xrecovery_logo
Main Menu
How to Recover Files After a Virus or Malware Attack: Ransomware, Trojan & Virus Data Recovery
By XRecovery Team  |  Updated: August 6, 2026  |  17 min read

How to Recover Files After a Virus or Malware Attack: Ransomware, Trojan & Virus Data Recovery

Your files are gone. Or encrypted. Or hidden. Or all your folders now contain shortcuts instead of real files. Malware attacks are uniquely devastating because the damage is intentional — someone designed this software to harm your data. But here's the critical thing to understand: different types of malware damage files in different ways, and your recovery approach must match the specific attack type. Using the wrong approach wastes time and can make recovery harder. Compare all 8 data loss scenarios.

Table of Contents

  1. Types of Malware & How They Damage Files
  2. Immediate Response — What to Do First
  3. Method 1: Unhide Files with ATTRIB Command (Trojan/USB Virus)
  4. Method 2: Restore from Shadow Copies (Ransomware)
  5. Method 3: Free Decryptors — NoMoreRansom.org
  6. Method 4: Restore from Antivirus Quarantine
  7. Method 5: XRecovery Recovery After Malware
  8. How to Prevent Malware Data Loss
  9. Frequently Asked Questions

1. Types of Malware & How They Damage Files

Malware TypeWhat It Does to FilesBest Recovery MethodRecovery Chance
RansomwareEncrypts files in place, demands payment for decryption key. Files are still on disk but unreadable.Shadow copies → NoMoreRansom → recovery software (Method 2)Low-Medium
Trojan / USB Shortcut VirusHides files, marks them as system/hidden, creates fake shortcuts. Files are still there — just invisible.ATTRIB unhide (Method 1)Very High
WormDeletes or overwrites files, spreads via networks and USB. Actual file deletion.XRecovery after worm removal (Method 5)Moderate
Overwrite VirusOverwrites file content with malicious code. Original data destroyed in overwritten sectors.XRecovery — partial recovery possible (Method 5)Low-Moderate
Spyware / AdwareRarely damages files directly. Files may be in antivirus quarantine (false positive).Check quarantine (Method 4)High
Bootkit / RootkitDamages boot sector or partition table. Drive may appear empty or RAW.XRecovery Deep Scan (Method 5)Moderate-High
Critical Ransomware Rule: Never pay the ransom. Law enforcement agencies worldwide advise against it — payment funds criminal operations, marks you as a paying target for future attacks, and offers no guarantee you'll receive a working decryption key. Many victims pay and get nothing.

2. Immediate Response After a Malware Attack

Follow these steps in exact order.

  1. Disconnect from the network immediately. Unplug Ethernet. Turn off Wi-Fi. This prevents the malware from spreading to other devices, communicating with command servers, or exfiltrating data.
  2. Do NOT turn off the computer if you suspect ransomware. Some ransomware variants delete shadow copies on reboot. Keep the system running until you've checked for shadow copies and documented the ransom note.
  3. Photograph the ransom note or error messages. This helps identify the malware variant, which is essential for finding the right decryptor on NoMoreRansom.org.
  4. Remove the malware. Run Windows Defender Offline scan or a bootable antivirus (Malwarebytes, Bitdefender Rescue Disk). Only proceed to file recovery after the system is clean.
  5. Do NOT format the drive or reinstall the OS before attempting recovery. Formatting destroys recoverable data.

1 Unhide Files — ATTRIB Command ~1 Min

For: Trojan / USB shortcut virus. This is the most common consumer malware scenario — and the easiest to fix. The virus doesn't delete files; it marks them as hidden and system files, then creates fake shortcuts that look like your folders. Your actual files are 100% intact.

  1. Open Command Prompt as Administrator.
  2. Navigate to the affected drive: X: (replace X with your USB or drive letter).
  3. Run: attrib -h -s -r /s /d *.* — This removes Hidden (-h), System (-s), and Read-only (-r) attributes from all files (/s = subdirectories, /d = directories too).
  4. Your files reappear immediately. Delete the fake shortcuts.
  5. Run a full antivirus scan to remove the virus that caused this.
Pro tip: If the virus keeps re-hiding files, the malware is still active. Boot into Safe Mode, run the attrib command, copy files to a clean drive, then wipe the infected drive.

2 Restore from Shadow Copies ~3 Min

For: Ransomware. Windows automatically creates shadow copies (restore points) that may contain previous versions of your files from before the encryption. Ransomware often tries to delete these — but doesn't always succeed.

  1. Right-click any encrypted folder → "Properties" → "Previous Versions" tab.
  2. If versions are listed, select one from before the attack → click "Open" to browse.
  3. Copy your clean, unencrypted files to a different drive.
  4. You can also use Shadow Explorer (free tool) for a more comprehensive shadow copy browser.

3 Free Ransomware Decryptors — NoMoreRansom.org Free

For: Ransomware with known decryption tools. NoMoreRansom.org is a free initiative by Europol, the Dutch National Police, and cybersecurity companies (Kaspersky, McAfee). They maintain a database of free decryptors for hundreds of ransomware variants.

  1. Go to NoMoreRansom.org → "Crypto Sheriff."
  2. Upload a sample encrypted file and any ransom note. The tool identifies your ransomware variant.
  3. If a decryptor exists, download and run it on a copy of your encrypted files (never the originals).
  4. Major decryptor providers also include: Emsisoft Decryptor Tools, Kaspersky RakhniDecryptor, Avast Free Ransomware Decryption Tools.

4 Restore from Antivirus Quarantine ~1 Min

Antivirus software sometimes quarantines legitimate files as false positives — especially during aggressive scans after a malware attack.

  • Windows Defender: Windows Security → Virus & threat protection → Protection history → find quarantined file → Restore
  • Malwarebytes: Detection History → Quarantined items → select file → Restore
  • Restored files return to their original location.

5 XRecovery Recovery After Malware Most Reliable

When files were actually deleted or corrupted — not just hidden — XRecovery provides the most thorough recovery. It scans the drive at the sector level to find files that were deleted during or after the attack, including earlier unencrypted versions that may still exist in free space. Read-only scanning ensures safety.

Step-by-Step:

  1. Remove malware first. Boot from a clean USB environment if needed.
  2. Download XRecovery to a different drive.
  3. Select the infected drive → Deep Scan. This searches for file signatures (JPEG, DOCX, PDF, etc.) regardless of what the malware did to the file system.
  4. Preview files to verify they're unencrypted and intact. XRecovery may find pre-encryption versions of files that ransomware encrypted.
  5. Recover to a different drive.

See 1000+ supported file types · detailed tutorial

How to Prevent Malware Data Loss

  1. Use the 3-2-1 backup rule. At least 1 copy offline (disconnected from your computer) — ransomware cannot encrypt offline backups. Maximize your recovery readiness.
  2. Keep Windows and all software updated. Most ransomware exploits known vulnerabilities that already have patches.
  3. Use reputable antivirus with real-time protection. Windows Defender is adequate for most users. Enable ransomware protection (Controlled Folder Access).
  4. Never open email attachments or links from unknown senders. Phishing is the #1 ransomware delivery method.
  5. Disable Remote Desktop Protocol (RDP) if not needed. RDP is the #2 ransomware entry point.
  6. Keep XRecovery installed on a separate drive for immediate recovery access. Download XRecovery.

Virus Attacked Your Files? Recover Them Now.

XRecovery finds files that malware tried to destroy. Deep Scan — free preview. Read-only safe.

Download XRecovery Free

Frequently Asked Questions

Can I recover files after ransomware without paying?

Yes. Try shadow copies, NoMoreRansom.org free decryptors, or XRecovery to find unencrypted file versions. Never pay. XRecovery free scan.

My files are hidden — how do I unhide them?

Open CMD as Admin → attrib -h -s -r /s /d X:\*.*. This is a Trojan/USB virus — your files are intact, just hidden.

Should I remove malware before or after recovery?

Before. Never run recovery software on an actively infected system. Boot from a clean USB environment if needed.

Where do I find free ransomware decryptors?

NoMoreRansom.org (Crypto Sheriff tool). Also: Emsisoft Decryptor Tools, Kaspersky RakhniDecryptor, Avast Free Decryption Tools.

Can antivirus software recover my encrypted files?

Antivirus removes the infection but rarely decrypts files. It stops further encryption. Use decryptors or XRecovery to find unencrypted versions.

Malware Destroyed Your Files? Don't Give Up.

XRecovery scans deep to find what malware tried to hide. Free preview.

Download XRecovery Free