Locked FIles due to malicious encyrption

A client seemed to have opened some Email and it encypted all the files. I am submitting a pic of the file type. There are no ransom instructions ... or anything. Any ideas?
Who is Participating?
andreasSystem AdminCommented:
Try to recover from shadow copies if available. a good tool to browse the shadow copies is shadowexplorer. But frequently those encryption tools nowadys disable the shadowcopies and delete old versions prior to encryption.

But its woth a try.
David Johnson, CD, MVPOwnerCommented:
1.  Don't let this machine boot, recover what files you can. Reinstall the O/S or restore everything from a backup. The currently encrypted files are gone.. treat it like a catastrophic disk failure.
Starquest321Author Commented:
David: How did this happen? Do they send instructions for ransom?
Thomas Zucker-ScharffSolution GuideCommented:
yes I have not seen an instance where ransom instructions have not been made available,  unless you clean the machine. No matter the files are gone,  and you either pay the ransom, thereby spring the very thing we are all fighting against,  or you recover from backup.

read my article on ransomware.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.