I recently found and removed a trojan and an infostealer after scanning my computer with Malwarebytes. While cleaning up afterward, I noticed a folder named "Crypto" inside my AppDataLocalLow directory. I assumed it was related to the malware and deleted it, but later searches suggested it might be a legitimate Windows-related folder.
I ran Windows File Recovery in regular mode and saved the recovered data to an external drive, but I cannot find the folder in the results. I have kept the computer powered on, disconnected it from the internet, and have avoided using other programs.
How important is this folder, and can Windows repair or recreate it? Would a clean Windows installation resolve both the malware concerns and any damage from deleting the folder? Should I try an extensive recovery scan or another recovery tool? If I recover the folder, would copying it back to its original location actually fix anything, or could that cause problems?
3 Answers
Because an infostealer was found, the safest solution is a truly clean Windows installation from trusted installation media. Back up only personal documents and other files you have checked carefully, then reinstall rather than relying on a repair install. From a separate clean device, change important passwords, revoke active sessions, and enable two-factor authentication. A reinstall will rebuild Windows system files, but it cannot recover deleted personal data or restore encryption keys that were removed.
Stop using the computer for recovery purposes. Every additional write can overwrite deleted data, especially on an SSD where TRIM may make recovery impossible. Do not recover files back onto the same drive; save them to the external drive. The chances also depend heavily on whether the system drive is an SSD or a hard disk. An extensive scan may find more, but it can also take much longer and cannot guarantee recovery.
A folder named Crypto under an AppData location can be part of Windows or applications, but the exact path matters. Deleting it does not necessarily mean Windows is permanently broken, and copying a recovered folder back is not guaranteed to restore the security keys or application data that were inside it. Some programs may simply recreate their folders, while saved login tokens or certificates could be lost and require signing in again.
A repair install can replace damaged Windows components while preserving some data, but it is not the same as removing an infostealer completely. For a confirmed credential-stealing infection, wiping the system and reinstalling is the more trustworthy option.