After receiving an email and executing the zipped attachment, all the images and documents in my computer are encrypted and rendered unusable. Furthermore, the desktop background is replaced by the following screen and a ransom is requested in order to retrieve the original files.
Can my files be recovered?
CTB Locker/Critroni may not always remove the volume shadow copy (VSS), so, if your operating system is Windows Vista or higher, it might be possible to retrieve a copy of the files affected by malware. Please follow the steps below:
- Download and install the following software:
- Once installed, browse to the location where the affected files are.
- Select a date prior to the infection.
- Select the affected file or folder, and choose the option Export.
This procedure may let you recover previous versions of the affected files.
How to avoid Ransomware infections
Panda Security solutions detect and block this type of malware. In any case, please bear in mind the following advice:
- Keep the operating system updated to avoid security breaches.
- Have your antivirus installed and updated.
- Do not open emails or files coming from unknown senders.
- Avoid browsing unsafe pages or non-verified content.
For further information, check article 4 Essential Tips to Prevent Virus Infections.