The following lines were added (+) and removed (-):
== Malicious Use ==== Recovery ==The scammers often prevent easy recovery by deleting all System Restore points on the machine, which normally house backup copies of the registry hives. If a restore point is available, it is the easiest means to recover the machine by restoring to a point prior to the hive being encrypted.