220-902 – Q308

A user reports personal files have been renamed and are undecipherable. Images have been to the user’s folder that request payment to unlock the files. The technician has quarantined the infected system and disabled System Restore. Which of the following should the technician do to unlock the user’s files?

A. Perform a clean installation of Windows
B. Remove the malware and recover the files from a backup
C. Initialize and repartition the hard drive to recover the files
D. Run safe mode to decrypt the user’s files

Correct Answer: B