What's New

October 18, 2017

New version available ! Includes all latest RansomWare variations.
Also includes a fix for handling .rar and .7z attachments.

Download Freeware 
Ver. 2017/Oct/18

When you get this pop up window in your Outlook, please click the "Yes" button to start the update.

Click the "OK" button to download files from our web site.
If your Outllook does not automatically exit, please close it yourself.


Start the setup process to update RansomSaver.


September 25, 2017

ISO files are images of CD or DVDs. See below for an example of RansomWare hidden as an ISO image.

iso ransomware 


September 20, 2017

.Rev files are RAR recovery files and can be opened by WinRar. When you do reconstruct the file, a new .rar file contains a ransomware. 

new ransom revision part 1

new ransom revision part 2


August 15, 2017

New way to pass ransomware via 7-Zip archives. It even states that it's virus free !
7-Zip is a legit free open source compression application.



July 10, 2017

We came across with a new extension that carries Ransomware: .xz
It's a compressed file similar to .zip and .rar and can be opened by 7zip
However our WinZip and WinRar versions were not able to open it.

This is how it looks like:



February 7, 2017

Ace compressed files were popular around 2000. They can still be opened my modern decompress software. Inside this file there is an executable file
ready to encrypt your files and ask for ransom. Don't open it. Our software will safely move this email under 'RansomSaver' folder in 'Deleted Items'.



January 18, 2017

New free application added: ShadowReport.
Automate collection of Shadow Copies info and receive a detailed report via email to your mailbox.
Enable Shadow Copy and add an extra layer of recovery against Ransomware.


Find more here:


January 3, 2017

Here are some interesting statistics. It looks like criminals are enjoying holiday vacations...


Check the counter of malware found by RansomSaver after December 23rd.


December 20, 2016

A new version is under way.

New suspicious attachment ( .dzip ) found and removed by RansomSaver:

Dzip Ransomware

We are not sure if most users will be able to open it and get infected, but we believe it's better to be safe than sorry.

Two new types of Microsoft Office Ransomware found and removed.
If you try to save the attachments on your hard disk, Kaspersky blocks them as : Trojan Downloader Agent.

Word and Excel new versions

Word and Excel new versions2