How to retrieve encrypted files (Trend Micro)

Know how to retrieve the files that were encrypted by the CryptoLocker Ransomware.

For more information about ransomware, refer to our Threat Encyclopedia: Ransomware.

Restore from Backup

Check your computer files that were encrypted. Once identified, segregate and delete the files. Copy and paste the files from your backup device to your computer.

Recover a deleted file or folder

1. Open the directory where the file is located.
2. Right-click in the directory, then select Properties.
3. The Properties window will appear, click the Previous Versions tab.
4. A list of available snapshots for the file or folder will appear. Select the snapshot with the last known good copy of your file or directory, then click View.
5. A new window displaying the content of the snapshot will appear.
6. Locate the file or folder that you wish to restore.
7. Do either of the following:
   • Open the file and save it to the correct location.
   • If you have multiple files or a folder, drag the files or folders to their correct locations.

Restore a Previous Version of the File (or Folder)

1. Locate the directory where the file is stored.
2. Right-click the file, then select Properties.
3. Click the Previous Versions tab when the Properties window opens.
   If you don’t see the Previous Versions tab, you need to install the client.
   You can speak with your support team to get the correct client installed.
4. A list of available snapshots for the file will appear.
5. Select the snapshot that represents the last known good version of the file.
6. Click View and verify if it is the correct version of the file.
7. Once you find the correct file, do any of the following:
   • View: View the recovered file directly and then save it by clicking File > Save As.
   • Copy: Create a copy of the recovered file in the same directory as the original file. You will now have both copies available.
   • Restore: This will restore the recovered file and will replace the current file.

Perform System Restore

Perform System Restore from a previous clean state. Check these Microsoft articles for instructions:

• Restore Windows 8 to a previous state
• Restore windows 10 to a previous state