.fmoon Files Virus – Remove MOON DECRYPTOR (+ Restore) - How to, Technology and PC Security Forum | SensorsTechForum.com

.fmoon Files Virus – Remove MOON DECRYPTOR (+ Restore)

This article aims to help you remove the MOON DECRYPTOR ransomware virus from your computer and restore files that have been encrypted with the .fmoon file extension added.

A new ransomware virus, calling itself MOON or MOON DECRYPTOR has been detected by malware researchers to encrypt files on computers it infects, adding the .fmoon file extension. The virus aims to use the AES and RSA ciphers in order to generate unique decryption keys stored in a decrypter for which the user must pay a hefty ransom to receive. If you are one of the victims of MOON DECRYPTOR ransomware, we strongly advise you to read this article and learn how to remove it and get your files back without having to pay anything.

Threat Summary

Name.fmoon Virus
TypeRansomware, Cryptovirus
Short DescriptionVirus from the file encryption kind. Renders your files temporarily useless until you pay a hefty ransom fee to get them back.
SymptomsThe files are no longer openable with an added .fmoon file extension to them. A “decryptor” pops up with instructions how to pay a ransom fee to get the files back.
Distribution MethodSpam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by .fmoon Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .fmoon Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.


In order for this ransomware virus to infect unsuspecting users, the cyber-crooks may trick them into opening an infection file or a web link. Such objects may be spread into multiple different methods, the most often used of which is to infect computers via e-mail spam. Such infection process is usually conducted with the classic social engineering technique – deceiving potential victims that they have received an important file, like an invoice, letter of confirmation, bank account statement, hijacked account report or other type of important file. The messages accompanying the file are also deceptive, for example:

Besides via e-mail, this ransomware virus may also be spread via multiple different methods, for instance if it has been uploaded online as a fake setup of software, game patch, crack or any other seemingly legitimate type of program.


Once this virus has been activated on your computer system, it may immediately drop it’s malicious files on the user’s computer. As soon as it drops those virus, the ransomware may immediately focus on modifying your computer system, more particularly insert processes in Windows Task Manager, the usage of which may result in MOON DECRYPTOR to obtaind administrative permissions on your computer. The virus may also modify the Windows Registry Editor of the infected computer, more specifically attack the Run and RunOnce registry keys:


In addition to this, MOON DECRYPTOR ransomware may also delete your shadow volume copy backed up files, by using a batch file which it executes without your knowledge. The commands it may insert in the background are the following:

vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures”

In addition to this, the virus also sets a ransom note, named MOON DECRYPTOR which appears like the following:

Image Source: id-ransomware.blogspot.bg

Text from the image:

Oops all your data are encrypted !!
This is a ransomware AES 256 + RS A 1024!! Look at Wikipedia for morę informations
Please pay before 20 minutes oryour datalll be lost forever. I’ll delete a file per minutę after!
Copy and past this link in Internet Explorer or Firefox :
and enter your informations :
Your UUID :
Encrypted key iBtSvjYAVWaJslcc4Hn/nMIMrg+bUgA0W4g***
If you obtain your passord, take it here and click on RECOVER
button {RECOVER}

MOON DECRYPTOR – Encryption Process

For the file encryption, MOON ENCRYPTOR uses a strong combination of the following encryption algorithms:

  • AES (Advanced Encryption Standard).
  • RSA (Rivest-Shamir-Adleman).

The AES cipher is used by this virus to encrypt the data in the files themselves. But no all the data of the files is encrypted, only blocks of it. The AES cipher generates decryption keys which are in turn encrypted with the RSA cipher, generating unique private and public keys, that are required for the decryption of the files.

The MOON DECRYPTOR virus targets primarily important files on your computer, such as documents, videos, audio files and other types of files. The file extensions targeted may be most of the following:


To the files locked by MOON DECRYPTOR, the file extenson .fmoon is added, making them appear like the example below:

→ New Text Document.txt.fmoon

Remove MOON Ransomware and Restore .fmoon Encrypted Files

In order to remove this ransomware from your computer, we strongly suggest that you focus on backing your files beforehand. After doing so, you can go ahead and follow the instructions for the removal below. They are divided in manual and automatic and for maximum effectiveness, security experts always recommend removing viruses, like MOON automatically using the specific removal software for this purpose.

If you want to restore your files, in the event that they have been encrypted by MOON DECRYPTOR virus, you can go ahead and follow the alternative file recovery methods below in step “2. Restore files encrypted by .fmoon Virus.” They are specifically designed to help you recover as many files as possible without having to pay any form of ransom.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share