Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

1.50.0.1036 12.50%
1.48.0.982 37.50%
1.48.0.980 12.50%
1.47.0.948 37.50%

Relationships


PE structurePE file structure

Show functions
Import table
advapi32.dll
RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, RegDeleteKeyW, RegQueryValueExW
gdi32.dll
SelectObject, CreateCompatibleDC, DeleteObject, GetDIBits, CreateDIBSection, DeleteDC
kernel32.dll
InitializeCriticalSectionAndSpinCount, InterlockedIncrement, InterlockedDecrement, GlobalLock, GlobalUnlock, lstrcpynW, lstrcpynA, WideCharToMultiByte, GetVersionExW, GetVolumeNameForVolumeMountPointW, GetDriveTypeW, LoadLibraryExW, GetTimeFormatA, LeaveCriticalSection, InterlockedCompareExchange, MultiByteToWideChar, GetLastError, RaiseException, lstrcmpiW, GetModuleHandleW, lstrlenW, ResetEvent, EnterCriticalSection, DeleteCriticalSection, SetThreadLocale, GetThreadLocale, GetVersion, GetModuleFileNameW, FreeLibrary, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcAddress, LoadLibraryW, GetFileAttributesW, GetSystemDirectoryW, OpenEventA, WaitForSingleObject, SetEnvironmentVariableA, CompareStringW, FlushFileBuffers, CreateFileW, WriteConsoleW, SetStdHandle, GetConsoleMode, GetConsoleCP, SetFilePointer, GetStringTypeW, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, GetDateFormatA, GetStartupInfoW, GetFileType, SetLastError, CreateEventA, SetEvent, CloseHandle, GetCurrentProcess, InitializeCriticalSection, TlsGetValue, TlsSetValue, TlsAlloc, TlsFree, GetCurrentThreadId, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, GetProcessHeap, Sleep, InterlockedExchange, AreFileApisANSI, LocalFree, FormatMessageA, GetCommandLineA, GetTimeZoneInformation, GetSystemTimeAsFileTime, RtlUnwind, LCMapStringW, GetCPInfo, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, ExitProcess, WriteFile, GetStdHandle, HeapCreate, GetLocaleInfoW, GetACP, GetOEMCP, IsValidCodePage, IsProcessorFeaturePresent, SetHandleCount
ole32.dll
CoCreateInstance, StringFromGUID2, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, ReleaseStgMedium
shell32.dll
SHGetFileInfoW, SHGetPathFromIDListW, ShellExecuteW, ExtractIconExW, DragQueryFileW, SHGetFolderLocation, SHGetDesktopFolder
shlwapi.dll
PathAppendW, PathFileExistsW, PathRemoveFileSpecW
user32.dll
GetDC, ReleaseDC, GetSystemMetrics, DrawIconEx, GetMenuItemInfoW, SetMenuInfo, InsertMenuItemW, InsertMenuW, CreateMenu, RegisterClipboardFormatW, CharNextW, DestroyIcon, GetIconInfo, SetRect, SetMenuItemInfoW
Export table
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

RecuvaShell.dll

Recuva by Piriform Ltd (Signed)

Remove RecuvaShell.dll
Version:   1.48.0.982
MD5:   ae17379d2fd65f02f88c08e989e92749
SHA1:   fdaa7d723fca3cf4026afb6be6062e834a0f4909

Overview

recuvashell.dll is loaded as dynamic link library that runs in the context of a process. It is installed with a couple of know programs including Recuva published by Piriform, Recuva from Piriform and Recuva by Piriform. The file is digitally signed by Piriform Ltd which was issued by the VeriSign certificate authority (CA).

DetailsDetails

File name:recuvashell.dll
Publisher:Piriform Ltd
Product name:Recuva
Description:Recuva shell extensions
Typical file path:C:\Program Files\recuva\recuvashell.dll
File version:1.48.0.982
Size:332.77 KB (340,760 bytes)
Build date:8/13/2013 4:08 PM
Certificate
Issued to:Piriform Ltd
Authority (CA):VeriSign
Effective date:Tuesday, June 7, 2011
Digital DNA
PE subsystem:Windows GUI
File packed:No
.NET CLR:No
More details

ResourcesPrograms

The following programs will install this file
Piriform
8% remove
Recuva is a data recovery program and is able to recover files that have been "permanently" deleted and marked by the operating system as free space. As with other file recovery programs Recuva works by looking for unreferenced data, but if the operating system has written new data over a deleted file then recovery will often not be possible.

BehaviorsBehaviors

Approved shell extension
Located in the registry at 'SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
  • 'RecuvaShellExt' with CLSID {435E5DF5-2510-463C-B223-BDA47006D002}

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Professional 37.50%
Microsoft Windows XP 25.00%
Windows 7 Ultimate 12.50%
Windows 8 12.50%
Windows Vista Home Premium 12.50%

Distribution by countryDistribution by country

United States installs about 28.57% of Recuva.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Lenovo 33.33%
Dell 16.67%
Acer 16.67%
Sony 16.67%
ASUS 16.67%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE