Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

1.50.0.1036 12.50%
1.48.0.982 37.50%
1.48.0.980 12.50%
1.47.0.948 37.50%

Relationships


PE structurePE file structure

Show functions
Import table
advapi32.dll
RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, RegDeleteKeyW, RegQueryValueExW
gdi32.dll
SelectObject, CreateCompatibleDC, DeleteObject, GetDIBits, CreateDIBSection, DeleteDC
kernel32.dll
InitializeCriticalSectionAndSpinCount, InterlockedIncrement, InterlockedDecrement, GlobalLock, GlobalUnlock, lstrcpynW, lstrcpynA, WideCharToMultiByte, GetVersionExW, GetVolumeNameForVolumeMountPointW, GetDriveTypeW, LoadLibraryExW, GetTimeFormatA, LeaveCriticalSection, InterlockedCompareExchange, MultiByteToWideChar, GetLastError, RaiseException, lstrcmpiW, GetModuleHandleW, lstrlenW, ResetEvent, EnterCriticalSection, DeleteCriticalSection, SetThreadLocale, GetThreadLocale, GetVersion, GetModuleFileNameW, FreeLibrary, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcAddress, LoadLibraryW, GetFileAttributesW, GetSystemDirectoryW, OpenEventA, WaitForSingleObject, SetEnvironmentVariableA, CompareStringW, FlushFileBuffers, CreateFileW, WriteConsoleW, SetStdHandle, GetConsoleMode, GetConsoleCP, SetFilePointer, GetStringTypeW, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, GetDateFormatA, GetStartupInfoW, GetFileType, SetLastError, CreateEventA, SetEvent, CloseHandle, GetCurrentProcess, InitializeCriticalSection, TlsGetValue, TlsSetValue, TlsAlloc, TlsFree, GetCurrentThreadId, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, GetProcessHeap, Sleep, InterlockedExchange, AreFileApisANSI, LocalFree, FormatMessageA, GetCommandLineA, GetTimeZoneInformation, GetSystemTimeAsFileTime, RtlUnwind, LCMapStringW, GetCPInfo, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, ExitProcess, WriteFile, GetStdHandle, HeapCreate, GetLocaleInfoW, GetACP, GetOEMCP, IsValidCodePage, IsProcessorFeaturePresent, SetHandleCount
ole32.dll
CoCreateInstance, StringFromGUID2, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, ReleaseStgMedium
shell32.dll
SHGetFileInfoW, SHGetPathFromIDListW, ShellExecuteW, ExtractIconExW, DragQueryFileW, SHGetFolderLocation, SHGetDesktopFolder
shlwapi.dll
PathAppendW, PathFileExistsW, PathRemoveFileSpecW
user32.dll
GetDC, ReleaseDC, GetSystemMetrics, DrawIconEx, GetMenuItemInfoW, SetMenuInfo, InsertMenuItemW, InsertMenuW, CreateMenu, RegisterClipboardFormatW, CharNextW, DestroyIcon, GetIconInfo, SetRect, SetMenuItemInfoW
Export table
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

RecuvaShell.dll

Recuva by Piriform Ltd (Signed)

Remove RecuvaShell.dll
Version:   1.50.0.1036
MD5:   aa891896e87ce0e1533a294c0c161d3e
SHA1:   63df081df7ee3db98890d3ff6a914a173f726f09

Overview

recuvashell.dll is loaded as dynamic link library that runs in the context of a process. It is installed with a couple of know programs including Recuva published by Piriform and Recuva published by Piriform. The file is digitally signed by Piriform Ltd which was issued by the VeriSign certificate authority (CA).

DetailsDetails

File name:recuvashell.dll
Publisher:Piriform Ltd
Product name:Recuva
Description:Recuva shell extensions
Typical file path:C:\Program Files\recuva\recuvashell.dll
File version:1.50.0.1036
Size:332.77 KB (340,760 bytes)
Build date:12/19/2013 7:41 AM
Certificate
Issued to:Piriform Ltd
Authority (CA):VeriSign
Effective date:Tuesday, June 7, 2011
Digital DNA
PE subsystem:Windows GUI
File packed:No
.NET CLR:No
More details

ResourcesPrograms

The following programs will install this file
Piriform
8% remove
Recuva is a data recovery program and is able to recover files that have been "permanently" deleted and marked by the operating system as free space. As with other file recovery programs Recuva works by looking for unreferenced data, but if the operating system has written new data over a deleted file then recovery will often not be possible.

BehaviorsBehaviors

Approved shell extension
Located in the registry at 'SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
  • 'RecuvaShellExt' with CLSID {435E5DF5-2510-463C-B223-BDA47006D002}

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Professional 37.50%
Microsoft Windows XP 25.00%
Windows 7 Ultimate 12.50%
Windows 8 12.50%
Windows Vista Home Premium 12.50%

Distribution by countryDistribution by country

United States installs about 28.57% of Recuva.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Lenovo 33.33%
Dell 16.67%
Acer 16.67%
Sony 16.67%
ASUS 16.67%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE