I have been attacked with a ransom malware, with all my files converted into .besub extension. And the hacker left a note and asking for ransom.

Obviously the data is important and I want it back.

Note that, my OS is genuine Windows 10. And i was using Defender, for protection (WHICH IS obviously, you know what i mean). But still, isn't the responsibility should be taken by Microsoft? What they can do in that?

And what should I do to get my data back?

I can provide you a sample file if you ask.

  • 2
    Hindsight is 20/20, but the best protection against ransomware (as well as lots of other loss-of-data scenarios) is to have proper backups of all your important data. – Philipp Jul 2 '19 at 16:04
  • 1
    Now that you've been infected, they probably can't do anything. Ransomware normally uses strong encryption. In the future, keep better backups -- malware is only one reason why. If you back up your data regularly, you're protected from anything that damages your data, whether it's dropping your computer into a river, viruses, particularly technically illiterate family, whatever. – Fund Monica's Lawsuit Jul 2 '19 at 16:16
  • 2

Although there have been poorly implemented ransomware attacks in the past that have been broken, I haven't seen that in a while so it's unlikely you can break it. Nevertheless it's worth googling.

That said, here's a method that may provide partial recovery of critical files.

Generally the ransomware attacks don't touch Windows Shadow Volumes. Get yourself a shadow volume tool like ShadowExplorer.

Export what critical files you can from ShadowExplorer. These will be back level files missing their most recent updates. There may be many versions, in which case you likely want the most recent file but check all the volumes, or there may be none.

Good Luck and let us know your results!

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.