.TEST Files Virus (CryptoMix) - How to Remove and Restore Files

.TEST Files Virus (CryptoMix) – How to Remove and Restore Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article has been created in order to help you by showing how to remove the .TEST files virus (CryptoMix variant) from your computer and how to restore files that have been encrypted with the .TEST file extension.

New ransomware infection has been reported to infect computers. The virus, using the .TEST file extension has been outlined by researchers to have the .TEST file extension which it appends on the files of the compromised computer. In addition to this, the malware also drops a ransom note, named _HELP_INSTRUCTION.TXT which aims to convince the victims of the virus in order to pay a hefty ransom fee in order to try and restore the AES encrypted files.

Threat Summary

Name.TEST Files Virus
TypeRansomware, Cryptovirus
Short DescriptionAims to encrypt the files on the infected computer and ask victims to pay ransom in order to restore the encrypted files.
SymptomsAims to append the .TEST file suffix on the encrypted files and then drops a ransom note, named _HELP_INSTRUCTION.TXT.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .TEST Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .TEST Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Test CryptoMix Ransomware – Spread

For the infection process, the .TEST ransomware virus may use more than one techniques, the main of which may be e-mail spam messages that may be sent to victims. Such e-mails often pretend they come from big companies, like PayPal, DHL, FedEx, Dropbox and others and their goal is to make you trust the deceitful messages within them that often aim to get you to open malicious attachments within the e-mails or click on an URL which eventually leads to the infection itself. Here is an example of how such e-mails appear:

In addition to this, there may be other methods by which the CryptoMix .TEST variant can infect your computer system. One of those methods is known to be via fake files, such as setups, program license activators, key generators as well as other types of seemingly legitimate files.

.TEST Ransowmare – Analysis

Upon the initial infection with the infection file of .TEST ransomware, the malware may begin to drop it’s malicious files in the following Windows folders:

  • %AppData%
  • %Local%
  • %LocalLow%
  • %Roaming%
  • %Temp%

As soon as the malicious files of the .TEST files virus are dropped onto the victim’s computers, the ransomware may begin to perform various different activities, such as interfere with the Windows Registry Editor, more particularly modify the following Windows Registry sub-keys:

→ HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

After having done this, the .TEST files virus may also begin to modify various different types of processes and services in Windows, allowing it to obtain administrative power. Then, the .TEST ransomware may execute a script in Windows Command Prompt which stops several Windows processes and in addition to this may delete the Shadow Volume Copies of your computer, hence destroying backup and recovery via Windows. The commands to do these activities are as follows:

→ sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet

Then, the malware adds the _HELP_INSTRUCTION.TXT which aims to notify the victim of the ransomware virus that they must contact one of the test757 e-mails in order to pay a a ransom fee.

.TEST Files Virus – Encryption

For the encryption of files, the .TEST files virus may use various different techniques to located the files on your computer. It may scan for the most commonly used files on your computer, which are likely to be videos, documents, images and other types of important files with file extensions, among which may be the following:


After the files are detected, the .TEST files virus begins to alter aspects of those files by replacing their original code with encrypted data with the AES encryption algorithm. In addition to this, the virus also renames the files with random letters and numbers and adds the .TEST file extension to them, making them appear like the following:

Remove .TEST Files Virus and Restore Encrypted Files

In order to remove the .TEST files virus, it is recommended that you follow the removal instructions below. They are divided in manual or automatic and their primary purpose is to make sure that the .TEST files virus is permanently gone. Be advised that if you lack the experience in removing the .TEST files virus automatically, recommendations by security experts are to perform the removal automatically via an advanced anti-malware software which will automatically scan for and remove the .TEST files virus from your computer completely and protect your computer against future infections.

In addition to this, if you want to restore files that have been encrypted by the .TEST files ransomware, you can try and follow the alternative instructions for file recovery below in step “2. Restore files, encrypted by .TEST Files Virus”. They are created in order to help you restore as many files as possible, but they are no guarantee you will be able to recover all of the data.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share