How to rescue your PC from ransomware

Don't negotiate with e-terrorists. Be a hero and rescue your hostage PC.

With nasty malware like Locky making the rounds—encrypting its victims’ files, and then refusing to unlock them unless you pay up—ransomware is a serious headache. But not all ransomware is so difficult.

You can remove many ransomware viruses without losing your files, but with some variants that isn’t the case. In the past I’ve discussed general steps for removing malware and viruses, but you need to apply some specific tips and tricks for ransomware. The process varies and depends on the type of invader. Some procedures involve a simple virus scan, while others require offline scans and advanced recovery of your files. I categorize ransomware into three varieties: scareware, lock-screen viruses, and the really nasty stuff.

Scareware

fakeav example

An example of a fake antivirus app.

The simplest type of ransomware, aka scareware, consists of bogus antivirus or clean-up tools that claim they’ve detected umpteen issues, and demand that you pay in order to fix them. Some specimens of this variety of ransomware may allow you to use your PC but bombard you with alerts and pop-ups, while others might prevent you from running any programs at all. Typically these invaders are the easiest type of ransomware to remove.

Lock-screen viruses

kovter ransomware

The Kovter ransomware locks down your computer, displaying a fake notice claiming to be from several government authorities.

Next is the ransomware variety I call lock-screen viruses, which don’t allow you to use your PC in any way. They display a full-size window after Windows starts up—usually with an FBI or Department of Justice logo—saying that you violated the law and that you must pay a fine.

The really nasty stuff

locky ransomware McAfee

A ransomware program called Locky has quickly become one of the most common types of malware seen in spam.

Encrypting malware—such as Locky—is the worst variant, because it encrypts and locks your personal files until you pay up. But even if you haven’t backed up your files, you may have a chance to recover your data.

Removing ransomware

Before you can free your hostage PC, you have to eliminate the hostage taker.

If you have the simplest kind of ransomware, such as a fake antivirus program or a bogus clean-up tool, you can usually remove it by following the steps in my previous malware removal guide. This procedure includes entering Windows’ Safe Mode and running an on-demand virus scanner such as Malwarebytes.

If the ransomware prevents you from entering Windows or running programs, as lock-screen viruses typically do, you can try to use System Restore to roll Windows back in time. Doing so doesn’t affect your personal files, but it does return system files and programs to the state they were in at a certain time. The System Restore feature must be enabled beforehand; Windows enables it by default.

windows7 advanced boot options Eric Geier/IDG

You can usually bring up the Advanced Boot Options of Windows 7 by pressing F8 during booting.

To start the restoration process using System Restore, follow these steps depending on your OS version:

Windows 7

  1. Shut down your PC and locate the F8 key on your PC’s keyboard.
  2. Turn the PC on, and as soon as you see anything on the screen, press the F8 key repeatedly. This action should bring up the Advanced Boot Options menu.
  3. Select Repair Your Computer and press Enter.
  4. You’ll likely have to log on as a user. Select your Windows account name and enter your password. (If you don’t have a password set, leave that blank.)
  5. Once logged on, click System Restore.

Windows 8, 8.1, or 10

windows10 recovery Eric Geier/IDG

You can get to the recovery options of Windows 8, 8.1, and 10 by holding shift when rebooting from the Windows login screen.

  1. If your PC boots to the Windows login screen, hold the Shift key, click the power icon, and select Restart.
  2. It should reboot to the recovery screens.
  3. Select Troubleshoot > Advanced Options > System Restore.

If you can’t get into the recovery screens, you can use the Windows installation media (disc or USB drive) for your particular version/edition to access the recovery tools. You’d boot up to that install media, but click Repair your computer on the main menu before proceeding with the installation. Alternatively, you can create a Windows System Repair Disc on another PC running the same Windows version, and then boot to that disc on the infected PC to reach the same recovery tools. We’ve previously discussed this process for Windows 7, Windows 8, and Windows 10.

If System Restore doesn’t help and you still can’t get into Windows to remove the ransomware, try running a virus scanner from a bootable disc or USB drive; some people refer to this approach as an offline virus scan. My favorite bootable scanner is from Bitdefender, but more are available: Avast, AVG, Avira, Kaspersky, Norton, and Sophos all offer antivirus boot-disk software.

bitdefender rescue cd Eric Geier/IDG

Bitdefender’s antivirus boot disk in action.

If you still have no luck after trying Safe Mode and an on-demand scanner, performing a System Restore, and running an offline virus scanner, your last resort is likely to perform a full restore or clean re-install of Windows. Most ransomware isn’t that tenacious, however.

show hidden files windows7 Eric Geier/IDG

Showing hidden files in Windows 7 takes a couple of clicks.

Recovering hidden and encrypted files

With that out of the way, it’s time to repair the damage. If you’re lucky, your PC was infected by malware that didn’t encrypt your data. If it appears you’re missing stuff though, the malware may have merely hid your icons, shortcuts, and files. It usually does this by making the files “hidden.” Here’s how to check, depending on your OS version:

Windows 7

  1. Open Computer.
  2. Press the Alt key and select Tools.
  3. Click Folder Options and select the View tab.
  4. Select Show hidden files, folders, and drives, and then click OK.

Windows 8, 8.1, and 10

  1. Open a File Explorer window.
  2. Select the View tab on the top pane.
  3. Check Hidden items.
show hidden files win10 Eric Geier/IDG

Showing hidden files in Windows 8 and after is a cinch.

If your data reappears after you elect to show hidden files, that’s great—it means there’s an easy fix for your woes. Open Computer or File Explorer, navigate to C:\Users\, and open the folder of your Windows account name. Then right-click each folder that’s hidden, open Properties, uncheck the Hidden attribute, and click OK. Boom! Done.

If you still can’t find your data, and your files really have been malware-encrypted, you’re in trouble. Usually it isn’t possible to just decrypt or unlock your hostage files, because the decryption key is typically stored on the cybercriminal’s server. Some victimized users have reported that some pieces of malware will keep their promise, decrypting and returning your files once you pay, but I don’t recommend paying.

This is why we constantly tell you to back up your PC on a regular basis.

If you previously set and created backups, scan them for viruses on another PC (one that is not infected) if at all possible. If all of your important files are backed up, you can proceed in removing the malware and then simply restoring your backed-up files.

If you don’t have a backup system in place, you might be able to recover some files from Shadow Volume Copies—if the malware hasn’t deleted them. Shadow Volume Copies is part of Windows’ System Restore feature. Either right-click on the files or folders you want to restore and open Properties to view the Previous Versions list, or use a program called Shadow Explorer to browse the snapshots.

But don’t rely on that. Start backing up your PC today, and do it regularly.

Preventing ransomware and malware infections

Avoiding ransomware is much the same as avoiding other types of other malware.

Always run a good antivirus utility and keep Windows and browser-related components (Java, Adobe, and the like) updated. Keep your browser clean of junk toolbars and add-ons to prevent adware invasions that could lead to malware infections. Always, always be wary of unexpected email attachments and spam.

And just to beat this dead horse one more time: Always have a good backup system in place, just in case your PC does become infected and you can’t recover your files. Yes, it’s that important.

Editor's note: This article was oroginally published January 13, 2014, and updated April 3, 2017.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Eric Geier

PC World (US online)
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?