Results 1 to 13 of 13
  1. #1
    2 Star Lounger
    Join Date
    Feb 2010
    Location
    Iowa, USA
    Posts
    163
    Thanks
    1
    Thanked 1 Time in 1 Post

    Do "Restore Previous Versions" options repair Cryptolocker infections?

    Do "Restore Previous Versions" options repair Cryptolocker infections, or at least enable recovery of files?

    I've been reading about the horrors of Cryptolocker infections. But Windows 7, Gdrive, and Dropbox all include a "Restore Previous Versions" option. Can these options be used to restore files that were encrypted by Cryptolocker? Thanks for any comments.

  2. #2
    Super Moderator
    Join Date
    Aug 2012
    Location
    Durham UK
    Posts
    6,609
    Thanks
    147
    Thanked 870 Times in 832 Posts
    Restoring a system using the restore points only reverts the volume system files to a previous date and any programs or updates installed since that date would need to be reinstalled but does not affect any personal files, so the files would remain encrypted.

    I don't know Gdrive or Dropbox but the only sure way of recovering your personal files would be from a system image stored on external media.

    CryptoPrevent will protect you from Ransomware and if you use the free version, then open it now and again to check for Definition/Program updates - but don't go asking for trouble by clicking on links in e-mails from those you don't know and if it is from someone you do know, phone them to confirm the e-mail is from them.

    The download button is at the bottom of the page, but read through the article first.
    Last edited by Sudo15; 2014-07-03 at 09:35.

  3. #3
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    4,746
    Thanks
    171
    Thanked 649 Times in 572 Posts
    Quote Originally Posted by Sudo15 View Post
    Restoring a system using the restore points only reverts the volume system files to a previous date and any programs or updates installed since that date would need to be reinstalled but does not affect any personal files, so the files would remain encrypted.
    The question wasn't about system restore points.

  4. #4
    Super Moderator
    Join Date
    Aug 2012
    Location
    Durham UK
    Posts
    6,609
    Thanks
    147
    Thanked 870 Times in 832 Posts
    Quote Originally Posted by BruceR View Post
    The question wasn't about system restore points.
    The title of the thread inferred that.

  5. #5
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    4,746
    Thanks
    171
    Thanked 649 Times in 572 Posts
    Quote Originally Posted by Sudo15 View Post
    The title of the thread inferred that.
    Well, it was about data files not system files: Recover data files in Windows 7 with Previous Versions

    Bruce

  6. #6
    Super Moderator
    Join Date
    Aug 2012
    Location
    Durham UK
    Posts
    6,609
    Thanks
    147
    Thanked 870 Times in 832 Posts
    That's a useful link Bruce - thanks - but I'll leave it to the OP to define what they meant if/when they come back.

  7. #7
    WS Lounge VIP Browni's Avatar
    Join Date
    Dec 2009
    Location
    Rochdale, UK
    Posts
    1,650
    Thanks
    38
    Thanked 161 Times in 139 Posts
    In reply to the OP the obvious answer is YES! assuming that you have a previous version that was not encrypted.

    My understanding with the various cloud sites you use is that any changes to a file will be uploaded to said cloud site whilst retaining the original version(s) and any form of encryption done to the file would be recognised as a change which should upload the new version with the original still being available.

    Regarding Windows, the previous versions do live on the PC but I do not know if the malware would have access to them (personally I don't think so)
    Last edited by Browni; 2014-07-03 at 12:18.

  8. #8
    Silver Lounger
    Join Date
    Oct 2012
    Posts
    2,335
    Thanks
    13
    Thanked 267 Times in 260 Posts
    There are so many factors that affect creation and storage of previous version data that it would most likely be a very unreliable method for recovering any significant data. For example, most of my data has no previous version, so 90 or 95% is gone right there.

    Also, all the malware would have to do is spare a few CPU cycles to wipe out the shadow copies while it encrypted files.

  9. #9
    2 Star Lounger
    Join Date
    Feb 2010
    Location
    Iowa, USA
    Posts
    163
    Thanks
    1
    Thanked 1 Time in 1 Post
    Thanks to all who replied. For some reason, the automatic email notification didn't work this time so I didn't know anybody had responded. Yes, my question was about the "Restore Previous Version" function of Windows 7, Grdrive, and Dropbox, not Windows 7 System Restore Points. Gdrive stores previous versions for a month I think, and Dropbox does something similar, so I do assume that a Cryptolocker type virus could not access them. I wasn't sure about the Windows 7 "Restore Previous Version" function and was hoping somebody knew for sure. In Windows 7, the "Restore Previous Version" can be accessed by left-clicking any file or folder and selecting the "Restore Previous Version" function. The "Restore Previous Version" function does have to be turned on, apparently, (under Computer-Properties-System Protection-Configure) although some of my files had previous versions even though it wasn't. So I'm not completely sure how (or when) it works and was hoping somebody knew more about it than I did. thanks anyway.

  10. #10
    Silver Lounger
    Join Date
    Oct 2012
    Posts
    2,335
    Thanks
    13
    Thanked 267 Times in 260 Posts
    Restore previous versions (RPV) is tied in with restore points, hence some of the confusion and another of the reasons RPV is unreliable or at least highly variable as to a full recovery situation.

    It is meant and only works best for individual revised document or folder error recovery to a previous version.

  11. #11
    Silver Lounger
    Join Date
    Mar 2014
    Location
    Forever West
    Posts
    2,072
    Thanks
    0
    Thanked 259 Times in 248 Posts
    A 'feature' of some infections is that they destroy the files necessary for System Restore to work, won't have anything to go back to.

  12. #12
    Silver Lounger wavy's Avatar
    Join Date
    Dec 2009
    Location
    ny
    Posts
    2,367
    Thanks
    233
    Thanked 147 Times in 136 Posts
    It probably does not need saying but I would use a non infected computer to d/l and hold the restored files until such time as you are certain all traces of crypto are purged.


    David

    Just because you don't know where you are going doesn't mean any road will get you there.

  13. #13
    Lounge VIP bobprimak's Avatar
    Join Date
    Feb 2009
    Location
    Hinsdale, IL, USA
    Posts
    2,482
    Thanks
    176
    Thanked 152 Times in 129 Posts
    If you are concerned about having reasonably up to date backup files in case your data files ever get encrypted (or otherwise damaged beyond repair), why not just dedicate a part of your local backup drive(s) to data backups? And perform these backups of critical files and folders every couple of days? That way, there will always be an unencrypted version availabe to restore in the event of infection or corruption -- or hard drive failure.
    -- Bob Primak --

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •