Fatp virus Removal and Decrypt

  Fatp ransomware variant is a type of malware encrypts files (video, photos, documents) 

Fatp virus

This type of ransomware attack hits files, then add a new extension to the files, and the victim  will not be able to use them, For example, "video1.mp4” will be named as “video1.mp4.Fatp”, and also it will put text document (_readme.txt) inside each encrypted folder.

Fatp ransomware used a unique decryption key, and it will be different for each infected computer system.

The decryption key is hosted on a server under the criminals full control, who have actually loaded the ransomware into the internet each victim will have unique id, the victim told to contact the attackers to pay the ransom.

There is no warranty that these online Cyber-criminals will keep their promises, so you may lose your money for nothing.

It's recommended saving a copy from all essential documents every day/week to an external storage. "USB Flash Drive/external HDD, or the cloud data storage. Keeping the backups on your system drive is not supported.

How does .Fatp ransomware attack files?

1. By spam e-mails.
2. Some Fake Ads on free hosting websites.
3. Some unsafe torrent software, Opening these types or clicking on the harmful links might harm the system.
4. Applications games cracks.

How To protect from the .Fatp ransomware Cyber-attack

1. Do not open any e-mail attachments, specifically from unknown sender.
2. Do not install unsafe freeware.
3. Install an antivirus with last update, to check each file before opening it.

How to remove Fatp virus?

You can remove ransomware from windows 10 & Remove Ransomware from windows 7  .

You have to change all your passwords used on the infected device because the Fatp ransomware may steal the passwords stored in your browser and send them to the gangs.

How to Decrypt .Fatp ?

a. Big files restoration

Remove .Zate extension from some BIG files then open them, this depends on virus ability of reading and encrypting the file, so it will not add the file marker. incase each file is larger than 2GB. 

b. Download free Decrypt tool for STOP/Djvu 

1. Make sure to launch Emsisoft decryption tool as an administrator. then agree with the license terms by clicking on "yes" button.

2. It will automatically find the available drives, including any connected drives, and for more locations can be selected with the “Add” button.

3. After adding the needed locations for decryption into the list, click on the “Decrypt” button to start the decryption procedure.

4. The main screen may turn you to a status view, letting you know of the active process and the decryption statistics of your data.

5. The tool will notify you at the end of the decryption process.

Emsisoft will display a message while decrypting files like:

No key for New Variant online ID

The decryption is impossible. Your original files were encrypted with an online key you run the virus while you are connected to the internet. So no one has the same encryption/decryption key pair. 

Result: No key for new variant offline ID

Decryption may be possible in the future. Receiving this message is good news for you, because it might be possible to restore your files in the future, follow updates regarding the decrypted DJVU variants.

Remote name could not be resolved

It refers to DNS problem on your PC, so reset your HOSTS file back to default.

References

What is Ransomware?

How to get rid of Ransomware?.

How to Protect Networks from Ransomware attack?.

 The history of harmful ransomware