[email protected] Ransomware Virus - How to remove

[email protected] is a code name for a dangerous ransomware virus that can cause a lot of damage to your computer. The name for this virus is not accidental – cyber criminals behind it use this email address for communication with victims. It can also be referred to as SAVEfiles virus because it employs .savefiles extension to lock personal files on the infected system. Doesn’t matter how you call it – this infection can completely paralyze your system and take away most of your personal files.

For those of you who would like to have them back, [email protected] will ask to pay a ransom – $500. Don’t make forced decisions. Even though hackers want you to pay the ’ransom’ and it might seem like the only option you have, it’s not. There are alternative methods to solve this situation without spending a whole bunch of money.

Our job here is to inform you about features of [email protected] virus and provide possible solutions how you can remove the virus itself and restore files that have been encrypted. To do that, you need to read the article to the end and get introduced to the removal instructions.

How [email protected] Can Encrypt Files

As most ransomware infections, [email protected] employ strong AES or RSA encryption algorithms to change the structure of your personal files and make them unusable. They append .savefiles extension to the end of every file and from that moment, you will not be able to open or use them in any other way anymore.

In order to make those locked files usable once again, you will have to reverse the process of encryption and decrypt them. Unfortunately, that’s easier said than done because they put a lock on it – unique decryption key that is generated for every single infected computer separately. There is no easy way to get that key because they store it on a remote server. So basically you are paying for the key that they promise to send you after they receive the payment.

That’s a common technique used by various ransomware viruses – Qinynore ransomware, bkp ransomware, IT.Books virus, and so on. They all are similar, but diferent at the same time.

After the encryption, they will create a file called “!!!SAVE_FILES_INFO!!!.txt” and place it on your desktop. This file contains their instructions on what you should do next and how the ransom should be paid, here is an original copy of it:

WARNING!

Your files, photos, documents, databases and other important files are encrypted and have the extension: .SAVEfiles

The only method of recovering files is to purchase an decrypt software and unique private key.

After purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.

Only we can give you this key and only we can recover your files.

You need to contact us by e-mail [email protected] send us your personal ID and wait for further instructions.

For you to be sure, that we can decrypt your files – you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.

Price for decryption $500.

This price avaliable if you contact us first 72 hours.

E-mail address to contact us:
[email protected]

Reserve e-mail address to contact us:
[email protected]

Your personal id:
**********

As you can see, there is an alternative email address used – [email protected]. Cyber criminals behind SAVEfiles virus employ a common ’scare, telling that you have to contact them within 72 hours, otherwise the price of ransom will grow. That’s unlikely true, they simply want to get in touch with you faster, before you can think of smarter solutions to this problem.

We do not suggest to contact them either pay the ransom. How can you be sure that your files will be decrypted after you make the payment? You can’t trust cyber criminals. Also, there are effective solutions that don’t cost $500, so it wouldn’t be wise anyway.

How It Got Inside Of Your Computer?

If SAVEfiles infection found a way to infect your computer, that means the security of your system is weak. Other malware, like browser hijackers or adware, will be able to do the same. Most probably it came as an attachment to some spam email that you have opened by yourself. You should never open letters and especially attachments to them if you don’t know where they came from.

Also, we suggest keeping your computer secured with a professional tool. There are plenty of them, all of them are different. Some of them are paid, others are free – you can check them out in our reviews section. In this case, if you want to protect your computer against malware, we recommend taking a look at IObit Malware Fighter. This tool has a dedicated ransomware feature that blocks unauthorized attempts to make changes to your personal files.

Remove SAVEfiles Virus and Restore Files

It would be a really hard task to detect and remove all files that belong to [email protected] ransomware manually. Instead of that, you should perform this removal with Spyhunter. All it takes is to scan your computer with one of them and [email protected] will be detected and removed automatically.

After you do that, there is another thing left to do – you have to retrieve your personal files that have been locked. Free decryptor for [email protected] is not available at the moment, so we recommend to follow this guide and restore your files from a backup.

If you do not have a backup, that might be a problem. In this case, you should search for a free file recovery tool online – we can’t guarantee that this will work, but it’s definitely worth to try. Also, we have developed detailed instructions how to do that below the article, so feel free to take a look at that too.

Automatic Malware removal tools

How to recover [email protected] Ransomware Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before SAVEfiles has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of [email protected] Ransomware Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to SAVEfiles. You can check other tools here.  

Step 3. Restore [email protected] Ransomware Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually SAVEfiles tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover [email protected] Ransomware Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.