Need to see if your shared folder is taking up space on your dropbox 👨💻? Find out how to check here.
Forum Discussion
Solved
Safe recovery of files locked by ransomware
Unfortunately my pc got infected by a ransomware. It locked all my files including the data i had on my dropbox, shared with my colleagues, changing their extension to "lalo".
First, I wanted to know if there is a way to recover my data because they're really important and we've got no backup.
Then i want to make sure these files are not affected by the malware and it can't infect my colleagues' devices.
I would really appreciate it if you could help me.
Hey Ntorabi, just jumping in here to see if I can help out!
With ransomware attacks, the files on your device are usually just encrypted rather than altered in that way.
However, if you do want to check the files then this isn't something that can be done by Dropbox. You would need to use an antivirus software to do so.
Regarding restoring your files, do you know around how long ago the ransomware affected your device? Was this perhaps outside of your account's version history window?
If you check your Events page here, can you see a large event when your files were affected?
Let me know - thanks!
21 Replies
Replies have been turned off for this discussion
- Rich
Super User II
Refer to the following help article:
- Thanks for your response,
I used the version history of files while singed from browser, but unfortunatly it didn't work...
All the versions i restore to, are linked with the extension ".lalo" - - I should add, that i formated my computer and now it's clean,
- And when i go to the version history of files, there's a note there that i have changed the name of file with ".lalo" ...
- How can i make sure that these folders are not containing any virous file? Does dropbox scan files?
- can deleting the whole folder be a safe way to assure it's clean?
- (by the way, i loged on browser right now, i haven't installed the dektop app yet...) - Daphne
Dropbox Community Moderator
Hey Ntorabi, just jumping in here to see if I can help out!
With ransomware attacks, the files on your device are usually just encrypted rather than altered in that way.
However, if you do want to check the files then this isn't something that can be done by Dropbox. You would need to use an antivirus software to do so.
Regarding restoring your files, do you know around how long ago the ransomware affected your device? Was this perhaps outside of your account's version history window?
If you check your Events page here, can you see a large event when your files were affected?
Let me know - thanks!
- Thanks for your response Daphne , finaly i recovered my files using the shadow copy of my deleted files,
About the version history, yes i tried to restore to versions before the encryption, but it didn't work, any previous versions i refered to were surprisingly encrypted...
By the way, you were right, the folder was virous free, it was just encrypted :)) I discovered another way to restore the files without using the Rewind function. It's more laborious, but still functional.
It happens that the ransomware changes the name of the file, so, for example, a file with a name "report.xlsx", becomes "report.xlsx.id[232323-12312].acuff",
What i did was to change the file name to "report.xlsx" again and, that way, Dropbox showed early versions of the file.
After that, I simply restore the files I wanted.My data was encrypted by ransomware pirates. How can I restore files...when i attempt to restore indiviadul files via version history, it fails to restore to the previous file version. Nothing happens.
Any help would be appreciated.
Thanks
- Lusil
Dropbox Staff
Hi walpole00, thanks for reaching out to us.
I moved your post here, where other users have also had a similar issue.
Since you've already tried restoring your files to a previous version though - great work by the way! - could you let me know the exact error message you get?
If you could send me a screenshot, that would be super helpful.
I can see each file being 'added'/renamed, then the original file being deleted in the events page. Every file in my drop box in now encrypted. It all happened this morning, file by file at 10:09am. When I try to restore the file, nothing happens (from version history)
