"....Note: A live ransomed Windows environment provides lots of forensic information, like which processes have started and which processes run full screen (blocking access to the desktop). This information gives HitmanPro a solid lead on which files and registry keys belong to the ransomware. An obvious advantage over rescue CDs that boot into a different environment and rely on virus signatures.
Create HitmanPro.Kickstart USB flash drive
The following video will show you how to turn any existing USB flash drive into a HitmanPro.Kickstart USB flash drive, using just a few clicks..."