Oops, Your Files Have Been Encrypted - What to Do Safely?
You computer is infected by ransomware
If you see an alert "Oops, your files have been encrypted" when trying to open your personal files, then your computer has been infected with malware. You will be asked to pay a certain amount of money (usually in Bitcoins) to decrypt files encrypted.
The biggest cyberattack called WannaCry has aroused much attention around the world. Most of the computer infected is running Windows 7. Windows 10 is currently safe. If you are one of the victims, just calm down. There are high chances that you will get your files recovered if you do it the right way.
Recommended steps to handle infected computers
You must be particularly concerned about data security if your files have been encrypted by WannaCry or other ransomware. Below are the recommended steps to handle infected computer.
1. The first thing you should do is to disconnect your computer from the internet, otherwise, it can spread to all the computers on the same network in seconds.
2. Restore your PC to the previous date or use other recovery options. If there are no recovery options available, boot into Safe Mode and backup all your encrypted files in case the malware or its variation delete all your files.
3. Remove the ransomware. You can remove the ransomware WannaCry once infected, but the process is not easy.
4. Backup your computer. In the situations like this, there is no better way than a good backup strategy.
After knowing the recommended steps, you can try one or more of them and it helps to reduce data loss as much as possible. Here I'll introduces you to remove WannaCrypt ransomware virus and create offline backup on the infected computers.
Remove WannaCrypt ransomware virus
Some of these steps below, if handled incorrectly, may lead to a system problem. It is recommended to create a system image backup before applying these methods.
1. Boot your computer in Safe Mode.
2. Press Ctrl + Shift + Esc to open Task Manager. Click on the Processes Tab, and delete those unfamiliar entries. Be careful when doing this because delete system process may cause system issues.
3. Press Windows + R, and type "msconfig" to open System Configuration. Click on the "Startup" tab and then look through all the programs for suspicious one. If you find an unknown developer, uncheck it and then click OK.
4. Press Windows + R, and type "regedit" enter Registry. Press Ctrl + F to bring out the Find window. Then search for "Virus Ransom.Crypt or WannaCry". The delete all the items in the results.
5. Go to the Start Menu in Windows 7 or search box in Windows 8 and then individually typing the following: %AppData%, %LocalAppData%, %ProgramData%, %WinDir%, %Temp%. when each folder opens, delete the files and folders created after your computer got hit by the ransomware.
This ransomware virus removal guide has been reported working, but it cannot guarantee that WannaCrypt will be completely removed from your PC. If you do not familiar with these steps, you may consider using tools like SpyHunter.
Create offline backup on infected computer
You still has the ability to backup system or files on the infected computer without booting Windows. You could consider using Qiling Disk Master Free and it works well in handling WannaCry Ransomware. You can enjoy the following advantages in this software:
- Complete backup solutions: It provides users with 4 backup solutions, including System Backup, Disk Backup, Partition Backup and File Backup.
- Multiple disk space savior feature: It is able to compress backup image with normal or high compression, backup only changed files with incremental backup, splitting large files to smaller one, etc.
- Create bootable media: It is to create bootable USB or CD/DVD and boot computer without entering into Windows.
And all the operations are based on an intuitive interface and all users can operate it like a professional. Please download it and install it on a working computer.
1. Connect a writable USB flash drive or DVD/CD to your computer. Run this freeware on the working computer, and create a bootable USB with it.
- Click Create Bootable Media under the Tools tab.
- Select bootable disc type - Windows PE and click Next.
- Select boot device - USB, CD/DVD or ISO file. Then, click Next, it will start the creation of bootable media.
2. Boot the infected computer from the boot disk. You need to change boot mode (UEFI/BIOS) or boot priority if it does not boot.
3. After loading files, you will see the main page of Qiling Disk Master Free. Then, click Backup and then select System Backup if you want to backup system. Also, you can backup important files with File Backup.
4. All the partitions required for a full system restore will be included in Step 1 by default. Click Step 2 to specify the target location to receive the backup. It is recommended to save the backup to an external hard drive.
5. Click Backup Options to set normal or high compresion level, automatic splitting, intelligent setcor backup, etc. Afterward, click Proceed to backup system without booting Windows.
If you ever see an alert like "your files have been encrypted", don't panic and follow this guide to reduce your data loss to the minimum. In conclusion, having a regular backup plan is the best defense against ransomware. In case virus or malware infect the backup, you should backup to an offsite location or backup to Google Drive.
If you create an Qiling account, you can backup files to Qiling Cloud. It offers you 1TB free storage for 15 days after you sign up for an Qiling account.
FAQs about your files have been encrypted
Should you pay the ransom?
Don't pay the ransom. If you have created files backup in Windows 7, you can easily restore them safely. Besides, it is reported that someone had already paid the ransom to no avail. The people behind this ransomware WannaCrypt are criminals. It is not reasonable to expect such criminals to honor their words after the transaction. If the files encrypted are really precious to you, there are things you should do instead.
Can you recover files encrypted by WannaCrypt Ransomware ?
Don't try to click the "Decrypt" button. You can use data recovery tool to recover ransomware encrypted files instead, because your original files were deleted and the encrypted files you see with extension .decrypt or .wncry were newly created by the ransomware.
If you still have some files that data recovery software cannot restore, there is still hope that you will get the files back without paying the ransom. You can wait for the decryption tool.
"We will get a decryption tool eventually, but for the moment, it's still a live threat and we're still in disaster recovery mode," Rob Wainwright, Europol director.
Summary
You can reduce data loss as much as possible if your files have been encrypted by WannaCry or other ransomware. Since your computer is infected, you need to boot into recovery environment and backup system, disk, partition or files to external hard drive. If there are multiple infected computers, you can choose to deploy system image to multiple computers simultaneously with its image deployment software. Try Qiling Disk Master Technician or TechPlus edition.
Related Articles
- How to Decrypt and Recover Ransomware Encrypted Files
If your computer is infected with ransomware WannaCry, don't cry or pay the ransom because you can recover ransomware encrypted files easily and quickly. - Remove Ransomware Virus WannaCry in Windows 7 and Restore Files
If you are looking for a way to remove ransomware virus and restore files, please continue to read, learn 3 effective methods and how to prevent it in the future. - Recent Ransomware Attacks Should Be Treated as A "Wake-up Call"
Recent Ransomware Attacks that have hit 150 countries since Friday should be treated by governments around the world as a "wake-up call". - Wipe Hard Drive in Windows 10 to Protect Privacy
What's the best way to wipe a hard drive and clear all the data away and make sure they are unrecoverable by no means. please read this article.