Ransomware Remove & File Restore

[liakos]

Hi,

Is there anyone who know how to remove ransomeware and restore my files back to normal cuz all got .locky extension in the end. Ive tried Spyhunter, Malwarebytes but couldnt restore file back to normal extensions like .doc .ppt etc.

Any ideas?

 

[mrmez]

AFAIK, unless you can break their encryption, you pay up or lose your data.
Pretty sure they use strong enough encryption to make it practically impossible for anybody.
Sorry dude.

 

[Rabmac]

There may be a chance to get files back but it depends on what you have been infected with.

This article explains how to rescue files that have been encrypted by Cryptolocker: http/www.makeuseof.com/tag/cryptolocker-dead-heres-can-get-files-back/

Obviously this advice is of little to no help right now but it is always a good idea to have your important files backed up on a separate device or two.

 

[Saga Lout]

Long shot - press the Windows key and R together then type on
services.msc
and hit Enter. Is the Service named "Volume Shadow Copy" Manual or Automatic? If it's automatic, you may have a system backup of all your files which are probably unaffected because the extortionists aren't smart enough to trawl the system for copies. If Manual, sorry - no joy but I have to disagree slightly with mrmez - there's no guarantee and, in fact, little chance of actually getting a decryption key from them even if you pay.

Long shot #2 - did you check to see if they deleted all your System Restore points? If not, try going back a day or two.

If you do contact them, make sure you also use The Onion Router because once they have your IP address they don't even need to rely on someone opening a tempting looking e-mail.

 

[LukeFatwalker]

Their encryption is some of the hardest to unlock. You could pay the ransom. The good news there is that they will almost always release your files (if that helps...)

If I were you, I'd just re-format the computer and be done with it. If you don't already, you may want to look at a program like Rollback Rx or Comodo Time Machine. Programs like these won't help you right now, but they are important tools for any Malware, Ransomware, Cryptolocker, and Virus recovery.

 

[Saga Lout]

There ar far more stories onthe Net about folks who paid and never saw an unlocking key thamn there are from people who got their files back.

OK so healthy folks don't go to Hosdpital to say how well they feel so they may not have posted a successful recovery but what's in it for the crook to let you off the hook when he's already had your money? I'm dealing with one now where the blackmailed/extortionist can't decide whether he wants half a bitcoin or three whole ones.

I haven't told him yet that he's not getting either but when he settles on a figure, I'll tell him which part of Russia to * off back to.

 

[mrmez]

Do you feel more important if you write in blue?

 

[Saga Lout]

No but my failing eyesight can see my typos so I can edit them out. Strange - you're only the third person to comment on that in seventeen years of writing in Internet fora.

 

[tman1]

Once they ransomware is gone, you can try to restore your files to earlier versions as long as volume shadow copy is enabled.