Oops, Your Files Have Been Encrypted - What to Do Safely?

You computer is infected by ransomware

If you see an alert "Oops, your files have been encrypted" when trying to open your personal files, then your computer has been infected with malware. You will be asked to pay a certain amount of money (usually in Bitcoins) to decrypt files encrypted.

The biggest cyberattack called WannaCry has aroused much attention around the world. Most of the computer infected is running Windows 7. Windows 10 is currently safe. If you are one of the victims, just calm down. There are high chances that you will get your files recovered if you do it the right way.

Recommended steps to handle infected computers

You must be particularly concerned about data security if your files have been encrypted by WannaCry or other ransomware. Below are the recommended steps to handle infected computer.

1. The first thing you should do is to disconnect your computer from the internet, otherwise, it can spread to all the computers on the same network in seconds.

2. Restore your PC to the previous date or use other recovery options. If there are no recovery options available, boot into Safe Mode and backup all your encrypted files in case the malware or its variation delete all your files.

3. Remove the ransomware. You can remove the ransomware WannaCry once infected, but the process is not easy.

4. Backup your computer. In the situations like this, there is no better way than a good backup strategy.

After knowing the recommended steps, you can try one or more of them and it helps to reduce data loss as much as possible. Here I'll introduces you to remove WannaCrypt ransomware virus and create offline backup on the infected computers.

Remove WannaCrypt ransomware virus

Some of these steps below, if handled incorrectly, may lead to a system problem. It is recommended to create a system image backup before applying these methods.

1. Boot your computer in Safe Mode.

2. Press Ctrl + Shift + Esc to open Task Manager. Click on the Processes Tab, and delete those unfamiliar entries. Be careful when doing this because delete system process may cause system issues.

3. Press Windows + R, and type "msconfig" to open System Configuration. Click on the "Startup" tab and then look through all the programs for suspicious one. If you find an unknown developer, uncheck it and then click OK.

4. Press Windows + R, and type "regedit" enter Registry. Press Ctrl + F to bring out the Find window. Then search for "Virus Ransom.Crypt or WannaCry". The delete all the items in the results.

5. Go to the Start Menu in Windows 7 or search box in Windows 8 and then individually typing the following: %AppData%, %LocalAppData%, %ProgramData%, %WinDir%, %Temp%. when each folder opens, delete the files and folders created after your computer got hit by the ransomware.

This ransomware virus removal guide has been reported working, but it cannot guarantee that WannaCrypt will be completely removed from your PC. If you do not familiar with these steps, you may consider using tools like SpyHunter.

Create offline backup on infected computer

You still has the ability to backup system or files on the infected computer without booting Windows. You could consider using AOMEI Backupper Free and it works well in handling WannaCry Ransomware. You can enjoy the following advantages in this software:

 Complete backup solutions: It provides users with 4 backup solutions, including System Backup, Disk Backup, Partition Backup and File Backup.  

Multiple disk space savior feature: It is able to compress backup image with normal or high compression, backup only changed files with incremental backup, splitting large files to smaller one, etc.

Create bootable media: It is to create bootable USB or CD/DVD and boot computer without entering into Windows. 

And all the operations are based on an intuitive interface and all users can operate it like a professional. Please download it and install it on a working computer. 

1. Connect a writable USB flash drive or DVD/CD to your computer. Run this freeware on the working computer, and create a bootable USB with it.

• Click Create Bootable Media under the Tools tab.
• Select bootable disc type - Windows PE and click Next.
• Select boot device - USB, CD/DVD or ISO file. Then, click Next, it will start the creation of bootable media. 

2. Boot the infected computer from the boot disk. You need to change boot mode (UEFI/BIOS) or boot priority if it does not boot.

3. After loading files, you will see the main page of AOMEI Backupper Free. Then, click Backup and then select System Backup if you want to backup system. Also, you can backup important files with File Backup.

4. All the partitions required for a full system restore will be included in Step 1 by default. Click Step 2 to specify the target location to receive the backup. It is recommended to save the backup to an external hard drive.

5. Click Backup Options to set normal or high compresion level, automatic splitting, intelligent setcor backup, etc. Afterward, click Start Backup to backup system without booting Windows. 

If you ever see an alert like "your files have been encrypted", don't panic and follow this guide to reduce your data loss to the minimum. In conclusion, having a regular backup plan is the best defense against ransomware. In case virus or malware infect the backup, you should backup to an offsite location or backup to Google Drive.

If you create an AOMEI account, you can backup files to AOMEI Cloud. It offers you 1TB free storage for 15 days after you sign up for an AOMEI account.

FAQs about your files have been encrypted

Should you pay the ransom?

Don't pay the ransom. If you have created files backup in Windows 7, you can easily restore them safely. Besides, it is reported that someone had already paid the ransom to no avail. The people behind this ransomware WannaCrypt are criminals. It is not reasonable to expect such criminals to honor their words after the transaction. If the files encrypted are really precious to you, there are things you should do instead.

Can you recover files encrypted by WannaCrypt Ransomware ?

Don't try to click the "Decrypt" button. You can use data recovery tool to recover ransomware encrypted files instead, because your original files were deleted and the encrypted files you see with extension .decrypt or .wncry were newly created by the ransomware.

If you still have some files that data recovery software cannot restore, there is still hope that you will get the files back without paying the ransom. You can wait for the decryption tool.

"We will get a decryption tool eventually, but for the moment, it's still a live threat and we're still in disaster recovery mode," Rob Wainwright, Europol director.

Summary 

You can reduce data loss as much as possible if your files have been encrypted by WannaCry or other ransomware. Since your computer is infected, you need to boot into recovery environment and backup system, disk, partition or files to external hard drive. If there are multiple infected computers, you can choose to deploy system image to multiple computers simultaneously with its image deployment software. Try AOMEI Backupper Technician or TechPlus edition.