Remove Format Virus File (.format File) – Decrypt Ransomware Files

Remove Format Virus File (.format File) – Decrypt Ransomware Files

UPDATE August 2019 What are .format files? What is Format virus? How to remove the Format virus from your computer and how to try and restore .format ransomware encrypted files?

The .format files are encrypted objects by a dangerous ransomware virus, that belongs to the STOP Ransomware family of malware. The virus aims to encrypt the files on your computer and then sets the .format file extension that is added to the files, encrypted by it. The outcome of this is that you cannot open the files until you pay ransom to the cyber-criminals who are behind the .format virus. Read this article in order to understand how to fully remove Format virus and try to restore your files.

Threat Summary

Name Format Virus
Type Ransomware, Cryptovirus
Short Description Variant of STOP Ransomware. Aims to encrypt your files and get you to pay ransom to buy them back from the criminals.
Symptoms Files are encrypted with an added .format extension. A ransom note file, called _readme.txt also appears.
Distribution Method Spam Emails, Email Attachments, Executable files
Detection Tool See If Your System Has Been Affected by Format Virus


Malware Removal Tool

User Experience Join Our Forum to Discuss Format Virus.
Data Recovery Tool Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.format Files Virus – Update August 2019

The good news for all victims of STOP .format ransomware is that the security researcher Michael Gillespie cracked the code of this variant and released an updated version of his STOP ransomware decrypter.

So the moment you remove all malicious files and objects from your infected system you can enter our data recovery guide where you will find a download link for the free .format decryption tool and learn how to proceed with the decryption process.

Decrypt Files Encrypted by STOP Ransomware

Have in mind that the tool is designed to support specific offline IDs, so it may not be effective for all occasions of .format ransomware infections.

Format Virus – How Did I Get It and What Does It Do?

The primary goal of the Format virus is to penetrate your computer system. For this to work, the main idea of the ransomware virus is to come as a legitimate file on your computer so that you can execute it. Such files can be sent to you via e-mail where they may pretend to be legitimate documents, from the likes of:

  • Invoices.
  • Receipts.
  • Word documents.
  • Presentations.
  • PDF files.

Once you are tricked into opening them, infection with the Format virus may commence by triggering malicious macros on the victim computer.

Not only this, but also another way via which you may become victim of the Format virus is if you happen to open several different types of files, whose main goal is to pretend to be software downloads of some sort. Such software downloads could turn out to be setups, portable programs, cracks patches, and others.

Either way, as soon as the Format virus infects your computer, it may drop the virus files in the following Windows directories:

  • %AppData%
  • %Local%
  • %LocalLow%
  • Texttt%Roaming%
  • %Temp%

When the Format virus has infected your computer, it will also drop its _readme.txt file, that has the following contents:

Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:

Reserve e-mail address to contact us:

After infection, Format virus may conduct series of virus activities in order to obtain administrator rights over your computer. It may use those to scan for and encrypt the following file types:

  • Documents.
  • Images.
  • Videos.
  • Archives.
  • Audio files.
  • Other important files.

The Format virus ransomware is careful not to encrypt files in the regularly targeted Windows directories and the main reason for this is the fact that encrypting system files may damage Windows. Instead, the often used files outside of system directories of Windows are encrypted and they are added the .format extension:

Once the Format virus adds the extension, the files are encrypted and they are no longer readible. The primary idea behind this is to change data from the original file using the AES encryption mode (Advanced Encryption Standard). This generates a unique decryption key that can be used by the crooks to extort you into paying money. When you pay in BitCoin, they promise to give you a decryptor for your key and decrypt files. Paying the ransom is strongly inadvisable and the main reason for not paying is that you cannot trust these cyber-criminals with your files. Instead we advise you to backup all of the .format files and wait for a free decryptor to come out, which is usually in 1 or 2 weeks time.

Remove Format Ransomware and Try to Restore .format Virus Files

In order for you to remove the Format ransomware virus entirely from your computer system, we advise you to follow the removal instructions that are underneath this article. They have been created with the primary reason to help you delete the virus step by step. However, if you want a faster removal and to detect and all virus files of this ransomware, we recommend that you remove it with a professional malware removal program. Such advanced software is powerful enough to scan for and detect all virus files on your computer and remove the Format virus completely.

If you want to try and restore files, that have been encrypted by the .format virus, then we do advise that you first do a backup. Then, you can try using the alternative methods for file recovery posted underneath. They are in no means 100% effective, but with their help, you can try to restore at least some of your encrypted files.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Follow Me:


  1. AvatarBona

    Thanks, sir. But my files are encrypted with .format and their ID are not in there. What should I do?

  2. AvatarBona

    Error: Unable to decrypt file with ID: 9vfpmvri6cTZ9H29Z9uMVrZYgr4wwXG36rYZShtC


Leave a Reply to Bona Cancel reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Stay tuned
Subscribe for our newsletter regarding the latest cybersecurity and tech-related news.