40

I started getting a strange message when I start my computer. An icon appears in the system tray, and a popup tells me "Encrypting file system - Back up your file encryption key".

I know what EFS is, but I don't use it. To my knowledge, I don't have any encrypted files on my partition. I have searched using Total Commander on all the partitions for files that have the "encrypted" attribute, but I found nothing. So I don't have any encrypted files.

Does anyone know what I did to get this message?

Improve this question
5
  • 2
    See also this qustion posted for Vista stackoverflow.com/questions/11699/efs-encryption-key-pop-up, but this answer worked for me for Windows 7 to determine the encrypted file. stackoverflow.com/questions/11699/efs-encryption-key-pop-up/…
    – goodeye
    Oct 14, 2011 at 4:21
  • 1
    I saw this prompt on Windows 8 today as well.
    – Drew Noakes
    Nov 4, 2013 at 10:03
  • 1
    Windows 8.1 Pro with Update 1 here! I got this yesterday, shortly after changing the theme in Notepad++. I'm not sure if it's related somehow. But it seems plausible. There is at least one TechNet user with the same symptoms. My theme did get saved in Notepad++ however. I didn't have to change folder permissions, but this does seem very odd. I searched wide and far, and I found no encrypted folders or files on any partition. But I did backup the encryption key.
    – Samir
    Nov 2, 2014 at 13:57
  • 2
    This one helped me to solve it: Happened here on a Windows 2012 Server (non-R2) when I created a table via an SQL script in SQL Server Management Studio 2016 (SSMS). It created an encrypted file "C:\Users\MyUser\Documents\Visual Studio 2015\Backup Files\Solution1\~AutoRecover.~vs6EE1.sql"
    – Uwe Keim
    Mar 7, 2017 at 16:16
  • This happened to me immediately after Alienware Command Center did an update; I don't use EFS or BitLocker; on Win 10. cipher /U /N didn't find any results. I'll circle back here if I find an issue later. Just FYI in case someone else has the same related circumstances (Alienware update).
    – pbristow
    Aug 4, 2020 at 14:44

7 Answers 7

Reset to default
16

Just had this yesterday - 4th Jan 2014.

A trojan has installed itself - even with Norton Internet Security installed :-(

Used cipher /U /N command in administrative Command Window to find the encrypted file called HPM3Util.exe in Startup folder which was a Trojan. Used Norton's Power Eraser to clean off.

Hope this helps anyone else...

Improve this answer
3
  • 2
    cipher /U /N helped me find that my password manager 1Password was the cause of this message.
    – David Pärsson
    Oct 8, 2016 at 7:28
  • @DavidPärsson I ran the cipher /u /n test and it showed C:\Users\....\AppData\Local\AgileBits\OPX4.auth (1Password 4) How did you get rid of the EFS prompts? Win 7, 64 bit Ultimate.
    – Jon Grah
    Oct 31, 2016 at 5:18
  • 1
    @JonGrah, since I'm backing up and syncing my 1Password vault across multiple devices, I thought that it was safe for me to dismiss the message and don't backup the encryption key.
    – David Pärsson
    Oct 31, 2016 at 9:01
12

I think I have resolved this. I ran certmgr.msc, and I have seen that there was a certificate under "Personal". That certificate was issued yesterday. The only thing I did yesterday was install Office 2010, and use it to save a document onto my SkyDrive (just out of curiosity).

I think that created the certificate, and Windows prompted me to save it.

Now I deleted that certificate, and I don't get the popup anymore.

What do you think? Is my explanation plausible, or could something else have happened?

Improve this answer
2
  • I got the warning just after trying Skydrive, too. Seems like a plausible explanation. I was able to access old Skydrive files even after deleting the certificate, although it seems a bit dangerous in case they ever start using it.
    – Vimes
    Feb 23, 2014 at 20:25
  • had similar issue - EFS cert backup no encrypted files used, possibly related with now renamed onedrive - it now has encrypted vault, clean reinstall of windows month ago, traced this to self issued encryption certificate in user personal certificates. Strangely the certificate was 'mis-configured', the valid end date was in past and before start date, exported for safety and deleted. EFS message went away, will update if something changes or if run into problems.
    – drk
    Dec 15, 2019 at 12:42
1

Is it this icon?

Bitlocker

If it is, then it sounds like Bitlocker to me and not EFS. Is it your personal computer, or a work computer? Bitlocker can be turned on remotely via GPO if it is a computer from your workplace.

Improve this answer
1
  • 2
    It is my personal computer. I have Windows 7 professional, and it does not include BitLocker
    – Ove
    Jun 11, 2010 at 5:31
1

This should not be a malware.

I had this same message, but it was from browser "Sphere", which is not malicious.

To see if it is malicious:

run CMD as administrator and type

cipher /U /N

if it is from software that you know is clean, dismiss. If it is from some unknown location or software, clean it.

Improve this answer
1

I got a bit paranoid when I saw the popup appear since I associate unwanted encryption of the disk with ransomware.

As the top rated comment recommended I did the following:

  • Run cmd as administrator (important to run as admin, otherwise it yielded no results)
  • Run cipher /U /N in the prompt

The result was multiple files in the following directory:

C:\Program Files\WindowsApps\Microsoft.SunriseBaseGame_1.300.860.2_x64__8wekyb3d8bbwe

All files there are associated with the game Forza Horizon 4 that I installed recently from the Microsoft Store, so in my case it came out clean.

Ran scans with Malwarebytes and Windows Defender to be sure, and those also came out clean.

So in short: It can both be clean (as it seems to be in my case, Microsoft Store apps) and malware (as in the top voted case) - so take precautions and check what files that are being encrypted to determine what it is if you see this popup. Also do a anti-virus scan just to be on the safe side.

Improve this answer
0

It's certainly not a virus.

At one point you installed something like a program, an ID method to do banking, or a driver for a device you plugged in (such as a smartphone). When this happened, a necessary certificate was created.

Since Vista, Windows asks you periodically to backup the encryption keys for these certificate files.

Plug in a USB stick and select Back Up Now and follow the backup guide.

Source: Microsoft Technet

Improve this answer
0

I just deleted my certificates from "Personal" and "Trusted" .. after running:

cipher /U /N

and

cipher /u /h > %UserProfile%\Desktop\Encrypted-Files.txt

from https://social.technet.microsoft.com/Forums/en-US/00291b25-6610-4563-aceb-2acc737b9cfa/prompt-popping-up-to-back-up-file-encryption-certificate-and-key?forum=win10itprogeneral

and it all came up blank.

Hopefully nothing bad happens haha..

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .