.GOTYA Files Virus - How to Remove and Restore Encrypted Files

.GOTYA Files Virus – How to Remove and Restore Encrypted Files

This article has been created in order to help you by showing you how to remove the .GOTYA files ransomware from your computer system and how to restore files that have been encrypted with the .GOTYA file extension.

A ransomware virus, belonging to the “hc” ransomware family, also known as .GOTYA files virus has been reported to infect unsuspecting users’ computers and after this encrypt the files on their computers in order to extort them for a ransom payoff. The virus adds the .GOTYA file extension to the encrypted files after which it may also drop behind a ransom note on your computer. In the event that your computer has been infected with the .GOTYA files virus, recommendations are to read this article in order to learn how to remove the .GOTYA files virus from your computer and how to try and restore encrypted files.

Threat Summary

Name.GOTYA Virus
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on the computers that have been compromised by it and demand victims to pay a hefty ransom fee in order to get the encrypted files decrypted once again.
SymptomsFiles are encoded using an advanced encryption and they are no longer able to be opened. The .GOTYA file extension is added to the infected computer.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .GOTYA Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .GOTYA Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.GOTYA Files Virus – Update January 2018

The .GOTYA Files Virus has been discovered to attack computer systems by using Remote Desktop access. The malware seeks to find exposed remote desktop services. Once it is successful and gets inside a PC, it excludes the PsExec.exe process from encryption, beause it uses it to spread the ransomware on other computers in the same network. This discovery has been made on the 5th of December and reveals one of the most prominent ways for infection. Nevertheless, if you have a good firewall setup your system should be intact.

.GOTYA Files Virus Distribution Methods

In order to infect the maximum amount of victims, this infection may use a variety of methods, including:

  • Spam e-mail campaigns.
  • Fake setups of software.
  • Fake cracks for software.
  • Fake patches for software.

If distributed via e-mail, the .GOTYA ransomware virus may be embedded as an e-mail attachment or may contain a web link that leads to the downloads of such via a third-party website. Often, deceitful messages are used to trick victims into opening the malicious e-mail attachment. Here is an example of an attack, infecting with .GOTYA ransomware

.GOTYA Ransomware – More Information

When an infection with .GOTYA ransomware takes place on the compromised device, the malware may begin to perform various different activities on the infected computer, beggining with dropping the malicious files on the infected PC. The files may be located in the following Windows directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%

After .GOTYA files virus drops it’s malicious files on the victim’s computer, the malware may begin to interfere with the Windows Registry Editor on your computer. The following registry sub-keys may be modified:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaveTimeOut
HKEY_CURRENT_USER\Control Panel\Desktop

In addition to this, the .GOTYA file ransomware may also begin to delete the shadow volume copies of your computer and disable any file recovery services. This is usually done via the following Windows administrative commands:

→ process call create “cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures”

.GOTYA Files Virus – Encryption Process

In order to encrypt the files on your computer, the .GOTYA files virus may begin to scan for specific files that are used very often, such as documents, images, videos, archives and other types of files. The virus does this by scanning for their file extensions. The file types which are likely encrypted if you have the .GOTYA files virus on your computer are the following:


When .GOTYA ransomware encrypts your files, the virus replaces blocks of data from the original file with data from the encryption algorithm it uses. The malware then may add the .GOTYA file extension to the files, making them appear like the following:

Remove .GOTYA Files Virus and Restore Encrypted Files

In order to remove this ransomware infection from your computer, we recommend that you follow the removal instructions down below. They are specifically created in order to help you delete the malicious files of this ransomware either manually or automatically. Since for manual removal, you will need to have extensive experience in making sure that every object, related to .GOTYA ransomware is deleted, experts reccomend removing .GOTYA ransomware automatically, using an advanced anti-malware software. It will automatically scan for and remove all malicious files, that are related to .GOTYA ransomware and plus protect your computer against future infections as well.

If you want to restore files that have been encrypted by the .GOTYA files virus, we advise you to follow the alternative methods for file recovery, which we have suggested down below in step “2. Restore files encrypted by .GOTYA Virus”. The methods are in no way 100% effective, but they may help recover as many files as possible.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share