Monday, March 27, 2017

Flotera ransomware removal instructions

Flotera ransomware removal instructions

What is Flotera?

Flotera is a ransomware-type virus similar to Polski ransomware. This malware is developed using an open-source file encryption project called AESxWin. Once infiltrated, Flotera encrypts files using AES-256 cryptography. During encryption, Flotera appends names of encrypted files with the ".aes" extension. For instance, "sample.jpg" is renamed to "sample.jpg.aes". Following successful encryption, Flotera creates a text file ("!!!-ODZYSKAJ-DANE-!!!.TXT"), which contains a ransom-demanding message, and places it on the desktop.
The message within the "!!!-ODZYSKAJ-DANE-!!!.TXT" file is in Polish and, thus, it is safe to assume that Flotera ransomware targets users mainly from Poland. This does not mean, however, that users from other countries are safe. The message states that files are encrypted and that they can only be restored using a unique decryption key, which is stored on a remote server controlled by Flotera's developers. A ransom of $199 must be paid by contacting the developers via one of the emails ("flotera@2.pl" or "flotera@protonmail.ch") provided. Further payment details are then provided. The ransom must be paid within four days, otherwise the cost doubles. Victims are permitted to attach two selected files, which are then decrypted and returned. This supposedly to guarantee that decryption is possible. Despite this, you should never trust these people. Research shows that cyber criminals often ignore victims once payments are submitted. Ignore all requests to pay or contact these people, since there is a high probability that you will be scammed. Unfortunately, there are no tools capable of restoring files compromised by Flotera. The only solution is to restore files/system from a backup.
Screenshot of a message encouraging users to pay a ransom to decrypt their compromised data:
Flotera decrypt instructions
Flotera shares many similarities with dozens of other ransomware-type viruses such as CryptoDevilRevengeEnjey CrypterFileLocker, and Purge. All have identical behavior - they encrypts files and makes ransom demands. The only major differences are size of ransom and type of encryption algorithm (symmetric or asymmetric) used. Cyber criminals proliferate ransomware via fake software update tools, trojans, third party software download sources (P2P networks, free file hosting websites, freeware download websites, etc.), and spam emails (malicious attachments). For these reasons, keep your installed applications up-to-date and use a legitimate anti-virus/anti-spyware suite. In addition, be very cautious when downloading software from unofficial sources and when opening files received from suspicious emails. Poor knowledge and careless behavior are the main reasons for computer infections. The key to computer safety is caution.
Text presented within Flotera ransomware text file "!!!-ODZYSKAJ-DANE-!!!.TXT":
@@@@@@@@@@@@@@@@@@@@@
Ŧ l ๏ t є г ค г ค ภ ร ๏ ๓ ฬ ค г є
@@@@@@@@@@@@@@@@@@@@@
######################################################################
Nie możesz znaleźć potrzebnych plików na dysku twardym ? Zawartość Twoich plików jest nie do otwarcia?
Jest to skutek działania programu który zaszyfrował większość Twoich danych przy pomocy silnego alogrytmu AES-256
używanego min. przez służby mundurowe do zatajania danych przesyłanych drogą elektroniczną.
Jedyna metoda aby odzyskać Twoje pliki to wykupienie od nas programu deszyfrującego, wraz z jednorazowym kluczem wygenerowanym unikalnie dla Ciebie!
########################################################################
W momencie gdy to czytasz całość jest już ukończona, wytypowane pliki zostały zaszyfrowane a sam wirus usunięty z Twojego komputera.
Klucz składający się z kilkudziesięciu znaków potrzebny do odszyfrowania danych z dysku znajduje się w miejscu dostępnym tylko dla nas !
Możesz w nieskończoność próbować instalacji kolejnych programów antywirusowych, Formatować system operacyjny to jednak nic nie zmieni !
Jeśli nie zastosujesz się do naszych instukcji nie odzyskasz plików które były na dysku HDD.
########################################################################
Gdy już postanowisz odzyskać swoje dane wyślij wiadomość pod obydwa adresy e-mail: flotera@2.pl oraz flotera@protonmail.ch
Możesz też napisać na Gadu-Gadu: 62206321
2 Pliki odszyfrujemy za darmo aby udowodnić że jesteśmy w stanie tego dokonać, Za resztę niestety musisz zapłacić !
Cena za odszyfrowanie wszystkich plików: 199$
Uwaga ! Nie marnuj czasu, czas to pieniądz za 4 dni cena wzrośnie o 100 % !
Screenshot of a pop-up window displayed by Flotera ransomware:
Flotera pop-up
Screenshot of files encrypted by Flotera ransomware (".aes" extension):
Files encrypted by Flotera

Flotera ransomware removal:

Step 1
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Safe Mode with Networking
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Windows 8 Safe Mode with networking
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
windows 10 safe mode with networking
Video showing how to start Windows 10 in "Safe Mode with Networking":
Step 2
Log in to the account infected with the Flotera virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.
If you need assistance removing flotera , give us a call 24/7:
1-866-208-0865
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. SpyHunter’s free scanner is for malware detection. To remove the detected infections you will need to purchase a full version of this product. More information on SpyHunter. If you wish to uninstall SpyHunter follow these instructions. All the products we recommend were carefully tested and approved by our technicians as being one of the most effective solutions for removing this threat.
If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.
Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":
1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.
Boot your computer in Safe Mode with Command Prompt
2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.
system restore using command prompt type cd restore
3. Next, type this line: rstrui.exe and press ENTER.
system restore using command prompt rstrui.exe
4. In the opened window, click "Next".
restore system files and settings
5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the Flotera ransomware virus infiltrating your PC).
select a restore point
6. In the opened window, click "Yes".
run system restore
7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining Flotera ransomware files.
To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of Flotera are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.
To restore a file, right-click over it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.
Restoring files encrypted by CryptoDefense
If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.
To regain control of the files encrypted by Flotera, you can also try using a program called Shadow Explorer. More information on how to use this program is available here.
shadow explorer screenshot
To protect your computer from file encryption ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and EasySync CryptoMonitor, which artificially implant group policy objects into the registry to block rogue programs such as Flotera ransomware.
HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises any attempts without need for user-intervention:
hitmanproalert ransomware prevention application
Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:
malwarebytes anti-ransomware
  • The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

No comments:

Post a Comment

Полезные сервисы, чтобы не сливать бюджет

Как зарабатывать на Арбитраже трафике? Расскажут тут - https://t.me/arbitration_traff September 22, 2017 https://t.me/arbitration_traff...