We are aware of the issue with the badge emails resending to everyone, we apologise for the inconvenience - learn more here.
Forum Discussion
Safe recovery of files locked by ransomware
Unfortunately my pc got infected by a ransomware. It locked all my files including the data i had on my dropbox, shared with my colleagues, changing their extension to "lalo". First, I wanted to k...
Hey Ntorabi, just jumping in here to see if I can help out!
With ransomware attacks, the files on your device are usually just encrypted rather than altered in that way.
However, if you do want to check the files then this isn't something that can be done by Dropbox. You would need to use an antivirus software to do so.
Regarding restoring your files, do you know around how long ago the ransomware affected your device? Was this perhaps outside of your account's version history window?
If you check your Events page here, can you see a large event when your files were affected?
Let me know - thanks!
- I should add, that i formated my computer and now it's clean,
- And when i go to the version history of files, there's a note there that i have changed the name of file with ".lalo" ...
- How can i make sure that these folders are not containing any virous file? Does dropbox scan files?
- can deleting the whole folder be a safe way to assure it's clean?
- (by the way, i loged on browser right now, i haven't installed the dektop app yet...)
- And when i go to the version history of files, there's a note there that i have changed the name of file with ".lalo" ...
- How can i make sure that these folders are not containing any virous file? Does dropbox scan files?
- can deleting the whole folder be a safe way to assure it's clean?
- (by the way, i loged on browser right now, i haven't installed the dektop app yet...)
Daphne
Dropbox Staff
Dropbox StaffHey Ntorabi, just jumping in here to see if I can help out!
With ransomware attacks, the files on your device are usually just encrypted rather than altered in that way.
However, if you do want to check the files then this isn't something that can be done by Dropbox. You would need to use an antivirus software to do so.
Regarding restoring your files, do you know around how long ago the ransomware affected your device? Was this perhaps outside of your account's version history window?
If you check your Events page here, can you see a large event when your files were affected?
Let me know - thanks!
- Thanks for your response Daphne , finaly i recovered my files using the shadow copy of my deleted files,
About the version history, yes i tried to restore to versions before the encryption, but it didn't work, any previous versions i refered to were surprisingly encrypted...
By the way, you were right, the folder was virous free, it was just encrypted :))- Daphne
I'm glad to hear that you had another backup of your files Ntorabi!
If I can help with anything else, please don't hesitate to get back to me here, I'd be happy to assist. :grin:
Hope you have a great week ahead!
I discovered another way to restore the files without using the Rewind function. It's more laborious, but still functional.
It happens that the ransomware changes the name of the file, so, for example, a file with a name "report.xlsx", becomes "report.xlsx.id[232323-12312].acuff",
What i did was to change the file name to "report.xlsx" again and, that way, Dropbox showed early versions of the file.
After that, I simply restore the files I wanted.
I can see each file being 'added'/renamed, then the original file being deleted in the events page. Every file in my drop box in now encrypted. It all happened this morning, file by file at 10:09am. When I try to restore the file, nothing happens (from version history)
