How to restore files after infected by cryptolocker?

March 12, 2016 at 10:22:28
Specs: Windows 7, AMD Turion 2.4GHz/4GB RAM
I once before got infected by a similar ransomeware and luckily caught it in time and was able to restore files from a shadow copy/previous version. After infected the first time I took the steps to protect myself from such an attack again using the Crypto Prevent tool, but unfortunately I was recently infected once again regardless of using that tool. I do not have a backup of files and this time I am unable to restore from the shadow copy as I think the virus deleted it. I have no option to do a system restore (no restore points) and right clicking a file - Previous version state no pervious versions available.

Being somewhat familiar with this virus/ransomware I know chances of restoring files are slim. But thinking outside the box, the shadow copy was deleted by the virus, so is there a way to just recover that deletion with a program like Recuva or similar. Then, if able to recover that, then maybe I still have a chance to recover files from that shadow copy. The problem is, I know how to recover files with Recuva, but not a shadow copy. Is it opssible to recover that and how would I go about doing so?

Thanks for any help

See More: How to restore files after infected by cryptolocker?

Report •

March 12, 2016 at 10:47:23

Report •

March 12, 2016 at 14:45:23
Just for info, it seems the reason CryptoPrevent does not necessarily protect you is that there are so many variants. Severe settings, which might stop it, place too much restriction on the user. I think the program has some merit by protecting certain areas but it is touch and go in terms of CryptoLocker versions.

Always pop back and let us know the outcome - thanks

Report •

March 12, 2016 at 20:55:10
For the future, a complete drive image on a non connected hard drive (internal or external) is the best protection. Occasionally updating it and keeping a regular back up off system is also important. If using Windows Back Up to make the image, make sure you also make a Windows Repair Disk to be able to restore it.

Recuva is really to recover individual files, you would need a program that can recover entire partitions if it was stored on another drive or partition. I believe there are options and others will probably offer them soon.

You have to be a little bit crazy to keep you from going insane.

Report •

Related Solutions

March 14, 2016 at 05:50:59
It really depends on what you're looking for in terms of cost.

If cost isn't an issue, I'd recommend using a snapshot program in conjunction with a disk imager. I use Rollback Rx in conjunction with Drive Cloner Rx. Rollback runs on a daily schedule taking a snapshot of the PC, and Drive Cloner runs a backup weekly. I find using both is good, because Rollback is quicker but doesn't have the versatility of disk imaging, but Drive Cloner works well in that regard.

If cost is an issue, you can pick up Macrium Reflect Free or Rollback Home. Both are great but you lose that compatibility that gives you that layered defence.

You can download many tools, even the detection tools, but I think having a solid backup really is what matters.

Hopefully this gives you a starting off point. Keep in mind this is just my two cents.

Report •

Ask Question