My mother called me today and told me that her PC was locked and all files displayed as wave files or mp3
So i gave her a visit and had a look what was going on.
I checked Windows it had 53 thousand entrys of _recovery_ +rkyft.html and _recovery_ +rkyft.png
All files seemed to be renamed randomly for example picture01.jpg - was now picture01.jpg.wav
I downloaded malwarebytes updated it and deleted a malicious file that had random letters and was not to be found on a google search ...
I cleaned the registry but apparently there are still two well hidden entrys that promt to the deleted file since the system tried to launch it on restart.
havent found those yet.
I read up on how to restore the files and one article pointed out that one should try to simply rename the file.
I did that with no success, each and every file is pretty much useless atm.
and once you have renamed them to picture01.jpg the file becomes corrupted.
My second thought would be ok lets try a restore point.
The pc is setup to make one for every update every new prog and had one done when i was here a month ago.
But guess what... no restore points all have been deleted...
Aint that nice.
So im currently sitting here like an idiot since i dont know what to do to get her files back.
I have no old backup data where i could select an original file and compare it the encrypted ones.
The system AV was running with aggressive settings. ( Bitdefender btw ) and was even updated.
So if you have any idea what can be done to save my mothers files help is greatly appreciated at this point.
Since im out of ideas...