How to remove Recoverydatas ransomware

Recoverydatas ransomware is a type of malware that might result in a permanent file loss

Recoverydatas ransomware is a computer virus that attacks Windows machines exclusively. The malware belongs to a well-known ransomware family known as Scarab – it was first introduced in mid-2017, and since then, hundreds of variants were relapsed. Once installed on the system, the malware encrypts all pictures, videos, music, documents, and other data with a combination of AES and RSA algorithms. Suchlike modified files are appended with .recoverydatas extension, and their original names are replaced by a random string. For example, a “picture.jpg” is transformed into “74NRnEW6TfgMRT.recoverydatas” and can no longer be accessed.

In order to restore files to normal, users are asked to write an email with their personalized ID included to recoverydatas@bk.ru. Crooks explain in the HOW TO RECOVER ENCRYPTED FILES.txt ransom note that victims have to pay a ransom of an unspecified amount (in Bitcoin cryptocurrency).

Recoverydatas virus is one of many which has the sole purpose of money extortion. Since this type of illegal business can be very profitable for the attackers, several methods could be used in order to spread the malware to as many users as possible. Previous variants of Scarab were spotted being distributed via Necurs botnet,^[1], although, since it was greatly disrupted by Microsoft,^[2] hackers are likely to prefer other methods, such as email spam or software cracks.

Recoverydatas files virus belongs to broad malware family, with many versions around, including Clay, Restoreserver, Scarry, and many others. It does not differ much from its predecessors, although the developers tend to use a bit different ransom notes each time when it comes to the body text (the name of the ransom note remains the same for awhile whoever). Here is what the message says:

Your All files are now encrypted!

Your personal identifier:

All your files have been encrypted due to a security problem with your PC.

Now you should send us email with your personal identifier.
This email will be as confirmation you are ready to pay for decryption key.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

Contact us using this email address: recoverydatas@bk.ru

with email pls send your ip adres :

Free decryption as guarantee!
Before paying you can send us up to 3 files for free decryption.
The total size of files must be less than 10Mb (non archived), and files should not contain
valuable information (databases, backups, large excel sheets, etc.).

How to obtain Bitcoins?
* The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click
'Buy bitcoins', and select the seller by payment method and price:
hxxps://localbitcoins.com/buy_bitcoins
* Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins

Attention!
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software, it may cause permanent data loss.
* Decryption of your files with the help of third parties may cause increased price
(they add their fee to our) or you can become a victim of a scam.

As evident, the attackers are trying their best to make users pay for the decryptor instead of choosing different methods for file recovery. Threat actors even offer test decryption service of three files that would not exceed 10MB in size – this is meant to serve as proof that there is a working Recoverydatas virus decryptor, and victims would get it as soon as Bitcoins are transferred to a specified wallet.

If you have a powerful anti-malware software equipped, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, you can be almost guaranteed that ransomware would not be able to access your PC and encrypt all files on it. However, since you are here, you are likely to look for Recoverydatas ransomware removal and data recovery possibilities.

Indeed, security experts^[3] recommend staying away from hackers, as they might simply take your money and never provide the tool they promised. Instead, remove Recoverydatas virus from your system and use alternative methods for data recovery. Also, since malware might damage some system files and Windows settings, we recommend fixing such damage with repair software FortectIntego.

.Recoverydatas extension will not go away after you eliminate malware from your computer

While cybercriminals can hardly be trusted with anything, they are right when they are talking about data decryption. Since malware uses sophisticated encryption methods, there is no known way of how these files can be decrypted unless a unique key is retrieved from the attackers. This is one reason why ransomware infection is so dangerous – most of such infections use fail-proof file locking methods that can not be bypassed by any programs or tools.

It is important to note that many users who get infected with ransomware are not aware of how it works and believe that, as soon as a full scan with anti-malware software is performed, they can remove .recoverydatas file extension and be able to access the data once again. Unfortunately, this is not true, as security software is unable to decrypt any types of files. Having that said, removing the infection from the computer is just as important.

So, what is there left to do and how to restore .recoverydatas virus files without paying criminals? There are a few things you would try – they include using third-party recovery solutions or employing built-in Windows restore points. Unfortunately, recovering data in such a way is relatively rare, however, not impossible. For alternative data restoration methods, please check the detailed instructions in our recovery section below.

Remove Recoverydatas ransomware before you attempt file recovery

The only secure way to recover your files is by restoring them from a backup. If you do not have one prepared, you should not hurry with Recoverydatas ransomware removal. First of all, you should make a copy of your most important files, as any action post-infection might cause them to get permanently corrupted. Note that locked files do not hold any malicious code within them, so they are safe to copy over.

Once that is done, you should remove Recoverydatas virus from your Windows computer. This is extremely important, as malware sometimes travels in bulk, meaning that additional infections might be present – these could steal your sensitive data or use your machine for other malicious purposes. Thus, employ powerful security software like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, and then perform a full system scan. Then, use FortectIntego utility to ensure that your system runs well. Finally, attempt to recover your data without paying criminals.