> How to > File Recovery > Petya Ransomware Decryption Tool to Decrypt/ Recover Petya Encrypted Files

Petya Ransomware Decryption Tool to Decrypt/ Recover Petya Encrypted Files

Posted by Abby Haines to File Recovery 2016-10-21

Summary

Finding a Petya ransomware removal or Petya ransomware decryption tool to remove Petya ransomware and decrypt your data? Here, we show you how to remove Petya ransomware and recover Petya encrypted files in simple two steps.

Wannacrypt

Following Wannacrypt, Petya Ransomware also talked as Petrwrap is another dangerous malware that usually causes trouble to computer users. Different from other malware like Cerber, Zepto, locky virus, etc from the locky family, Petya never directly encrypt your files. It just prevents you from accessing your hard drive and data by lock your system. And tells you to pay for a special key to remove or decrypt the Petya ransomware and restore your system and data.

The Ransomware have infected numerous Windows machines in 2016 and now it attacks again and is affecting a large number of users. If you happened to be one of the victims, you may be busy with finding a Petya ransomware removal or Petya ransomware decryption tool to remove Petya ransomware and decrypt your data. Here, you come to the right place. In this page, we will show you how to remove Petya ransomware and recover Petya encrypted file. Just read on to get the step-by-step virus file recovery tutorial.

Step 1. Reboot Petya infected PC from Windows installation disk

Whenever you want to recover Petya encrypted files after the ransomware attacking your computer and locking your system and data, you should first try to remove Petya ransomware using a Petya ransomware removal tool or Petya ransomware decryption tool. 

Here, if your PC can start up normally, just move to step 2 to do the job. And if your PC is controlled by the Petya Ransomware and cannot boot properly, try the following steps to boot the PC using Windows installation disk. If you don't have one, visit Microsoft page about how to create Windows 10 installation media for help.

1) Create a Windows installation USB drive/CD > Reboot Windows from CD/DVD or USB.
2) Once Windows boots from CD/DVD or USB, select Windows Repair.
3) Open Command Prompt: Click Start > All apps > Windows System > Locate and open Command Prompt.
4) Type bootrec / fixmbr and hit enter.
5) Type bootrec / fixboot and hit enter.
6) Type bootrec / rebuildbcd and hit enter.

After finishing all the steps above, reboot System and continue removing Petya ransomware.

Step 2. Remove Petya ransomware using Petya ransomware removal tool

1) Show hidden files on PC and delete suspicious Petya files;
2) Click Start > Type: notepad %windir%/system32/Drivers/etc/hosts at the Search bar and hit Enter;
3) Remove or be aware of different IPs from the localhost IPs; (Remove them if necessary)
4) Right click Taskbar > Start Task Manger > Navigate to Processes;
5) Locate suspicious processes associated with Petya > Right click on process > Open File Location > End Process > Delete the directories relate to Petya suspicious files;
6) Click Start > Search > Type:
 %AppData%
%LocalAppData%
%ProgramData%
%WinDir%
%Temp%

Hit Enter after each search, check each Folder and delete recent entries that relate to Petya ransomware.
7) Run anti-virus or anti-ransomware software to clean up Petya etc virus.

Step 3. Recover or decrypt Petya encrypted files

After removing Petya ransomware from your computer, you can try to retrieve or decrypt Petya encrypted files. Here we offer you two possible methods. Though there is no guarantee that they will be 100% efficient, but you can take a try! 

Method 1. Restore Petya encrypted files via System Restore 

Restoring your computer to a previous backup point using System Restore feature of Windows will be the most efficient and easiest way to retrieve Petya encrypted files. But note that it is helpful only when you have created restore points prior to infection date. 

1) Click Start > Type: System Restore at the Search bar and hit Enter;
2) Choose a Restore Point > Click Next to start restore Windows to a previous state so to get all fines back.

Method 2. Retrieve Petya encrypted files using file recovery software

Petya ransomware usually deletes the file after creating its encrypted copy. So, if method 1 does not work, there may be some chances to recover Petya encrypted files using EaseUS file recovery software, a powerful and popular data recovery program works well to recover deleted files

Step 1. Launch EaseUS data recovery software, select the drive where you want to restore Petya encrypted files and click "Scan" button to move to the next step.

Recover Petya encrypted files - select to scan the specific disk

Step 2. A quick scan will start first. After it completed, a deep scan will automatically launch in order to find more files.

Recover Petya encrypted files - run quick scan and deep scan

Step 3. After scan, choose what  you want and click "Recover" button to retrieve them back. Here, you'd better save all the recovered files on a different drive or device in case of data recovery failure.

Recover Petya encrypted files - click recover button