Dealing with corrupted files post- ransomware

[Jake]

So I got hit, due to my own stupidity, learned from the experience, and am now wondering how to deal with the consequences.

I don't want to delete the corrupted files since they still have the titles and I can use that to rebuild, recover some.

I think I got rid of all the virus, but should I isolate the corrupted files or has all the damage already been done?

Also- is there any program out there that can seek out and identify files that have been corrupted (so I don't have to meticulously click on each one to see if it has been corrupted)?

 

[carnageX]

Are they actually corrupted somehow, or are they just encrypted?

Check out the tools Avast and Kaspersky put out to decrypt the files:
https://blog.avast.com/avast-releases-four-free-ransomware-decryptors
https://noransom.kaspersky.com/

 

[Jake]

Thanks, I'll give those a try.

 

[carnageX]

Good luck - I suggest backing up the files and using the tools afterwards, just in case.

 

[luke127]

You'll definitely want to know what type of cryptovirus you had, otherwise specific decryption programs will be ineffective. Usually the HTML files that tell you how to pay the ransom are a good giveaway, and bleeping computer has a website that tells you which one you have based on its message given in the HTML file. I cannot remember it off the top of my head, but a quick google search should yield results.

 

[carnageX]

You'll definitely want to know what type of cryptovirus you had, otherwise specific decryption programs will be ineffective. Usually the HTML files that tell you how to pay the ransom are a good giveaway, and bleeping computer has a website that tells you which one you have based on its message given in the HTML file. I cannot remember it off the top of my head, but a quick google search should yield results.

This is a good place to start: https://www.bleepingcomputer.com/fo...dentify-what-ransomware-encrypted-your-files/

 

[luke127]

This is a good place to start: https://www.bleepingcomputer.com/fo...dentify-what-ransomware-encrypted-your-files/

That would be the forum thread containing the link to the site Told you it would be easy to find xD