I wrote this article to help you remove Recuperadados@protonmail.com. This Recuperadados@protonmail.com removal guide works for all Windows versions.
If you are reading this removal guide you are probably stuck with a nasty ransomware infection which locked all of your data. This is what all ransomware pieces do. They encrypt your personal data and then they blackmail you for money in exchange for its recovery.
This particular threat, which you have fallen victim to is a part of the Hidden Tear project and it is known to be targeting mostly Portuguese PC users. However, this doesn’t mean that you are safe just because you don’t live in Portugal. Distance and location have never been an obstacle for the ransomware family. And if you have been particularly unlucky to get attacked, you are in trouble.
As soon as the pest enters your system it doesn’t waste any time. The first thing it does it to perform a scan of your machine looking for data to lock. It doesn’t take it long to find everything – pictures, music, videos, documents, Word files, presentations, etc. They all get encrypted with the AES-256 encryption algorithm and you no longer have access to them. They are modified and have the brand new “.BLOQUEADO” extension appended. Due to it, your machine is unable to recognize them.
For example, a mp3 file named Myfavoritesong.mp3 after being locked becomes Myfavoritesong.mp3.BLOQUEADO. Seeing this bizarre extension is a clear sign that the file-encrypting process is over and your files have been turned into unusable gibberish. Renaming them or moving them into a new folder does nothing as well. However, the ransomware has its own idea how to recover everything.
After the encryption is over the pest drops its ransom note in each folder containing locked data and on your desktop. This is a text file called -[AVISO-IMPORTANTE]-.txt. In case you are wondering what the hackers` suggestion of a way out is – it is you paying a hefty amount of money. The note provides the Recuperadados@protonmail.com email address via which you are supposed to get in touch with the authors and make the payment.
Ransomware`s main goal is money. The crooks are trying to convince you that the only way of getting your files back is by obtaining the decryption tool, which, of course, doesn’t come for free. You have to pay about $450 and only then will the hackers send you the decryptor. But can you be sure that they will? No!
Cybercriminals are not famous for being reliable and trustworthy. Most of the times they don’t keep their end of the deal and the victim ends up double-crossed. And even if they do send you the tool and it does work, it only decrypts the locked data. It doesn’t delete the ransomware which remains on your system ready to strike again. It’s you who loses in both scenarios. And not only that. If you pay you are practically helping crooks develop more threat with your money.
You help their business to grow and expand. Is that what you want? We highly doubt it. Instead of wasting your money and hoping for the best, use our removal guide down below. It is easy to follow in just a few steps and you don’t have to pay a single cent. But how this ransomware infected you in the first place? Have you opened any suspicious emails? Spam messages a are very popular and effective tactic. They pretend to be legitimate ones in order to fool you into opening them. Don’t open an email which you don’t know the sender of. Delete it straight away.
Another technique involves freeware/shareware bundles. Especially if you get them from unverified sources. When installing bundle always choose the Custom settings. They allow you to see each program in the bundle and deselect anything you want. And last but not least, watch out for bogus software updates, illegitimate websites, third-party pop-ups, etc. Don’t forget that it is up to you to protect your machine. Don’t be careless. Infections pray for that.
Recuperadados@protonmail.com Removal
Method 1: Restore your encrypted files using ShadowExplorer
Usually, Recuperadados@protonmail.com deletes all shadow copies, stored in your computer. Luckily, the ransomware is not always able to delete the shadow copies. So your first try should be restoring the original files from shadow copies.
- Download ShadowExplorer from this link: http://www.shadowexplorer.com/downloads.html.
- Install ShadowExplorer
- Open ShadowExplorer and select C: drive on the left panel
- Choose at least a month ago date from the date field
- Navigate to the folder with encrypted files
- Right-click on the encrypted file
- Select “Export” and choose a destination for the original file
Method 2: Restore your encrypted files by using System Restore
- Go to Start –> All programs –> Accessories –> System tools –> System restore
- Click “Next“
- Choose a restore point, at least a month ago
- Click “Next“
- Choose Disk C: (should be selected by default)
- Click “Next“. Wait for a few minutes and the restore should be done.
Method 3: Restore your files using File Recovery Software
If none of the above method works, you should try to recover encrypted files by using File Recovery Software. Since Recuperadados@protonmail.com first makes a copy of the original file, then encrypts it and deletes the original one, you can successfully restore the original, using a File Recovery Software. Here are a few free File Recovery Software programs:
