Safe recovery of files locked by ransomware

[Ntorabi]

Unfortunately my pc got infected by a ransomware. It locked all my files including the data i had on my dropbox, shared with my colleagues, changing their extension to "lalo".

First, I wanted to know if there is a way to recover my data because they're really important and we've got no backup.
Then i want to make sure these files are not affected by the malware and it can't infect my colleagues' devices.

I would really appreciate it if you could help me.

[walpole00]

I can see each file being 'added'/renamed, then the original file being deleted in the events page.  Every file in my drop box in now encrypted.  It all happened this morning, file by file at 10:09am.  When I try to restore the file, nothing happens (from version history)

[walpole00]

Heres a screen shot of the events...every file shows as being 'added' with a new file extn, then the original file is deleted.  None of the original files that have been deleted are in the deleted folder.

[Lusil]

In that case, we'll have to take a better look into this together via ticket. 

I've sent you one to the email address connected to your Community profile, so when you have the chance, check your inbox and we'll go from there. 

Cheers!

[Ntorabi]

sorry to hear you've got the same problem,

actually the ''version history'' didn't work for me either, any version I refered to from an encrypted file, changed in to an encrypted file despite it wasn't encrypted in that time . I used the "show deleted files'' option in right side of the browser, and restored my files from there one by one,

hope it will work for you too, let me now incase you found another solution for this.

@walpole00 

[waheed254]

It Worked Really.
Thanks Brother.

[waheed254]

Your Method worked well also get recovered my data.
Thanks

[Brenae]

Help! I need to urgently rewind my files back to a date prior to 11/2/22.  My files have been encrypted by Royal Ransom Virus and I do not have access to my data.  Can someone help me with this?  I currently have the Basic plan. If I upgrade to the Plus plan will I then be able to Rewind to a previous date? 

Do I delete the corrupted files off of my computer, or will the rewind update them automatically, etc. 

Can someone please help me ASAP this is very urgent. 

Brenda

[Mark]

Hi

Have a look at https://help.dropbox.com/security/ransomware-recovery

Basically you need to clean your machine first and THEN recover. Upgrading to paid will let you rewind 🙂

[Brenae]

Thank you. My C drive drive did not have any bad files on it. The only folder infected was my Dropbox folder. I uninstalled Dropbox, logged out of my account, et cetera on my local computer.
Should I delete the Dropbox folder on my local computer c drive, before I rewind my files or will the rewind update the files on my local computer you do when I synch?

[Mark]

Personally I'd just wipe the Dropbox directory and everything near it and then start a fresh 🙂