.Flatcher3@india.com.000g Virus Files (Remove and Restore) - How to, Technology and PC Security Forum | SensorsTechForum.com

[email protected] Virus Files (Remove and Restore)

This article is created to help you remove [email protected] file ransomware and restore encrypted files.

A mysterious ransomware infection using the [email protected] file extension which is added to the encrypted files has been reported by malware researchers to cause damage to victims. The virus aims to encrypt the files on the compromised computers after which drop a ransom note, called helping.txt In which it sets it’s demands to contact the e-mail in the extension. In case you have become a victim of the [email protected] ransomware virus, recommendations are to read this article thoroughly.

Threat Summary

Name

Flatcher3

TypeRansomware
Short DescriptionEncrypts files on infected computers after which asks victims to contact [email protected]

SymptomsThe victim sees the files encrypted with an added [email protected] file extension and a helping.txt ransom note file.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by Flatcher3

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss Flatcher3.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Flatcher3 Ransomware – Distribution

One method by which the Flatcher3 virus may be spread is to be sent as a malicious e-mail attachment. Such attachments usually contain the malicious file in an archived manner. The message accompanying the attachment may portray it as an important document that has to be opened, like an invoice for an unmade purchase, for example.

Other malicious object being sent via e-mail may be clean web links that cause redirects or lead to file-sharing sites, such as dropbox.com. There, a malicious script or a file may cause the infection.

Other infection methods may also include using different torrent websites to upload malicious files embedded within legitimate installers or masked as such. Other malicious files may be masked as key generators, fake updates, activators, etc.

Flatcher3 Rasomware – Infection Activity

After an infection by Flatcher3 ransomware has been performed, the virus may connect to a distribution site and download malicious files with different and suspicious names in the following folders:

  • %AppData%
  • %Roaming%
  • %Local%
  • %LocalLow%
  • %SystemDrive%
  • %Windows%
  • %System32%

In addition to this Flatcher ransomware might also modify the following registry sub-keys by adding custom values in them:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

This modification is done to run the malicious files of the virus on Windows boot.

Other activity of Flatcher ransomware may include the interacting with some critical Windows services. This modification allows for multiple different activities to be performed, such as allow encryption to take place. Some of the attacked files may be the following:

→ bootsect.bak
iconcache.db
ntuser.dat
thumbs.db

The Flatcher3 ransomware may also execute the vssadmin and bcedit commands to delete backups and shadow copies (VSS) from Windows, so that the user cannot restore his files this way:

→ process call create “cmd.exe /c
vssadmin.exe delete shadows /all /quiet
bcdedit.exe /set {default} recoveryenabled no

[email protected] File Virus – Encryption Process

This ransomware virus aims to encrypt important files only and it is careful to not encrypt files in the system folders of Windows. Among the encrypted files are documents, videos, music, image files and others, for example:

→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com

After the encryption process has completed the files are left in the following state:

The virus also drops a helping.txt file with the following content:

Hallo. For the help contact us: [email protected]

Remove Flatcher3 and Restore Encrypted Files

For the removal process of Flatcher3 file ransomware to be safe, it is important to first backup the encrypted files. Then, we advise following the Manual or Automatic removal instructions below to remove the virus files. In case you are having difficulties removing Flatcher3 manually, recommendations are to perform it automatically by downloading an advanced anti-malware program which will protect your computer in the future as well.

For the restoration of the files, you may want to try the alternative (not guaranteed) methods in step “2. Restore files encrypted by Flatcher3.”

Manually delete Flatcher3 from your computer

Note! Substantial notification about the Flatcher3 threat: Manual removal of Flatcher3 requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Flatcher3 files and objects
2.Find malicious files created by Flatcher3 on your PC

Automatically remove Flatcher3 by downloading an advanced anti-malware program

1. Remove Flatcher3 with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Flatcher3
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.