.r5a File Virus Encryption Removal

The encrypted files may not be the only damage done to you. parasite may still be hiding on your PC. To determine whether you've been infected with ransomware, we recommend downloading SpyHunter.

Download SpyHunter Anti-Malware

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

This page aims to help you remove the .r5a File Virus. These the .r5a File Virus removal instructions work for all versions of Windows.

the .r5a File Virus is a type of software classified as Ransomware. It gets its name from the fact that it will actually demand a ransom in return for granting you access to your own data, which it encrypted in the first place. These programs are among the nastiest viruses that could possibly enter your computer and the worst part is – even once you’ve successfully removed them that will still not enable you to open and use your files again. We have, however, designed this guide to walk you through the process of both uninstalling the .r5a File Virus and decrypting your coded files. Despite this method perhaps not being 100% effective (there is a slight chance some files might remain encrypted even after completing these instructions), we still highly recommend you go through them first, before attempting to contact the cyber-criminals, who unleashed the virus on you. Please note, that the present instructions will not in any way alter your files, therefore it is completely safe to use them.

A little about the .r5a File Virus and what it does

Ransomware was predominantly present in Russia and first appeared as far back as in the nineties. It was a big ‘hit’ back then, but has since only grown in popularity. Nowadays, literally any computer with access to the Internet in any part of the world is exposed the risk of being infected by the virus. It is distributed mainly with the help of a Trojan horse virus, which will in the majority of cases be sent to you via email. It will contain either an attachment in the form of some file (any file!) or a link to some webpage. Whatever the case, by opening either one of those enclosed things you will be allowing the Trojan to automatically download the .r5a File Virus onto your computer and you won’t even know what hit you. This is partly what makes ransomware so dangerous – it’s practically undetectable. In rare cases you might be able to sense something is wrong, especially if your computer isn’t quite the fastest machine out there and there is a lot of data stored on it. This will result in your PC being incredibly slow, and once you notice this, you should open your Task Manager and sort the processes by memory used. If in the top of the list you see something you don’t recognize and it seems suspicious, immediately shut down your computer and turn to a professional for help.

But since you’re already here, seeking how to deal with the .r5a File Virus, it must have already made its presence known to you and that means its dirty work is done. When it has finished encrypting your files, you will probably see a message on your screen informing you of the same and telling you to pay a certain amount in exchange for the encryption key. It might even be threatening to increase the amount, if you don’t pay the requested sum on time. Perhaps it will even get you to believe that your files will be lost forever, if you don’t pay up. Well, the good news is that none of this has to necessarily be true and you shouldn’t allow these cyber-criminals to scare you into complying with their demands.

What to do and how to be safe in the future

This is by all means yours and only your decision to make, therefore we cannot tell you to pay the ransom or not to. Here is some food for thought, though:

Consider that you are dealing with genuine criminals on the other side of the screen. They may not be running around with guns or putting a knife to your throat, but they broke into your property and stole your access to that property. What makes you think they should keep their end of the bargain and send you the key? Also, even if they do send it, nobody can guarantee that the key will work and all your files will be restored. And refunds are certainly not available. Sure, our methods don’t offer 100% guarantees either, but at least we aren’t going to charge you for them and we can promise you they won’t tamper with your files or change them in any way.

As for preventing things like this from happening again, we recommend you at all times have a working antivirus and run virus checks regularly. Avoid hanging out on shady, potentially dangerous websites and be extremely cautious when opening emails from unknown sources, especially those with attachments and/or links.


Name .r5a
Type Ransomware
Danger Level High (May potentially cause full loss of access to some files)
Symptoms  Possibly very slow computer while virus is at work. Afterwards – message about encrypted files and ransom.
Distribution Method Mostly via email with the help of a Trojan horse virus. Will come in the form of attachment or link.
Detection Tool the .r5a File Virus may be difficult to track down. Use SpyHunter – a professional parasite scanner – to make sure you find all files related to the infection.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

Remove .r5a File Virus

Readers are interested in:


Reboot in Safe Mode (use this guide if you don’t know how to do it).

This is the first preparation.


To remove parasite on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

If you want to avoid the risk, we recommend downloading SpyHunter
a professional malware removal tool.

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

The first thing you must do is Reveal All Hidden Files and Folders.

  • Do not skip this. the .r5a File Virus may have hidden some of its files.

Hold the Start Key and R – copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.


Type msconfig in the search field and hit enter. A window will pop-up:


Go in Startup —> Uncheck entries that have “Unknown” as Manufacturer.


Press CTRL + SHIFT + ESC simultaneously. Go to the Processes Tab. Try to determine which ones are a virus. Google them or ask us in the comments.


We get asked this a lot, so we are putting it here: Removing parasite manually may take hours and damage your system in the process. We recommend downloading SpyHunter to see if it can detect parasite files for you.

Right click on each of the virus processes separately and select Open File LocationEnd the process after you open the folder, then delete the directories you were sent to.



Type Regedit in the windows search field and press EnterOnce inside, press CTRL and F together and type the virus’s Name. 

Search for the ransomware  in your registries and delete the entries. Be extremely careful –  you can damage your system if you make a big mistake.

Type each of the following in the Windows Search Field:

  1. %AppData%
  2. %LocalAppData%
  3. %ProgramData%
  4. %WinDir%
  5. %Temp%

Delete everything in Temp. The rest just check our for anything recently added. Remember to leave us a comment if you run into any trouble!


How to Decrypt files infected with the .r5a File Virus

There is only one known way to remove the virus’ encryption that MAY work (no guarantees) – reversing your files to a previous state. There are two options you have for this:

The first is using a system backup. Search for Backup and Restore in the windows search field —–> “Select another backup to restore files from”


If you have no backups, your option is Recuva

Go to the official site for Recuva and download its free version. When you start the program, select the file types you want to recover. You probably want all files. Next select the location. You probably want Recuva to scan all locations.

Click on the box to enable Deep Scan. The program will now start working and it may take a really long time to finish, so be patient and take a break if necessary.

You will now get a big list of files to pick from. Select all relevant files you need and click Recover.

Did we help? Share your feedback with us so we can help other people in need!

Leave a Comment