.911 File Ransomware Virus Removal (+File Recovery) - How to, Technology and PC Security Forum | SensorsTechForum.com

.911 File Ransomware Virus Removal (+File Recovery)

This article aims to show you how to remove the .911 files virus (GlobeImposter 2.0 variant) and to explain how to recover .911 encrypted files without paying ransom.

Yet another variant of the GlobeImposter virus has come out in the wild, encrypting files on the computers infected by it after which adding the .911 file extension to them and asking from victims to pay a hefty ransom fee in order to get the files to be openable again. The .911 file virus follows the tendency of 3 digit file extension, used in the previous two GlobeImposter ransomware variants – the .725 and ..726 file viruses.

Threat Summary

Name.911 File Virus
TypeRansomware, Cryptovirus
Short DescriptionEncrypts files on the computers infected by it and then demands a ransom to be paid in BitCoins to get them to work again.
SymptomsAdds the .911 suffix to the encrypted files and drops the !SOS!.html ransom note with full instructions how to pay the ransom.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .911 File Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .911 File Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

How Does .911 Ransomware Infect Victims

For the .911 file virus to infect a given computer successfully, the crooks behind it may engage in various different tactics. The primary of those is to use social engineering skills in order to trick potential victims into opening spam e-mail messages. These messages may have either a malicious web link or an e-mail attachment which only pretends to be important. The pretext they use to convince users to click on the malicious objects is that they are usually important invoices, bank account statements or other such documents. They may also pose as large companies or banks, like the following:

  • PayPal.
  • Amazon.
  • FedEx.
  • DHL.
  • UPS.

Usually the cyber-crooks archive the e-mail attachments in .zip files so that they evade protection scanners from the e-mail providers. In order to check if an archive is malicious or not for free, you can use ZipeZip(https://zipezip.com/).

In some cases, the files which are used in order to cause an infection may not be executable files or scripts. They may also be malicious Microsoft Word (.docx) documents or .PDF files that may have malicious macros embedded. The documents do not infect your computer when you open them and appear normal. However, some of them claim they are locked and in order to see the content, you must click on “Enable Content” to enable macros. Those macros are in fact malicious and they are the ones that cause the infection itself in the following way:

.911 File Ransomware – Malicious Activity

Being a GlobeImposter variant, this virus is little different than the other viruses, at least at first glance. However, there are several key improvements and areas by which it can be recognized. One of those is it’s distinctive ransom note, which the virus drops after an infection takes place. It is named !SOS!.html and aims to get victims to pay a hefty ransom to restore the files.

Besides the main ransom note, the virus also drops it’s malicious files on the compromised computer. They may be located in the usually targeted Windows folders:

  • %AppData%
  • %Roaming%
  • %Local%
  • %LocalLow%
  • %Temp%

After the files are dropped, the .911 file virus may delete the shadow volume copies on the computers infected by it. The virus performs this by executing a batch (.bat) script that inserts the following command as an administrator in Windows Command Prompt:

→ vssadmin delete shadows /for={DrivePartition} /oldest | /all | /shadow={Identification of the shadow copies}] /quiet

In addition to modifying the volume shadow copies of the infected machine, the virus may also add custom registry entries that automatically run the malicious files on Windows boot:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The Encryption of .911 Files Ransomware

When .911 GlobeImposter variant encrypts your files, your computer may slow down or even briefly freeze and during the encryption you will not be able to stop it as you won’t notice it, because it is a fast process.

What the virus does is it firstly targets the most often used documents, videos, pictures, archives and other files on your computer which may have the following file extensions:


After the encryption process is complete, the virus adds the .911 file extension to the files and their final appearance is changed to the following:

Even though you may feel convinced into paying the ransom, it is strongly inadvisable. Instead, recommendations are to focus on removing this ransomware and try to recover your files using different methods.

Remove .911 Ransomware and Restore Files

Before beginning the removal of .911 files virus it is strongly recommended to backup your files beforehand. Then, you can proceed with the removal of this virus, preferably by following the instructions we have posted below. They are divided in manual and automatic to best help you with the removal process. For maximum effectiveness, malware researchers strongly recommend using a ransomware-specific removal software to help you scan for and remove all the objects associated with the .911 variant of GlobeImposter from your PC and protect it in the future.

After having removed this ransomware, you can attempt and restore your files, by following the alternative methods for file recovery below in step “2. Restore files encrypted by .911 Files Virus”. They are not 100% effective but may help you recover most of your encrypted files without having to pay the ransom.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share