I wrote this article to help you remove “Ooops, your files have been encrypted” Ransomware. This “Ooops, your files have been encrypted” Ransomware removal guide works for all Windows versions.

If you have been infected with a virus which displays a message beginning with “Ooops, your files have been encrypted”, we can provide the explanation you are searching for. The parasite you have contacted is a ransomware program. It can also be referred to as a win-locker. A hacker attack from Friday was able to penetrate over 200,000 machines, located in 150 countries across the globe. The rogue program goes by several names. The renegade developers have dubbed it WannaCry. Several alternative names are floating around, including Wincry, WannaCrypt, WCry, Wana Decrypt0r and WanaCrypt0r. We are using the term “Ooops, your files have been encrypted” ransomware to assist users in identifying the threat. While this is not the name of the virus, it works as a referential title.

To explain what has happened to your computer, we will start from the event we mentioned earlier. There was a large scale attack which exploited a critical SMB vulnerability. The flaw was reported about a month ago by a hacker organization called Shadow Broker. The group found out about the vulnerability when uncovering classified documents from the NSA. Microsoft reacted promptly by developing a patch which was released under the serial number MS17-010. Although the company provided a solution about a month ago, an unprecedented number of devices fell victim to “Ooops, your files have been encrypted” ransomware. As alarming as this may sound, there is a reasonable explanation. The systems which the infection managed to infiltrate had not gone through an update.

If you are doing research in the attempt to protect your system from the infection, our advice is to check for pending updates and execute them. Note that only supported versions of the Windows OS will receive the patch automatically. Microsoft have released updates for a number of unsupported builds, but users need to find and download them on their own. They are widely available. It is not common practice to create updates for unsupported Windows versions. The company has decided to make an exception due to the severity of the threat. If you have already been infected with “Ooops, your files have been encrypted” ransomware, keep on reading to find out more about the program.

Although the message of the cyber criminals is straightforward, there are a lot of details around the virus you should know about. The program window which is displayed on your desktop belongs to Wana Crypt0r 2.0. This is not the win-locker, but the software which performs the decryption. The renegade developers have decided to transfer both programs together. The decryptor gives the same information as the ransom note. The physical file is titled @Please_Read_Me@.txt. You will find a copy of it in every folder which contains encrypted data. The locked files can be recognized by the .WNCRY appendix. “Ooops, your files have been encrypted” ransomware adds the custom suffix to mark the affected files. The win-locker targets documents, databases, archives, zipped folders, logs, scripts, images, videos, audios, presentations and other formats.

The attackers demand a ransom of $300 USD. The amount is to be paid in Bitcoins. The majority of win-locker developers accept payments in this cryptocurrency because it provides optimal security. Bitcoin platforms do not require users to list personal details. Furthermore, the transaction cannot be traced to the bank account of the designated recipient. The creators of “Ooops, your files have been encrypted” ransomware give users 3 days to pay the listed ransom. If you miss the deadline, the sum will be doubled. The time period for making a payment is 7 days. There is a last resort for the people who cannot afford to pay at all. The attackers have stated that they will hold free events in 6 months’ time. We need to warn you that you cannot trust cyber thieves to make good on their end of the deal. The best course of action would be to remove “Ooops, your files have been encrypted” ransomware and try to recover your files from their shadow volume copies.

“Ooops, your files have been encrypted” Ransomware Removal

Method 1: Restore your encrypted files using ShadowExplorer
Usually, “Ooops, your files have been encrypted” Ransomware deletes all shadow copies, stored in your computer. Luckily, the ransomware is not always able to delete the shadow copies. So your first try should be restoring the original files from shadow copies.

1. Download ShadowExplorer from this link: http://www.shadowexplorer.com/downloads.html.
2. Install ShadowExplorer
3. Open ShadowExplorer and select C: drive on the left panel
4. Choose at least a month ago date from the date field
5. Navigate to the folder with encrypted files
6. Right-click on the encrypted file
7. Select “Export” and choose a destination for the original file

Method 2: Restore your encrypted files by using System Restore

1. Go to Start –> All programs –> Accessories –> System tools –> System restore
2. Click “Next“
3. Choose a restore point, at least a month ago
4. Click “Next“
5. Choose Disk C: (should be selected by default)
6. Click “Next“. Wait for a few minutes and the restore should be done.

Method 3: Restore your files using File Recovery Software
If none of the above method works, you should try to recover encrypted files by using File Recovery Software. Since “Ooops, your files have been encrypted” Ransomware first makes a copy of the original file, then encrypts it and deletes the original one, you can successfully restore the original, using a File Recovery Software. Here are a few free File Recovery Software programs:

1. Recuva
2. Puran File Recovery
3. Disk Drill
4. Glary Undelete