How to recover
Files encrypted by Help50 ransomware
from Windows

My device has been recently hit by ransomware Help50, and most of my documents have now been marked with .dat extensions. I was wondering if there was any way possible I could recover my files? Additional files the virus has created on my PC are: DECRYPT_FILES.txt; Project1.exe.

Help50 virus is new and so far mysterious crypto-ransomware virus which prevalence is currently very low. Nevertheless, a few cases of its hijack came to experts’ attention at the end of March 2017. Naturally, there wasn’t enough time to come up with any decryption software that would help recover files encrypted by Help50 for free. In fact, such decryption may not even be possible since the virus uses a strong XOR encryption to lock media files, documents, archives and other predetermined data. It is likely that the files will remain permanently damaged and marked with .dat extensions because according to the reports, the hackers fail to deliver even the paid decryption tools. Thus, if you are already infected with this ransomware, the only option you are left with is Help50 removal from the system. Software like [d1] can be used for this purpose. When the virus is eliminated, lost files can be recovered from backups.

Unfortunately, such crucial part of data security as creating backups is often overlooked by users and results in major problems when files are lost, accidentally deleted, or corrupted by malware. Then, the victims can only try to save themselves with the help of alternative data recovery methods. You can backup the encrypted data using CryptoSearch tool for future decryption. Below we will provide three recovery methods that were proven successful in cases of ransomware attacks.

Help50 recovery options:

Method 1. Data Recovery Pro

There aren’t a lot of automatic tools that can be used to recover files from such serious malware attacks as Help50. Luckily, there is an exception -- Data Recovery Pro. When enabled, this tool carries out the system scan automatically and recovers encrypted data. Of course, such tools are not actual decrypters, so you should not expect them to roll back your system to a pristine condition. Here is how to use this tool:

• Get started by downloading Data Recovery Pro to your computer (http://2-spyware.com/download/data-recovery-pro-setup.exe);
• Install the program following the steps indicated in the Data Recovery Setup;
• Launch the program and enable the system scan to search for files encrypted by Help50;
• Follow the directions on the screen to restore them.

Method 2. Windows Previous Versions feature

Windows has an in-built function that can prove itself useful when recovering files encrypted by Help50. This is called the Windows Previous Versions feature. We should point out though that this feature works only in cases when System Restore function was enabled before the virus infiltration. Besides, Windows Previous Versions feature will only be useful for the recovery of a single file at the time, so you will not be able to recover your entire system when using it. If this condition suits you, follow these steps:

• Locate the file you want to recover and right-click it;
• In the menu click "Properties" and choose "Previous versions" tab;
• The new "Folder versions" window will display the list of available file copies. On this list, select the preferred version and confirm your choice by clicking "Restore."

Method 3. ShadowExplorer

Last but not least, you should try to recover your files with the help of ShadowExplorer. This tool uses Volume Shadow Copies of encrypted files to render them readable again, so if the virus has not deleted these files, it is sure worth trying this method out.

• Go to Shadow Explorer’s official website http://shadowexplorer.com/ and download the tool;
• Complete software installation following the steps indicated in the Shadow Explorer Setup Wizard;
• When the installation is done, open the program and go to the drop-down menu in the top left of the application screen. Select the disk containing encrypted data and look through the installed folders;
• Open the desired folder’s settings by right-clicking the folder icon and hit "Export." Select the location where the data will be stored.