Oops, Your Files Have Been Encrypted - What to Do Safely?
You computer is infected by ransomware
If you've encountered the alert "Oops, your files have been encrypted" when trying to access your personal files, it's likely that your computer has been infected with malware. This is a common tactic used by ransomware, which demands payment (usually in Bitcoins) to decrypt your files.
The WannaCry cyberattack has caused widespread concern globally, with the majority of infected computers running Windows 7. Fortunately, Windows 10 users are currently safe from this threat. If you're one of the affected victims, take a deep breath and follow these steps to increase your chances of recovering your files.
Recommended steps to handle infected computers
You must be particularly concerned about data security if your files have been encrypted by WannaCry or other ransomware. Below are the recommended steps to handle infected computer.
1. The first thing you should do is to disconnect your computer from the internet, otherwise, it can spread to all the computers on the same network in seconds.
2. Restore your PC to the previous date or use other recovery options. If there are no recovery options available, boot into Safe Mode and backup all your encrypted files in case the malware or its variation delete all your files.
3. Remove the ransomware. You can remove the ransomware WannaCry once infected, but the process is not easy.
4. Backup your computer. In the situations like this, there is no better way than a good backup strategy.
After knowing the recommended steps, you can try one or more of them and it helps to reduce data loss as much as possible. Here I'll introduces you to remove WannaCrypt ransomware virus and create offline backup on the infected computers.
Remove WannaCrypt ransomware virus
The WannaCrypt ransomware virus has caused significant disruptions worldwide. To mitigate the damage, it's essential to remove the virus and create an offline backup of your data.
1. Boot your computer in Safe Mode.
2. Press Ctrl + Shift + Esc to open Task Manager. Click on the Processes Tab, and delete those unfamiliar entries. Be careful when doing this because delete system process may cause system issues.
3. Press Windows + R, and type "msconfig" to open System Configuration. Click on the "Startup" tab and then look through all the programs for suspicious one. If you find an unknown developer, uncheck it and then click OK.
4. Press Windows + R, and type "regedit" enter Registry. Press Ctrl + F to bring out the Find window. Then search for "Virus Ransom.Crypt or WannaCry". The delete all the items in the results.
5. Go to the Start Menu in Windows 7 or search box in Windows 8 and then individually typing the following: %AppData%, %LocalAppData%, %ProgramData%, %WinDir%, %Temp%. when each folder opens, delete the files and folders created after your computer got hit by the ransomware.
This ransomware virus removal guide has been reported working, but it cannot guarantee that WannaCrypt will be completely removed from your PC. If you do not familiar with these steps, you may consider using tools like SpyHunter.
Create offline backup on infected computer
If you're looking for a reliable solution to remove WannaCrypt ransomware, consider using Qiling Disk Master Free. This software offers a range of benefits, including:
- Complete backup solutions: It provides users with 4 backup solutions, including System Backup, Disk Backup, Partition Backup and File Backup.
- Multiple disk space savior feature: It is able to compress backup image with normal or high compression, backup only changed files with incremental backup, splitting large files to smaller one, etc.
- Create bootable media: It is to create bootable USB or CD/DVD and boot computer without entering into Windows.
And all the operations are based on an intuitive interface and all users can operate it like a professional. Please download it and install it on a working computer.
1. Connect a writable USB flash drive or DVD/CD to your computer. Run this freeware on the working computer, and create a bootable USB with it.
- Click Create Bootable Media under the Tools tab.
- Select bootable disc type - Windows PE and click Next.
- Select boot device - USB, CD/DVD or ISO file. Then, click Next, it will start the creation of bootable media.
2. Boot the infected computer from the boot disk. You need to change boot mode (UEFI/BIOS) or boot priority if it does not boot.
3. After loading files, you will see the main page of Qiling Disk Master Free. Then, click Backup and then select System Backup if you want to backup system. Also, you can backup important files with File Backup.
4. All the partitions required for a full system restore will be included in Step 1 by default. Click Step 2 to specify the target location to receive the backup. It is recommended to save the backup to an external hard drive.
5. Click Backup Options to set normal or high compresion level, automatic splitting, intelligent setcor backup, etc. Afterward, click Proceed to backup system without booting Windows.
If you ever see an alert like "your files have been encrypted", don't panic and follow this guide to reduce your data loss to the minimum. In conclusion, having a regular backup plan is the best defense against ransomware. In case virus or malware infect the backup, you should backup to an offsite location or backup to Google Drive.
FAQs about your files have been encrypted
Should you pay the ransom?
Don't pay the ransom. If you have created files backup in Windows 7, you can easily restore them safely. Besides, it is reported that someone had already paid the ransom to no avail. The people behind this ransomware WannaCrypt are criminals. It is not reasonable to expect such criminals to honor their words after the transaction. If the files encrypted are really precious to you, there are things you should do instead.
Can you recover files encrypted by WannaCrypt Ransomware ?
Don't try to click the "Decrypt" button. You can use data recovery tool to recover ransomware encrypted files instead, because your original files were deleted and the encrypted files you see with extension .decrypt or .wncry were newly created by the ransomware.
If data recovery software has failed to restore some of your files, there's still a chance to recover them without paying the ransom. You can wait for the decryption tool, which might be released by the ransomware developers or a third-party group.
The statement by Rob Wainwright, Europol director, highlights the ongoing threat of ransomware, which continues to affect individuals and organizations worldwide. Despite efforts to combat the issue, ransomware remains a live threat, and disaster recovery mode is still in effect.
Summary
You can reduce data loss as much as possible if your files have been encrypted by WannaCry or other ransomware. Since your computer is infected, you need to boot into recovery environment and backup system, disk, partition or files to external hard drive. If there are multiple infected computers, you can choose to deploy system image to multiple computers simultaneously with its image deployment software. Try Qiling Disk Master Technician or TechPlus edition.
Related Articles
- How to Decrypt and Recover Ransomware Encrypted Files
If your computer is infected with ransomware WannaCry, don't cry or pay the ransom because you can recover ransomware encrypted files easily and quickly. - Remove Ransomware Virus WannaCry in Windows 7 and Restore Files
If you are looking for a way to remove ransomware virus and restore files, please continue to read, learn 3 effective methods and how to prevent it in the future. - Recent Ransomware Attacks Should Be Treated as A "Wake-up Call"
Recent Ransomware Attacks that have hit 150 countries since Friday should be treated by governments around the world as a "wake-up call". - Wipe Hard Drive in Windows 10 to Protect Privacy
What's the best way to wipe a hard drive and clear all the data away and make sure they are unrecoverable by no means. please read this article.