Remove virus or malware by recovering

[anushankatugamp]

Hello, 

I faced to the ransomware virus (.orkf) Now already my failes encrypted. I could'open. Do we have possibility decrypted these files. I tried to remove .orkf textensions and see but no luck. Could you please assist how to recover my files and documents? 

I didn't create windows restore point. So I think restore option also not work for me. 

[WAWood]

@anushankatugamp 

We are not an Information Security firm, so we have no utilities to remove malware from your PC.

Since malware is able to hide in files that can not be found, the only safe thing to do is a complete factory reset -- which in your case, would need to be done from external media.

The ways to do an external factory reset are the following:
- Factory reset using external HP image you make
- Factory reset using external HP image you buy

Each of these is discussed in some detail below ...

---------- Factory reset using external HP image you make ----------
HP provides a Cloud Recovery tool that you can use, together with a 32GB USB stick, to create your on HP reset media.

Here is the link: https://support.hp.com/us-en/document/c06162205

This works the same as the factory reset described above.

---------- Factory reset using external HP image you buy ----------
For those PCs not supported by the Cloud Recovery, in some cases, HP offers Recover Media for sale. This can not be downloaded; instead, it must be ordered from HP.

HP Recovery Media is a set of DVDs and a CD, or USB stick, that will erase the hard drive (removing all data, settings, and applications, reinstall the original OS, drivers, and some HP Utilities.

In some cases, you may be able to order a USB stick instead of disks.

You can look online for Recovery Media starting with the linked paged: http://support.hp.com/us-en/drivers

Once there, input your Product name or number. On your Software and Drivers Download page, select your Operating System and and Version. Click &quot;Update&quot;.<br><br>If HP Recovery Media is available for your machine, down near the bottom of the page, you will see an entry for Order Recovery Media-CD/DVD/USB. Click the &quot;+&quot; symbol to expand that entry and click on Order Media for details.

Or, if you prefer, you can do the same by contacting HP Customer Support.

HP contact info: https://support.hp.com/us-en/contact-hp?openCLC=true

If HP no longer carries the media you need, another site you should check for HP Recovery Media is: http://www.computersurgeons.com/

These work the same as the factory reset described above.

[anushankatugamp]

Hello @WAWood 

Yes, your solution work for remove the malware and virus but At the moment, I already removed malware from my computer and free virus. So I want recover my files and documents. Files and document available in PC but encrypted. That’s  why I’m asking how to recover my files and document not a recover my PC. Factory reset remove my files and applications, so its doesn’t worth for me. Appreciate if you can  explain how to recover my files. Every file like this, I attached image below. 

.ORKF (pdf.orkf). Could you please assist, how to recover those files. 

[WAWood]

@anushankatugamp 

As I already said, we are not an Information Security outfit -- so we have no tools for dealing with malware.

The screenshot looks like the malware both renamed and encrypted your files -- and there is nothing we can do to decrypt them or recover them.

This is one of the many reasons why you should make regular backups of files you can not afford to lose.