.ERROR File Virus – Remove and Restore Encrypted Files - How to, Technology and PC Security Forum | SensorsTechForum.com

.ERROR File Virus – Remove and Restore Encrypted Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article has been created to help you by displaying how to remove .ERROR ransomware and how to restore encrypted files.

A new ransomware infection, going by the name Error Ransomware has been reported to roam around the web, encrypting files via the AES and RSA encryption ciphers. The virus aims to add the .ERROR file extension to the encrypted files and to rename them, making them not only corrupt but no longer recognizable as well. For the return of the files, Error ransomware demands from victims to pay a hefty ransom fee, most likely in BitCoin. Furthermore, be advised that Error ransomware is not a threat that should be taken lightly and if you are a victim of this virus, it is recommended that you read this article.

Threat Summary

NameError Ransomware
TypeRansomware, Cryptovirus
Short DescriptionA CryptoMix ransomware variant. Encrypts the files on the computers it infects and then asks for payment to decrypt them.
SymptomsRenames the files (A-Z 0-9 random names) and then adds the .ERROR file extension to them.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by Error Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Error Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Error Ransomware – Distribution Methods

If you have been infected by Error Ransomware, the most likely method by which the infection has occurred Is via e-mail spam messages. Such messages often aim to pretend to be legitimate e-mails that carry seemingly important documents in .zip, .rar or other archives. The documents are in fact the infection files of Error ransomware and a deceitful message, like the example below may be used to spread them:

Besides the example above, the files may pose as banking letters, receipts, invoices and other types of documents.

Other methods which can be used to infect unsuspecting victims with this virus can be if the malware is uploaded online as a fake software setup, fake key generator, game patch or crack or other seemingly legitimate software uploaded online.

Error Ransomware – Analysis

When an infection with Error ransomware takes place, the malware aims to perform different types of functions on the user’s computer. For starters, the virus may drop it’s malicious files in the commonly targeted Windows folders:

  • %AppData%
  • %Roaming%
  • %Local%
  • %LocalLow%
  • %LocalLow%
  • %Temp%

After the files of Error ransomware have been extracted on the user’s computer, the malware may begin to perform multiple different activities on the victim’s computer. The main one of those is to situate registry entries in the following Windows folders.


Among the malicious activities of Error ransomware is to delete the shadow volume copies of the infected computer, eliminating any chance of restoring the files via possible system backup. This may be performed by executing a batch file that has the following commands embedded within it:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
stop WerSvc
vssadmin.exe Delete Shadows /All /Quiet
vssadmin.exe Delete Shadows /All /Quiet
vssadmin.exe Delete Shadows /All /Quiet

These commands make sure that all Windows processes that may interrupt Error ransomware while it encrypts your files are eliminated.

In addition to this, the virus also drops a _HELP_INSTRUCTION.TXT file which has a ransom note, asking victims to contact several private e-mail addresses. The file has the following contents:

Attention! All Your data was encrypted!
For specific informartion, please send us an email with Your ID number:
We will help You as soon as possible!

Error Ransomware Encryption Process

In order to encrypt files on the computers which it has already infected, the Error Ransomware virus aims to perform multiple different activities, the first of which is to scan for widely used file types. The virus looks for specific files that are often used and skips Windows system folders during the encryption. Among these may be files with the following extensions:


The encryption process of Error ransomware is a carefully coded one. First, the ransowmare uses the AES encryption algorithm to render the files no longer able to be opened. After this is done, the encryption generates an asymmetric decryption key. This key is additionally RSA encrypted and unique RSA keys are generated for each infection. So far, it is not known, but the cyber-criminals may perform one of the following activities if you pay the ransom:

  • Trick you and do not decrypt anything.
  • Create a custom decryptor software for you, based on the decryption ID which is a unique code.
  • Have a master decryptor that hides the master decryption key within it’s code and send it to you after payment.

After encryption, the files are completely renamed and have the .ERROR file extension, making them look like the following:

Remove Error Ransomware and Try Restoring .ERROR Files

For the removal process of Error ransomware, we advise you to follow the removal instructions underneath. They are divided in both automatic and manual so that you can safely remove this virus according to your preferences. Experts strongly advise to use the automatic removal methods however, since they are the simplest and most effective way to remove all files and objects created by Error ransomware on your computer and protect it in the future as well.

If yo want to restore files that have been encrypted by this ransomware virus, we strongly suggest that you check out the alternative methods for file recovery which we have suggested underneath in step “2. Restore files encrypted by Error Ransomware”. They are not a direct solution, however they may help you recover as many files as possible encrypted by this virus without having to pay ransom.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share