How to recover files after ransomware virus

-

More and more computers are infected by ransomware. Every day there are new victims whose computer data is encrypted by ransomware. These are more and more private individuals but also large companies. If ransomware has encrypted the computer data, an amount of money is requested in virtual cryptocurrency.

If you pay – which I do not recommend – you will get the code to get the encrypted data back or the ransomware developers will decrypt the files remotely.

Recover ransomware encrypted files

If you don’t want to pay the ransomware developers and first try to decrypt the encrypted files yourself then there are a number of options you can try. In this article, I will give you some options to try to decrypt the encrypted files again. There is no guarantee that these tips will work.

Shadow Explorer

ShadowExplorer is a free program where you can view Shadow copies created by Windows itself. If Shadow copies in Windows are available then you can use Shadow Explorer to restore these copies. You can then restore entire folders or files. Most advanced ransomware is familiar with Shadow copies and removes them. So there is no guarantee that Shadow Explorer can restore copies.

Download Shadow Explorer

Install Shadow Explorer. First, you need to select a Shadow copy in the menu.

If there are no shadow copies available the shadow copies are deleted, there is no way to restore files using Shadow Explorer.
Continue to the next step instead.

Select your drive in the top left corner and browse the folder and files you would like to recover.

shadow explorer recover files after ransomware

Select the folder or file, right-click, and click on Export. Select the output folder and click on OK.

The folder or file you have recovered is now in the out folder location.

recover files using shadow explorer

Recuva

Recuva is another free program to recover pictures, music, documents, videos, emails, or any other file type you’ve lost. And it can recover from any rewriteable media you have memory cards, external hard drives, USB sticks, and more. Please note there is no guarantee Recuva can restore encrypted files by ransomware. Recuva works for some ransomware but not for the more sophisticated ransomware.

Download Recuva free

Install Recuva by following the installation process.

In the first step, read the information and click Next.

recuva step 1

What file type would you like to recover? Click all Files and click the Next button.

recuva step 2

Where are the files located? Click I’m not sure and click the Next button.

recuva step 3

When Recuva is ready to search your files click on the Start button.

recuva step 4

Wait a few minutes. Recuva is scanning for deleted files and folders.

recuva scanning files

In the column “Filename” you can restore any removed file. Check the file you would like to restore and click the “Recover…” button.

recuva recovery ransomware files

EaseUS data recovery

EaseUS is a premium program to restore files. Reliable and professional data recovery software, retrieves deleted & lost files
on PC/laptop/server or other digital storage media effortlessly.

You can perform a scan to recover files, when you would like to recover the detected files you need to purchase a license to do so.

Download EaseUS data recovery TRIAL

Install EaseUS data recovery using the simple installation process.

Click on the Local Disk (C:\) to begin scanning to recover files.

easeus data recovery step 1

Wait for the scan to finish this might take a while when you have lots of files to recover.

easeus data recovery step 3

When the EaseUS data recovery program is done scanning you need to save your scan session. In the top menu click on the Save button. Next, search for the files and folder you would like to recover and click on the Recover button.

easeus data recovery step 4

I hope you have been able to restore files that are encrypted by ransomware.

Maximhttps://malware.guide/
Hi! I am Maxim. I research malware. I blog about malware and computer virus threats as they are released, so you can use it to remove viruses from your computer, phone, or tablet. Is this information useful? Share on social media and help others Thank you!

2 COMMENTS

Subscribe
Notify of
guest
2 Comments
Oldest
Newest Most Voted
Inline Feedbacks
View all comments
Markus Drygala
Markus Drygala
1 month ago

Hallo,
alle meine Bilddateien auf meinem Rechner sind mit Sspq Ransomware infiziert.
Kann es helfen, den PC auf einen Wiederherstellungspunkt zurückzusetzen?
Vielen Dank für ihre Antwort.
Ich bin echt hilflos.

Grüße
Markus

Learn more

How to Remove Mac malware manually

More and more Mac computers are becoming victims of malware. This is a fact. Mac malware has grown exceptionally...

How to recover files after ransomware virus

More and more computers are infected by ransomware. Every day there are new victims whose computer data is encrypted...

Remove malware from Mac with CleanMyMac

do you still think Mac computers can't get infected with malware? Then think again. Mac computers are increasingly infected...

How to install Malwarebytes

Malwarebytes is the best tool to remove unwanted programs and malware from your computer. Malwarebytes can be installed next...

Remove POP-UP advertisements in Google Chrome

When you visit internet websites, you will not escape pop-ups, i.e., ads that appear in a new window of...

How to use AdwCleaner to remove malware

Adwcleaner is a free scanner for adware, malware, and other unwanted software. In 2011 AdwCleaner was designed by a...

How can I see if my computer has been hacked?

I am often referred to as a "hacked" computer when there is a malware infection or when abnormal behavior...
Malwarebytes
Latest guides

Remove Dougiersd.website – 1 Simple Step

Dougiersd.website is a fake website. The Dougiersd.website website tries to trick you into clicking on ads displayed by the...

Remove News-umybifid.cc (Computer + Phone)

Are you receiving unwanted notifications from News-umybifid.cc? Notifications from News-umybifid.cc may appear on your computer, phone, or tablet. The...

Remove Domparce.pro – 1 Simple Step

Domparce.pro is a fake website. The Domparce.pro website tries to trick you into clicking on ads displayed by the...

Remove News-bepapi.cc (Computer + Phone)

Are you receiving unwanted notifications from News-bepapi.cc? Notifications from News-bepapi.cc may appear on your computer, phone, or tablet. The...

Remove News-bobicu.cc – 1 Simple Step

News-bobicu.cc is a fake website. The News-bobicu.cc website tries to trick you into clicking on ads displayed by the...

Remove Kentorjose.com (Computer + Phone)

Are you receiving unwanted notifications from Kentorjose.com? Notifications from Kentorjose.com may appear on your computer, phone, or tablet. The...
More removal guides like thisRELATED
Learn how to remove malware
2
0
I am here to help! Ask your question in the comments.x
()
x