Hi - there are different variants of the crypto virus - but it is normally better to restore the whole mas90 folder.... you should NOT overwrite - make copies of the mas90 folder, and rename it before you restore, in case the backup is not valid - leaves you the option of paying the ransom if you need to. Good luck....