Abstract: Methods and devices for recovering data may include receiving an identification of at least one file on the computer device impacted by a cyber threat. The methods and devices may include receiving a last known good time stamp for the at least one file that identifies a point in time prior to the cyber threat. The methods and devices may also include transmitting, to a remote backup provider associated with the at least one file, a restore request to restore the at least one file with restored content based at least on the last known good time stamp. The methods and devices may include receiving, from the remote backup provider, a restored file with the restored content.

Abstract: Methods and devices for recovering data may include receiving an identification of at least one file on the computer device impacted by a cyber threat. The methods and devices may include receiving a last known good time stamp for the at least one file that identifies a point in time prior to the cyber threat. The methods and devices may also include transmitting, to a remote backup provider associated with the at least one file, a restore request to restore the at least one file with restored content based at least on the last known good time stamp. The methods and devices may include receiving, from the remote backup provider, a restored file with the restored content.

Abstract: Aspects of the subject matter described herein relate to removing malware from a computer system. In aspects, an anti-malware engine detects malware and writes a tool onto a storage device. The anti-malware engine disguises the tool to make it more difficult for malware to detect that the tool is on the storage device. In addition, the anti-malware engine encrypts and writes remediation actions to be taken by the tool to the storage device and requests that the computer reboot. After rebooting, the computer executes the tool which takes the remediation actions including removing the malware.