 An encrypted virus, also known as ransomware, is a most dangerous type of malware. After penetrating an operating system, they delete user files after creating encrypted copies. It is impossible to decrypt the files without a special encryption key, which is impossible for an ordinary user, so the information is lost forever. As the rule such viruses show a pop-up message, your personal files are encrypted, and suggest you should pay for decryption, but it's just a waste of money, so don't. Let's see in detail what to do if your computer has been attacked by such virus and your files are encrypted. How can you tell that you are attacked by ransomware virus? Your files will be deleted and replaced by copies having the same extension. Pause this video and study this information or find it in the description of this video. Soon all your files will have an icon like a white sheet of paper or an icon like an archived file. Usually, there is a text file or HTML file next to the decrypted files. This particular file contains the hacker's demands to send money, usually starting from $500 in exchange for a decryption key. First and well, don't give way to panic and phase the truth. Your files are lost forever. You can find lots of decryptors on the web promising to unlock your data for a small amount from $30 to $100, but most likely they will not. You shouldn't be sending money to the virus created either, because all you can get is more attention from the experienced hacker. Remember, the virus is still inside your computer and may be encrypting more and more files. Disconnect all memory cards, USB drives, cameras, tablet PCs and so on from your computer. Disconnect your computer from the networks or Wi-Fi to stop the virus from spreading. Press Ctrl-Shift-Escape or Ctrl-L-Delete to see the list of running processes and check them for suspicious activities. Such viruses create much load on the computer's resources, especially on the hard disk and processor. Find the most resource-intensive processes and stop them. Then go to Startup tab and disable all applications. You can leave only trusted ones, but remember that they can also be infected and start a virus as well. Right-click on the Start menu and select Computer Management. Then go to Task Skittler and then to Task Skittler Library. Do the active tasks and disable those that seem suspicious. After such actions, the virus won't be able to start itself again and you can begin working with files. I'd recommend installing the antivirus, Kaspersky Internet Security, or any other product from the top category, to protect your computer against repeated startup of the virus and your files against repeated infection. You can learn more about such antiviruses from our review, find the link in the description. Do your personal files and copy all of them, which are not encrypted yet. If you don't have an antivirus installed, remember that bringing your files to another computer can infect it too. Go to Kaspersky website. Find the link in the description. There is a collection of free decrypting utilities by Kaspersky and the instructions on using them. For example, let's learn how to decrypt an XTBL file. Enter extension of the file which you need to encrypt and click Search. The website offers us a shared decrypt to utility, download and run it. Then click to start scanning and specify the path to one of the encrypted files. If the utility cannot determine the virus identifier, it will ask you to specify the path to the file readme.txt, which contains demands from the ransomware. This path is simple. The file is usually in the same directory with the infected files. Ready? The utility has checked and decrypted the file. Note, please remember that there is little chance that all of your files can be decrypted in that way. Then it is high time to think about data backup or to say exactly recovering files from your backup. If you have such copy of your files, then you are lucky and you can recover them after the virus is deleted. Such backup could be made by a program which you installed or adjusted, or independently by one of Windows tools, file history, restore points or system image backup. In the description you will find links to the videos where we examine this problem in detail. If you work with a computer connected to the local company network, you should ask your system administrator for help. He must be the person who is in charge of backup. If you can't find a backup copy, try using data recovery software. After encrypting, the virus creates a new file and writes the encrypted contents of the original file there. After that, it deletes the original file, so you can try recovering it. Download, install and launch Hetman Partition Recovery. Run full analysis and the program will show the files available for recovery. Sure you won't be able to recover all of your files that way, but at least it works with some of them. If you liked this video, click the Like button below and subscribe to our channel to see more. We'll be glad to answer any questions in comments. Thank you for watching and good luck.