.emilysupp Files Virus – How to Remove and Restore Files

.emilysupp Files Virus – How to Remove and Restore Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article has been created in order to explain what is the .emilysupp ransomware and how to remove it from your computer and restore encrypted files.

The .emilysupp files virus is the type of ransomware which is from the GlobeImposter family of viruses. The ransomware aims to encrypt the files on your computer after which it drops a ransom note file, called Read_Me.html and also encrypts the files on your computer adding the .emilysupp file extension. The ransomware virus aims to get victims to pay a hefty ransom fee in BitCoin and gives a deadline of 12 hours to do so. Otherwise it threatens to delete the decryption key. If your computer has been infected by the .emilysupp files virus, we advise that you read this article to learn how to remove the .emilysupp files virus from your computer and how to restore files, encrypted by it.

Threat Summary

Name.emilysupp Ransomware
TypeRansomware, Cryptovirus
Short DescriptionA variant of GlobeImposter family of ransomware viruses. The malware aims to encrypt the files and gives 12 hours to pay ransom to decrypt them.
SymptomsYour files are encrypted with the added .emilysupp file suffix. A ransom note, called Read_Me.html is also dropped.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .emilysupp Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .emilysupp Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.emilysupp Files Virus – Spread

The .emilysupp files virus may infect victims via several methods, the primary of which has been reported to be conducted via spammed e-mail messages. Such e-mails may contain deceptive claims that they are legitimate and contain important documents, for example:

  • Invoices.
  • Receipts.
  • Banking statements.
  • PayPal account activation forms.

In addition to this, the virus may also be spread as a result of being uploaded on websites, pretending to be a legitimate type of file, while patiently waiting for you to download it. The files it pretends to be are usually often downloaded or sought after programs, like:

  • Installers for different software.
  • License activators.
  • Online software cracks.
  • Patches.
  • Key generators.

.emilysupp Files Virus – More Information & Activity

The .emilysupp ransomware virus is a part of the GlobeImposter family of viruses. These infections aim to make your files unable to be opened while in the same time, they give the possibility to pay ransom to get them back. To reach it’s end goal, that is to get you to pay a “fee” in Bitcoin, the .emilysupp files virus performs series of activities, that begin with the malware having to drop it’s malicious files on your PC. These files may be under different names and often reside in the following Windows Directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Temp%
  • %Roaming%

The files dropped by the .emilysupp ransomware infection may be under different file names, often completely random ones or names that pretend to be legitimate programs of Windows, like Notepad, Paint, etc.

After having it’s files dropped, the .emilysupp files variant of GlobeImposter may start to create mutexes on the infected computer and perform techniques that result in obtaining administrator priviledges. Among the activities of this ransomware may be to create value entries in the following Windows registry sub-keys. This may result in the malware starting to run automatically when you log in Windows. The sub-keys that are targeted for this may be the Run and RunOnce keys, with the following locations:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In addition to modifying the registry sub-keys, the .emilysupp files virus may start to perform other actions on the victim’s computer. It may delete the volume shadow copies and disable system recovery in Windows to prevent you from recovering your files via backup by executing the following commands in Windows Command Prompt without you even noticing:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

The final action after encrypting your files for this infection is to drop it’s Read_Me.html file, that displays the following ransom note:

.emilysupp Files Virus – Encryption Process

The main method of encryption performed by this GlobeImposter ransomware variant is to first exclude system folders of Windows from encryption so that you can pay the ransom. To do this the .emilysupp virus has a whitelist of folders, which the malware skips from encrypting. Other than that, the .emilysupp ransomware encrypts the following types of files which may be important to you:

  • Documents.
  • Videos.
  • Images.
  • Archives.
  • Audio files.
  • Files, used by often installed programs.

Once the virus has finished encrypting your files, it may set the .emilysupp file extension to the files, which may result in the files starting to appear like the image below shows:

Remove .emilysupp Files Virus and Restore Encoded Files

In order for you to get rid of this ransomware virus, we advise that you follow the automatic or manual removal instructions blow. They have been created in order to help you delte this ransomware infection based on how much experience and time you have. The best method for deletion according to security experts however still remains to be the usage of an advanced anti-malware software. Such program will effectively help you remove this software automatically by scanning for it’s malicious objects. In additon to this, it also aims to ensure that future protection is also available in real-time.

If you want to restore files, that have been encrypted by this ransomware virus, we do advise that you try out the alternative file recovery methods underneath in step “2. Restore files, encrypted by .emilysupp Ransomware”. They may not be a 100% guarantee that you will be able to recover all fo the encrypted files, but they may help you recover most of the data.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share