top left corner to extend a drop down menu. Select the disk with encoded files and then choose a folder that you want to recover.
3. Select Export. Specify the destination to export the restored files.