I have a note on my machine which indicates that my machine has ransomware on it. I've done a system restore of my machine back several weeks, and each time the files keep coming back. My files are NOT encrypted, but I am still getting the note.

Any suggestions on how I could find what is causing this note?

  • 3
    The ransomware could be creating the note but then crashing when it tries to actually encrypt a file. Feb 14, 2017 at 11:14
  • Suggestions on how I would detect that, or rather; or whether there would be a Windows Event log confirming this ??
    – KingJohnno
    Feb 14, 2017 at 11:18

1 Answer 1


Before restoring the system, make sure you delete those notes, then you can enable Auditing to track file changes on the folder(s) where you see those files recreated (open folder Properties->Security->Advanced->Auditing). All changes will be reported in the Security log. They will provide you with more information about the process which creates those files.

There are chances you might find the malicious process right in the log information. There is also the possibility to find an intermediary process instead (e.g. a cmd.exe which executes a script that copies files). In this case it would be best also to enable Process Tracking Auditing (this is done from Local/Group Security Policy) before those files are recreated (e.g. after system restore, boot into safe mode and enable the auditing), however this is not guaranteed to work in all cases, as it depends on how the malware gets executed when the system starts.

Last, but not least, you might need to consider the scenario in which the system snapshot you try to restore might be already infected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .