.RECOVERYOURFILES Virus – How to Remove It and Restore Data

.RECOVERYOURFILES Virus – How to Remove It and Restore Data

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article has been created in order to explain to you how you can remove the .RECOVERYOURFILES virus from your computer and how you can get back files, encrypted by this ransomware.

Yet another ransomware with mysterious origins has popped up on malware researchers’ radar. The malware uses the .RECOVERYOURFILES file extension which it adds to the files after they have been encrypted. Furthermore, the ransomware also drops a ransom note file, called INSTRUCTIONS_RECOVER_FILES.txt. The ransom note’s primary goal is to get users to pay a hefty ransom in order to get their files recovered back to their usual working state. If you are one of the victims of this ransomware virus, we recommend that you read this article thoroughly and learn how you can remove .RECOVERYOURFILES virus and restore files, encrypted by this ransomware virus.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionEncrypts the files on your computer and then asks you to pay ransom to be able to use them again.
SymptomsFiles are appended .RECOVERYOURFILES extension. A ransom note is dropped.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .RECOVERYOURFILES Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .RECOVERYOURFILES Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.


To infect a certain computer, the .RECOVERYOURFILES virus aims to get victims to open the infection file themselves. This may happen by sending the file in the form of an e-mail attachment. This e-mail attachment often pretends as it is a legitimate type of file, that is created with the idea to be some type of important document, such as:

  • Invoice.
  • Receipt.
  • Bill.
  • Banking document.

In addition to this, the .RECOVERYOURFILES virus may also come in your computer as a result of you having to manually download the malicious files of this ransomware infection. This happens when the crooks decide to upload the files on suspcious websites, whose main purpose is to get users to believe that the files are what they are looking to download, such as:

  • Program installers.
  • Portable versions of programs.
  • Cracks.
  • Key generators.
  • License activators.

.RECOVERYOURFILES Virus – More Information

The .RECOVERYOURFILES virus is the type of malware which belons to the file encryption kind. These types of viruses strive to get your files to no longer be usable until you pay ransom to the ones behind the malware.

To complete it’s objective successfully, the .RECOVERYOURFILES virus may initially drop it’s ransomware payload on the computers of victims. The files, dropped by the .RECOVERYOURFILES virus may be locked in the commonly targeted Windows system directories under different names, like the image below shows:

After locating it’s payload on your computer, the .RECOVERYOURFILES virus may check if it’s running on actual Windows or if it’s running in a virtual drive. If the malware is running in a virtual environment or has previously infected the same machine, it deletes itself.

In addition to this, the virus may also perform other activites, such as to create registry entries in the Run and RunOnce Windows registry sub-keys with the purpose of getting it’s payload files to run automatically when you boot Windows. They are located in the following sub-keys:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\

In addition to this, the .RECOVERYOURFILES ransomware also drops it’s ransom note file on the victim PC, called INSTRUCTIONS_RECOVER_FILES.txt. The ransom note has the following message, asking victims to contact the cyber-criminals:



This is your ID:




In addition to this, the ransomware virus may also delete the shadow volume copies on the affected machine, thus preventing the recovery of the files via Windows. To do this, this ransomware may run a script, aimed at running the following commands as an administrator on the victim computers:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

.RECOVERYOURFILES Virus – Encryption Process

The .RECOVERYOURFILES virus is the type of malware, which claims to use the RSA+AES encryption combination which is basically a two-level encryption, includin the assymetric keys from the AES and the unique keys, generated by the RSA encryption algorithm. These types of ciphers are appended when the original files on the infected computer are copied. Te copies of the files are the encrypted ones while the original files may be deleted by the ransomware.

To encrypt the files, the .RECOVERYOURFILES virus scans the infected computer for the following types of files:

  • Audio files.
  • Videos.
  • Documents.
  • Images.
  • Database files.
  • Backup files.
  • Signatures.
  • Virtual drives.
  • Archives.

As soon as .RECOVERYOURFILES virus encrypts the files of victims, the ransomware then adds its distinctive file extension to them, making them appear like the following image:

Remove .RECOVERYOURFILES Ransomware and Restore Your Data

If you want to remove this ransomware virus from your computer, be advised that you should backup your data first, because it may be a risky process. Then, we recommend to follow the removal instructions that are underneath the article to either manually or automatically hunt down the malicious files of the .RECOVERYOURFILES virus and then delete them. For maximum effectiveness, experts do advise users to turn to a professional anti-malware software which will take care of the removal process of this ransomware and make sure this does not happen again.

If you want to try and get your data back, you can attempt several or all of the alternative recovery methods In step “2. Restore files, encrypted by .RECOVERYOURFILES Virus” underneath. They have been created to help you to restore as many encrypted files as possible, without actually having to pay the ransom, although they may not be 100% effective.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share