.Infinite Files Virus (InfiniteTear 3) – How to Remove and Restore Encrypted Data

.Infinite Files Virus (InfiniteTear 3) – How to Remove and Restore Encrypted Data

This article aims to help you by explaining what is .Infinite files virus and how to fully remove it from your computer system plus restore files encrypted by it on your system.

New ransomware virus version of the InfiniteTear ransomware family has been reported to infect victim computers and encrypt the important pictures, videos, audio and other important files in them, while renaming them and also adding the .Infinite file suffix after their names. The virus, named InfiniteTear 3, also leaves behind a long ransom note file, named “How_Decrypt_Files.txt (Read Only)”. It aims to get the victims of the malware to pay a hefty ransom fee in order to get their files restored back to their original state by paying a hefty ransom fee in BitCoin via contacting the crooks on their e-mail address InfiniteDecryptor@protonmail.com which is encrypted and anonymous. If your files have been encrypted and renamed with random names plus contain the .Infinite file extension added to them, we recommend that you focus on removing this malware from your PC, preferably by following the information in this article.

Threat Summary

Name.Infinite Ransomware
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on your computer system and get you to download a paid decryptor to unlock them.
SymptomsFiles are renamed and are added the .Infinite suffix after their encryption has completed.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .Infinite Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .Infinite Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.Infinite Ransomware – Distribution

For .Infinite files virus, the primary method of spreading it’s infection file is likely to be e-mail spam messages that may either contain malicious e-mail attachments within them or contain files that can either be executables, JavaScript or other types of .hta or .htm files within an archive or contain .docm documents which have malicious macros and only look legitimate but after opening them your PC may already become compromised.

The e-mails often mask the malicious e-mail extensions as legitimate documents of some sort from the likes of:

  • Invoices.
  • Receipts from purchases by eBay, Amazon, AliExpress and other reputable retailers to increase victim trust.
  • Fake banking documents.

In addition to this, the .Infinite files ransomware may also slither onto victims computer via more passive methods from the likes of uploading the file on a website, pretending to be:

  • A setup of a program.
  • Installer of a patch, driver or license activation software.
  • Key generator.

.Infinite Files Virus – Analysis

As soon as the malware has been launched on your computer, it drops multiple different malicious files, among which is the main malicious process, carrying the fake name Host32.exe as reported on VirusTotal:

→ SHA-256: 7c82091c655357ae11be9794fa8346f30d350a0b1c3b5789c3667ed8d62e0c2f
Name: Host32.exe
Size: 74 KB→ ActiveXObject(“WScript.Shell”);
cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0”
cmd.exe /c wmic SHADOWCOPY DELETE”
cmd.exe /c vssadmin Delete Shadows /All /Quiet”
cmd.exe /c bcdedit “
new ActiveXObject(“WScript.Shell”
cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP-keepVersions:0”
cmd.exe /cwmicSHADOWCOPYDELETE”0
cmd.exevssadminDeleteShadows /All/Quiet”
cmd.exe /c bcdedit /set {default} recoveryenabled No”,
cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures”

.Infinite Files Virus – Encryption Process

The files which are encrypted by this ransomware infection are usually from the following commonly used file types:


For the encryption mode, the InfiniteTear ransomware likely uses the AES (Advanced Encryption Standard) which generates an asymmetric decryption key that is used in combination with a decrypter which is only available to the cyber-criminals and they demand the approximate sum of $120 to be paid in BitCoin to get the files decrypted. The encryption process consists of replacing portions of data from the original files with data from the cipher which makes them appear scrambled. And if that Is not enough, the virus also renames the file completely and adds the .Infinite file suffix in order to make them no longer openable:

Remove .Infinite Ransomware and Restore Encrypted Files

In order to make sure that the .Inifinite ransomware virus is gone, we recommend that you follow the manual removal instructions below only if you have experience in malware removal. Otherwise, experts always outline downloading and installing an advanced anti-malware program to automatically remove .Infinite ransomware and viruses of this type and fully secure your computer at a click of a button.

Furthermore, if you wish to restore your files in the even that they are encrypted by this ransomware, we recommend that you follow the alternative file recovery methods in step “2. Restore files encrypted by .Infinite Ransomware” down below. They may not be able to recover all of your files but can help you restore as many files as possible.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share