# \[SOLVED\] How to restore .DOCM Virus files?

**URL:** <https://onehack.st/t/solved-how-to-restore-docm-virus-files/75216>\
**Category:** Discussion & Solutions\
**Tags:** solved, antivirus\
**Created:** [March 26, 2020, 12:34am UTC](https://onehack.st/t/solved-how-to-restore-docm-virus-files/75216 "2020-03-26T00:34:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Majdi\_Taani](https://onehack.st/user_avatar/onehack.st/majdi_taani/32/35831_2.png) [@Majdi\_Taani](https://onehack.st/u/Majdi_Taani)\
**Post date:** [March 26, 2020, 12:34am UTC](https://onehack.st/t/solved-how-to-restore-docm-virus-files/75216/1 "2020-03-26T00:34:20Z")

</div>

Hey Guys,

So i have an issue where by one of the computers has been infected and now files have been changed to a “.DOCM” extension.

Any ideas on how to decrypt it and stop such ransomware infections for the future on a Windows Desktop.

---

<div class="post-metadata">

**Author:** ![Hyperdemongod](https://onehack.st/user_avatar/onehack.st/hyperdemongod/32/26170_2.png) [@Hyperdemongod](https://onehack.st/u/Hyperdemongod)\
**Post date:** [March 26, 2020, 4:35am UTC](https://onehack.st/t/solved-how-to-restore-docm-virus-files/75216/2 "2020-03-26T04:35:29Z")

</div>

## **Remove .Docm Ransomware Virus**

# **Step1:** [Reboot in **Safe Mode**](https://howtoremove.guide/how-to-enter-in-windows-safe-mode-all-versions/)

# **Step2:**

**WARNING! READ CAREFULLY BEFORE PROCEEDING!**

> We get asked this a lot, so we are putting it here: Removing **.Docm** manually may take hours and damage your system in the process. We recommend [downloading SpyHunter](https://howtoremove.guide/download-software-en-v3/) to see if it can detect **.Docm** files for you.

Press **CTRL + SHIFT + ESC** at the same time and go to the **Processes Tab**. Try to determine which processes are dangerous.

![malware-start-taskbar](https://howtoremove.guide/wp-content/uploads/2015/05/malware-start-taskbar.jpg "Task Manager")

**Right click** on each of them and select **Open File Location**. Then scan the files with a free online virus scanner.

After you open their folder, **end the processes** that are infected, then **delete their folders.**

**Note:** If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections.

# **Step3:**

Hold the **Start Key** and **R**  **–**  **copy +**  **paste** the following and click **OK** :

**notepad %windir%/system32/Drivers/etc/hosts**

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

![hosts_opt (1)](https://howtoremove.guide/wp-content/uploads/2015/07/hosts_opt-1.png "Hosts file")

Type **msconfig** in the search field and **hit enter.** A window will pop-up:

![msconfig_opt](https://howtoremove.guide/wp-content/uploads/2015/07/msconfig_opt.png "System Configuration")

Go in **Startup —\>**** Uncheck** entries that have “Unknown” as Manufacturer.

- Please note that ransomware may even include a fake Manufacturer name to its process. Make sure you check out every process here is legitimate.

# **Step4:**

To remove **.Docm** on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

> If you want to avoid the risk, we recommend [downloading SpyHunter](https://howtoremove.guide/download-software-en-v3/)  
> a professional malware removal tool.

Type **Regedit** in the windows search field and press **Enter.** Once inside, **press CTRL** and **F** together and **type** the virus’s **Name.**

_ **Search** _ for _the ransomware_ in your registries and **delete** the entries. Be extremely careful – you can damage your system if you delete entries not related to the ransomware.

Type each of the following in the Windows Search Field:

1. **%AppData%**
2. **%LocalAppData%**
3. **%ProgramData%**
4. **%WinDir%**
5. **%Temp%**

Delete everything in Temp. The rest just check out for anything recently added.

# **Step5:** [Decrypt .DOCM Files](https://howtoremove.guide/how-to-decrypt-ransomware/)

Follow this video:

[![](https://img.youtube.com/vi/hEA_drWPlzs/maxresdefault.jpg ".DOCM File Virus Ransomware Removal") ](https://www.youtube.com/watch?v=hEA_drWPlzs)

And  
to prevent ransomware infections, follow this

> [@Enable Ransomware Protection In Windows 10 Built-In Defender Anti-Virus](https://onehack.st/t/enable-ransomware-protection-in-windows-10-built-in-defender-anti-virus/59077):
>
> Windows Defender, the built-in real-time antivirus in Windows 10, has a critical security feature that’s disabled by default: Ransomware Protection. Strangely though, the feature was added in a Windows 10 version 1709 update in October 2017, which comes as a surprise for many users who may not have known about it until now. What’s worse is that ransomware is a serious threat that has implications as it silently encrypts your data and locks down your PC, eventually blocking access to your data u…