Files automatically encrypted, how to remove encryption permanently

Jean updated on Sep 19, 2019 to File Recovery | How-to Articles


Files automatically getting encrypted even copied to an external drive? Relax! This post explains in details about how to disable and remove encryption permanently in Windows 10, 8 or 7, including with the help of third-party file recovery software.

"My files located on the desktop are automatically getting encrypted after moving to any other locations, and the color of the file name changes to green. By clicking the file Property, in the Advanced settings, the option Encrypt contents to secure data is automatically checked without asking my permission. How to disable encryption in Windows permanently?"

Overview of file encryption

Windows Encrypting File System (EFS) is one of the basic file/folder encryption technology that enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer. When files were encrypted in this way, the file name will show green color instead of the normally black text. Additionally, there is some third-party encryption software working in the same way of encrypting files, folders or hard drive partitions, such as BitLocker and TrueCrypt.

Usually, files and folders will be automatically encrypted and keep in a safe location with a certificate and private key in order to prevent other users from reading or editing them. But why so many people are reporting that desktop files or downloaded files automatically getting encrypted without asking?

Why are files automatically getting encrypted

Assuming that you're not really using a file or folder encryption service on your PC, it might be malware or virus infection. Or perhaps it's because you're moving some files to a folder on an encrypted hard drive!

According to general troubleshooting to decrypt encrypted files, you can only use the certificate key or password to unlock the encryption system. Otherwise, see if a designated recovery agent could help. Anyone who is not authorized to remove encryption will receive an error message telling you that access denied.

How to remove encryption permanently in Windows 10/8.1/8/7

Here in this article, we'll focus on solutions to files automatically encrypted by the virus and malware that utilizes its unique encryption scheme and block every access to the encrypted files. In order to decrypt encrypted files without certificate which you can only pay the ransomware to get one, try the following tricks to remove the virus from PC/laptop and decrypt encrypted files!

Fix 1. Download EaseUS Data Recovery Wizard to recover deleted files 

You have to understand that most of the computer virus encrypts files in three steps. First, make an entire copy of all the files; second, delete all original files; third, encrypt the copy. That's why you see encrypted files as soon as your computer were virus infected.

how virus encrypts files automatically

Fortunately, you can hire data recovery professionals or simply use EaseUS Data Recovery Wizard, a third-party file recovery software to recover virus deleted files.


Step 1: Launch EaseUS Data Recovery Wizard.

Select the disk partition or storage location where you lost files and click "Scan".

Run file recovery software.

Step 2: EaseUS Data Recovery Wizard will start a scanning process to find lost files.

The scanning process will automatically start to find all of the files.

Scan and find lost files.

Step 3: Preview and restore lost files.

You can filter scan results by file type, select found files and click "Recover" to get them back. You should save the files to another safe spot in your PC/storage device, not where they were lost from.

Restore virus deleted files.

Fix 2. Uncheck Encrypt contents to secure data and use cmd to remove the virus

Step 1. Open Windows Explorer
Step 2. Right-click the encrypted file or folder, and then click Properties.
Step 3. On the General tab, click Advanced.
Step 4. Clear the Encrypt contents to secure data checkbox

Continue taking time to remove virus without using antivirus software to make sure that the Encrypt contents to secure data option will no longer be stealthy checked.

Step 1. Run Command Prompt as Administrator in Windows.
Step 2. Type attrib -s -h *.* /s /d then press enter. (d should be replaced by the virus infected drive where files were encrypted automatically)
Step 3. Type dir. The command shows you the content of the drive.
Step 4. Check if there is an unusual .exe file. If there's an autorun.inf file, rename it with the new filename.

Manual input of the command line is suitable for computer professionals since wrong commands can cause more severe problems. Therefore, for security and usability, we strongly recommend you try an automatic command line alternative. EaseUS Tool M is a practical tool that enables you to check and fix files system error, enable/disable write protection and system update with one-click instead of typing intricate command lines.

Follow the simple steps below to show hidden files with this 1-click-fix software. 

Step 1.  DOWNLOAD EaseUS Tool M for Free.

Step 2. Start EaseUS Tool M, choose "File Fixing" on the left pane. Next, choose the target drive and keep the "Show hidden files." selected. Then, click the "Fix" button to start the progress.

show hidden files - step 2

Step 3. After the operation completes, click the View button to check the hidden files. 

show hidden files - step 3

By doing these troubleshooting steps, the files will be no longer be encrypted without asking by a virus.


100% of people found this article helpful.


Frequently Asked Questions

1. Why choose EaseUS Data Recovery Wizard?

"EaseUS Data Recovery Wizard is the best we've seen. It's far from perfect, partly because today's advanced disk technology makes data-recovery more difficult than it was with the simpler technology of the past, but it's fast and efficient..."PCMag

"The first thing you'll notice about EaseUS Data Recovery Wizard Pro is that its interface is very clear and uncluttered, with only a small collection of self-explanatory controls. You won't find lots of extra options hidden in a system of hidden menus, either; what you see really is what you get."techradar

"Recover lost files, even after deleting a partition or formatting your drive."Macworld

2. Why cannot I recover 2GB data for free?

It is recommended to check the version installed is Free or Trial because they are different versions.

Trial has data preview function but cannot save any files, while the Free version enables to recover 2 GB files. The default free space is 500 MB and you may share the product on social media to get another 1.5 GB.

3. Why cannot the recovered files be opened?

A file is saved as 2 parts on the storage device: directory info (which is comprised by file name, time stamp and size info, etc.) and data content.

If the files with original file names and folder structures cannot be opened, one possible reason is the corrupted directory info. There is still a chance to recover the data content with the RAW Recovery method in our software.

4. Why isn't it suggested to recover the files back to the original drive?

The storage structure of the lost files would be altered or damaged by any changes on the drive. If you save the recovered files back to the same drive, the original data structures and data content would be corrupted or overwritten, which causes permanent data loss. So you should prepare another disk to save the files.

5. How can I check whether my data is recoverable or not before purchase?

The Free version helps you save 2GB files to better verify the recovery quality of our product before purchase.

6. How long does it take to scan the drive?

It strongly depends on the capacity of your hard drive and the performance of your computer. As reference,most drive recoveries can be completed in around 10 to 12 hours for a 1-TB healthy hard drive in general conditions.

About Data Recovery Wizard

It's super easy to recover 250+ types of files after deletion, disk formatting and virus infection. Click the links and compare the difference of each version.