To remove ransomware in Windows 7, access the Advanced Boot options, and select the Safe Mode with Command Prompt option. Activate the System Restore dialog box via the command prompt, and select one of the restore points prior to the date of ransomware infection.
- Access the Advanced Boot Options screen
Click on the Start button, hover over the arrow pointing to the right next to the Shut Down button, and select the Restart option from the drop-down menu. Press and hold the F8 key before the Windows logo appears on the screen. If that doesn’t work, tap the F8 key repeatedly until the Advanced Boot Options screen activates.
- Access the System Restore dialog box
Select the Safe Mode with Command Prompt option, and press Enter. Once the command prompt shows up, type in “rstrui.exe”, and press Enter.
- Restore the system to a previous point
Check the box next to the Show More Restore Points option. Look at the entries in the Date and Time column, and select the restore point just before the date when your computer got infected with ransomware. Click on the Next button, make sure that the Drive section displays your primary hard drive, and click on Finish. Once the restoration process is complete, restart your computer, and boot Windows 7 into regular mode by selecting the Start Windows Normally option in the Advanced Boot Options screen.