How to remove Tater ransomware

Tater ransomware is file locking malware that belongs to GarrantyDecrypt virus family

Tater ransomware is a type of malware that is designed to lock up users' files and then demand ransom for their release. The threat stems from GarrantyDecrypt – a virus that has been active since October 2018, and since then released multiple variants, such as .decryptgarranty, .protected, .NOSTRO, .cosanostra, .metan, .spyhunter, and others. 

Tater virus uses RSA encryption algorithm^[1] to lock up data, appends .tater extension and finally drops a ransom note  #HOW TO DECRYPT#.txt. In the brief message, hackers urge users to contact them via tater@mail2tor.com email within 48 hours of the infection, or otherwise, the decryption key will be deleted.

To retrieve access to pictures, videos, documents, and other data, users have to either pay cybercriminals in Bitcoin for the unique key (experts highly advise refrain from doing so), wait for the official decryptor or use third-party recovery tools for decryption. Before that, users have to remove Tater ransomware from their machines completely, or the restored files will be repeatedly locked.

Tater ransomware can be spread in a variety of different methods – it highly depends on how determined the crooks are, as some distribution means require in-depth IT knowledge and preparation. Here are some of the ways hackers can use:

• Brute force attacks via the RDP;
• Spam emails;
• Fake updates;
• Exploit kits;^[2]
• Repacked or hacked software installers;
• Software cracks or keygens;
• Malicious ads, etc.

As soon as Tater ransomware enters the computer, it does not start the encryption process straight away. Malware first performs all the necessary changes to the system in order to operate without disturbances. For example, Tater file virus is known to open, copy, write and delete files, change Windows registry, elevates its privileges via process injection and shell commands,^[3] load new modules, etc.

After all the technical changes are made, Tater ransomware then performs the encryption, locking users out of their personal files. Finally, the virus drops a ransom note to inform the infected users about the situation:

!!!!!!!Your files are encrypted!!!!!!!
Do not try to recover your files on your own or with someone else,because after the intervention you can remain without your data forever.
You have 48 hours to contact us,otherwise you will be left without access to the files forever.
Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service
Only we can decrypt all your data! 
Contact us us:
tater@mail2tor.com
And tell us your unique ID

Experts^[4] highly advise users staying away from criminals behind Tater ransomware, as the chance of getting scammed is quite high. In such a case, even after the payment, you might end up losing not only your files but also the money. Additionally, such action will only prove that ransomware works and hackers will keep expanding their illegal business.

Therefore, do not contact hackers and instead proceed with Tater ransomware removal. You should use reputable security application (such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes) for that, although not all of them might be able to detect and terminate the threat. Additionally, you should run a scan with FortectIntego to recover from system damage. Once you delete the virus completely, you can attempt to recover your data.

Be careful while browsing the internet to avoid ransomware attacks

There are a variety of methods that would help you protect your device from ransomware and other malware. Of course, no means can guarantee you 100% protection, as malicious actors continually improve their codes to release more robust and persistent versions of the virus. Nevertheless, these tips should help you to keep ransomware infection risk at a minimum:

• Install reputable security software and keep it up to date;
• Enable Firewall;
• Use ad-blocker, especially when visiting high-risk sites (porn, torrents, gambling, etc.);
• Keep your OS, along with all the installed programs, up to date;
• Use strong passwords for all your accounts and enable two-factor authentication;
• Beware of spam emails – attachments or links inside might lead to ransomware;
• Disable Remote Desktop Protocol when not using it;
• Scan all executables you download from the internet with tools like Virus Total.

Terminate Tater ransomware using reputable security tools

You should not attempt to remove Tater ransomware manually – ransomware is a complicated infection that embeds deep within the system and changes the way it operates. Therefore, you should instead rely on professional tools like SpyHunterCombo Cleaner. Nevertheless, a scan with a few applications might be needed in order to terminate the Tater virus. Once you are ready, enter Safe Mode with Networking as explained below and perform a full system scan.

Tater ransomware removal will guarantee that all the files you recover from backups or other means will not be encrypted repeatedly. That is why you should never attempt the recovery prior to the elimination of the virus. If you have no backups ready, check third-party software that might help you recover at least some of your files.