I wrote this article to help you remove PERL File Extension Ransomware. This PERL File Extension Ransomware removal guide works for all Windows versions.

PERL file extension ransomware appears to be an attempt at recreating the Locky virus. The sinister program shares the same graphics with the top tier win-locker, with an identical design scheme of the ransom note and payment portal. Security experts believe that PERL file extension ransomware is the third version of Bart, a win-locker which mimics Locky. The imitations have thus far been limited to outlook. They have come nowhere near the destruction level of the original. Still, PERL file extension ransomware can and will encrypt most of your personal files. The clandestine program targets 140 file types, including text documents, images, audios, videos, databases, archives and others. Upon locking them, it demands a ransom to provide the access key.

How does PERL file extension ransomware infect computers?

PERL file extension ransomware uses the RSA-4096 algorithm to rearrange file codes, making them unreadable. The malignant program performs the encryption using a public key. It generates a unique private key and stores it on a remote server. To provide it, the developers of the win-locker demand a certain sum. Their message is conveyed through a couple of files. The default messenger is referred to as a ransom note. It is a text file, titled recover.txt. To acquire the user’s attention immediately, PERL file extension ransomware produces a wallpaper and sets it as the desktop background. The image is given the name recover.bmp. It contains the same information as the ransom note.

Win-lockers make their presence obvious because they require people to cooperate. The ultimate goal is the same for all ransomware programs. Some of them do not bother to introduce themselves, which is why researchers refer to them by the suffix they add to the targeted items. In this instance, the file extension in use is .perl. This explains the origin of the program’s name. The proprietors of PERL file extension ransomware send a clear and stern message to the owner of the infected device. They want him to pay 1 bitcoin for the decryption key. The amount has to be transferred through a Tor page. The reason for the specific requirements is security. The bitcoin cryptocurrency and the Tor web browser allow the cyber criminals to protect their anonymity. According to them, there is no alternative way to restore your files.

Of course, the owners of a win-locker would want people to believe that the only exit is to pay them. These scare tactics are typical psychological games. However, you need to take the following aspects into account. To begin with, there is no guarantee that the cyber thieves would provide the decryption key once you have completed the payment. There have been many instances of win-locker developers swindling users further by collecting the payment and keeping their files locked. The other factor you should have in mind is that the uninstall of PERL file extension ransomware is to be conducted by its owners. They can leave behind executable processes, set to be activated in time. This can result in the encryption occurring again. Rather than risking to pay for nothing or have a ticking time bomb within your system, you should look for an alternative way to delete the virus.

How did I get infected with PERL file extension ransomware?

PERL file extension ransomware is distributed via spam emails. The covert program would be hidden behind a file, attached to the letter. The sender will describe the attachment as an important document on an urgent matter. He can misrepresent a reliable company or entity, like the national post, the local police department, the government, a bank, a courier firm, a social network or an online shop. Before trusting a message from your in-box, you should make sure it is reliable. Check the sender’s name and contacts. If he is representing a certain organization, he should have used an official account to get in touch with you. You can visit the entity’s official website and check its contacts page for reference.

PERL File Extension Ransomware Uninstall

Method 1: Restore your encrypted files using ShadowExplorer
Usually, PERL File Extension Ransomware deletes all shadow copies, stored in your computer. Luckily, the ransomware is not always able to delete the shadow copies. So your first try should be restoring the original files from shadow copies.

1. Download ShadowExplorer from this link: http://www.shadowexplorer.com/downloads.html.
2. Install ShadowExplorer
3. Open ShadowExplorer and select C: drive on the left panel
4. Choose at least a month ago date from the date field
5. Navigate to the folder with encrypted files
6. Right-click on the encrypted file
7. Select “Export” and choose a destination for the original file

Method 2: Restore your encrypted files by using System Restore

1. Go to Start –> All programs –> Accessories –> System tools –> System restore
2. Click “Next“
3. Choose a restore point, at least a month ago
4. Click “Next“
5. Choose Disk C: (should be selected by default)
6. Click “Next“. Wait for a few minutes and the restore should be done.

Method 3: Restore your files using File Recovery Software
If none of the above method works, you should try to recover encrypted files by using File Recovery Software. Since PERL File Extension Ransomware first makes a copy of the original file, then encrypts it and deletes the original one, you can successfully restore the original, using a File Recovery Software. Here are a few free File Recovery Software programs:

1. Recuva
2. Puran File Recovery
3. Disk Drill
4. Glary Undelete