How to Restore Files from a Backup in Windows 7/8/10/11

We recommend using Safe Mode with a command prompt to perform a recovery of your files safely. You will have to reboot your computer, so you better save this instruction.

1. Reboot computer

Windows 7 users:You need to reboot your system and before its loaded constantly press “F8” button until you see boot options.

Windows 7 Reboot

Windows 8/10/11 users: Press the “Power” button from Windows login screen or Settings. Hold the Shift key on your keyboard and click on “Restart

Windows login screen

2. Start Windows in Safe Mode

After your computer reboots – Click on “Troubleshoot” – press “Advanced options” – “Startup Settings

Advanced options

Click the “Restart” button, and your computer will reload again and show you the list with all options. You need to choose the “Safe Mode with Command Prompt

Safe Mode with Command Prompt

3. Run “System Restore” tool

When your windows loads, enter the following line: cd restore and press Enter.

cmd: cd restore

After that type rstrui.exe line and press Enter.

cmd: rstrui.exe

A recovery window will open before you. Click Next to proceed.

recovery window

4. Select your restore point

In the next window, you must choose a Restore point. All files in protected drives will be recovered at the time when this point was created (prior to the infection with Budak). In the case when ransomware removes these backups, there will be no Restore points listed. Select a Restore point and click “Next”.

Select a Restore point

Click “Finish” in this window and confirm the recovery process by pressing “Yes“.

Confirm the recovery process

Video guide: Restore files after ransomware attack

Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.


  1. my laptop was attacked by koti virus on 20 May 2020. I formated my laptop om 23May 2020. Now I can get restoring point?.

    1. I somehow fixed the password problem but my internet is disable while i’m still use it normally, is it maybe due to the ransomware

  2. Is there a chance that the weui virus change tha password after i reboot with the safe mode with command prompth??

  3. helo sir
    my laptop also attacked by a torjan virus and and its all partition file become MAQL file how even audio and video files how can solve this problem please help me

Leave a Reply

Back to top button