.Flatcher3@india.com.000g Virus Files (Remove and Restore) - How to, Technology and PC Security Forum | SensorsTechForum.com

[email protected] Virus Files (Remove and Restore)

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

This article is created to help you remove [email protected] file ransomware and restore encrypted files.

A mysterious ransomware infection using the [email protected] file extension which is added to the encrypted files has been reported by malware researchers to cause damage to victims. The virus aims to encrypt the files on the compromised computers after which drop a ransom note, called helping.txt In which it sets it’s demands to contact the e-mail in the extension. In case you have become a victim of the [email protected] ransomware virus, recommendations are to read this article thoroughly.

Threat Summary



Short DescriptionEncrypts files on infected computers after which asks victims to contact [email protected]

SymptomsThe victim sees the files encrypted with an added [email protected] file extension and a helping.txt ransom note file.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by Flatcher3


Malware Removal Tool

User ExperienceJoin our forum to Discuss Flatcher3.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Flatcher3 Ransomware – Distribution

One method by which the Flatcher3 virus may be spread is to be sent as a malicious e-mail attachment. Such attachments usually contain the malicious file in an archived manner. The message accompanying the attachment may portray it as an important document that has to be opened, like an invoice for an unmade purchase, for example.

Other malicious object being sent via e-mail may be clean web links that cause redirects or lead to file-sharing sites, such as dropbox.com. There, a malicious script or a file may cause the infection.

Other infection methods may also include using different torrent websites to upload malicious files embedded within legitimate installers or masked as such. Other malicious files may be masked as key generators, fake updates, activators, etc.

Flatcher3 Rasomware – Infection Activity

After an infection by Flatcher3 ransomware has been performed, the virus may connect to a distribution site and download malicious files with different and suspicious names in the following folders:

  • %AppData%
  • %Roaming%
  • %Local%
  • %LocalLow%
  • %SystemDrive%
  • %Windows%
  • %System32%

In addition to this Flatcher ransomware might also modify the following registry sub-keys by adding custom values in them:


This modification is done to run the malicious files of the virus on Windows boot.

Other activity of Flatcher ransomware may include the interacting with some critical Windows services. This modification allows for multiple different activities to be performed, such as allow encryption to take place. Some of the attacked files may be the following:

→ bootsect.bak

The Flatcher3 ransomware may also execute the vssadmin and bcedit commands to delete backups and shadow copies (VSS) from Windows, so that the user cannot restore his files this way:

→ process call create “cmd.exe /c
vssadmin.exe delete shadows /all /quiet
bcdedit.exe /set {default} recoveryenabled no

[email protected] File Virus – Encryption Process

This ransomware virus aims to encrypt important files only and it is careful to not encrypt files in the system folders of Windows. Among the encrypted files are documents, videos, music, image files and others, for example:


After the encryption process has completed the files are left in the following state:

The virus also drops a helping.txt file with the following content:

Hallo. For the help contact us: [email protected]

Remove Flatcher3 and Restore Encrypted Files

For the removal process of Flatcher3 file ransomware to be safe, it is important to first backup the encrypted files. Then, we advise following the Manual or Automatic removal instructions below to remove the virus files. In case you are having difficulties removing Flatcher3 manually, recommendations are to perform it automatically by downloading an advanced anti-malware program which will protect your computer in the future as well.

For the restoration of the files, you may want to try the alternative (not guaranteed) methods in step “2. Restore files encrypted by Flatcher3.”

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share