We recommend use Safe Mode with command prompt to safely perform a recovery of your files. You will have to reboot your computer, so you better save this instruction.
1. Reboot computer
Windows 7 users: You need to reboot your system and before its loaded constantly press “F8” button until you see boot options.
Windows 8/10 users: Press the “Power” button from Windows login screen or Settings. Hold the Shift key on your keyboard and click on “Restart“
2. Start Windows in Safe Mode
After your computer reboots – Click on “Troubleshoot” – press “Advanced options” – “Startup Settings“
Click the “Restart” button and your computer will reload again and show you the list with all options. You need to choose the “Safe Mode with Command Prompt“
3. Run “System Restore” tool
When your windows loads, enter the following line: cd restore and press Enter.
After that type rstrui.exe line and press Enter.
A recovery window will open before you, Click Next to proceed.
4. Select your restore point
In the next window, you need to choose a Restore point. All files in protected drives will be recovered at the time when this point was created (prior to the infection with Budak). In the case when ransomware removes these backups, there will be no Restore points listed. Select a Restore point and click “Next”.
Click “Finish” in this window and confirm the recovery process by pressing “Yes“.
Video guide: Restore files after ransomware attack