Severity scale:  
  (98/100)

F1220@tuta.io ransomware. How to remove? (Uninstall guide)

removal by Jake Doevan - - | Type: Ransomware

F1220@tuta.io – a ransom-demanding virus which offers free decryption of three files

F1220@tuta.io virus
F1220@tuta.io is a ransomware virus which renames the file by using random characters.

F1220@tuta.io is a dangerous file locking virus which appears to be a new variant of the Scarab ransomware family. This threat also spreads via phishing messages and modifies the Windows Registry[1] to start its damaging activity. F1220@tuta.io virus encrypts files by using unique algorithms such as AES or RSA and renames the locked document by adding random characters. Moreover, this cyber threat produces a ransom-demanding message named HOW TO RECOVER ENCRYPTED FILES.TXT which urges for Bitcoin in exchange for the unlocking tool and offers free decryption of three small files. Furthermore, the note provides f1220@tuta.io and f1220@mail.ee email addresses which are the way to contact the criminals.

Name F1220@tuta.io 
Related to Scarab ransomware
Category Ransomware
Extension Renames the encrypted file by using random characters
Ransom message HOW TO RECOVER ENCRYPTED FILES.TXT
Ransom No particular price is given, however, the crook urges for Bitcoin cryptocurrency
Email addresses f1220@tuta.io and f1220@mail.ee 
Encryption code RSA/AES
Offers Criminals offer three files for free decryption
Distribution Phishing emails are the most common ransomware spreading source
Damage fixing Fix the damage done by this ransomware by installing Reimage

Once installed, F1220@tuta.io ransomware[2] uses unique ciphers to lock up important documents. Such codes differ each time when the virus infects a different user. This is the main reason why decryption keys are almost impossible to discover even for highly-experienced tech experts. Nevertheless, all keys are stored on remote servers which makes them unreachable for other people, except the criminals themselves.

The F1220@tuta.io ransom message looks like this:

Your files are now encrypted!

Your personal identifier: –
All your files have been encrypted due to a security problem with your PC.

Now you should send us email with your personal identifier.
This email will be as confirmation you are ready to pay for decryption key.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

Contact us using this email address: f1220@tuta.io, f1220@mail.ee

Free decryption as guarantee!
Before paying you can send us up to 3 files for free decryption.
The total size of files must be less than 10Mb (non archived), and files should not contain
valuable information (databases, backups, large excel sheets, etc.).

How to obtain Bitcoins? 
* The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 
'Buy bitcoins', and select the seller by payment method and price: 
https://localbitcoins.com/buy_bitcoins 
* Also you can find other places to buy Bitcoins and beginners guide here: 
http://www.coindesk.com/information/how-can-i-buy-bitcoins 

Attention! 
* Do not rename encrypted files. 
* Do not try to decrypt your data using third party software, it may cause permanent data loss. 
* Decryption of your files with the help of third parties may cause increased price 
(they add their fee to our) or you can become a victim of a scam.

Crooks who spread viruses such as F1220@tuta.io ransomware may not always provide particular details about the ransom price. However, in almost all cases, criminals demand cryptocurrency such as Bitcoin, Ethereum, Monero, and others, only. Such cryptocurrency transfers give strong guarantees that the entire transfering process will remain safe and untrackable.

If you overcome this ransomware infection, you need to remove F1220@tuta.io virus from your computer system instantly. After you do that, you can fix the damage done by this cyber threat by using Reimage or any other similar anti-malware tool if you are likely too. Make sure you do not perform the data recovery method before you eliminate the infection. Get rid of the virus first and then check out our suggested third-party software for file restoring.

Another reason to complete the F1220@tuta.io removal is that some ransomware-related viruses have an ability to open paths for other malware forms to spread easily. In some cases, you can get your computer system infected even with a Trojan[3]. If such thing happens, the elimination process will become even more difficult to perform. So, please be aware of such possible consequences and terminate the infection ASAP.

Take precautionary measures against ransomware infections

According to malware experts[4], ransomware has one main distribution source – spam emails. Cybercriminals often drop dubious messages to numerous random users. Such emails come with harmful attachments, which once opened, launch the virus-related content straightly to the victim's computer system. So, if you ever overcome a suspicious-looking email from a questionable sender – better eliminate it permanently for your own safety.

Moreover, you should avoid visiting third-party websites, for example, P2P networks. These pages can include damaging content which might be a hidden virus. For automatical computer protection, we advise investing in a reliable antivirus program. Computer security software is necessary for every user as it keeps the computer system protected all the time if updated regularly.

Terminate F1220@tuta.io ransomware

If you want to remove F1220@tuta.io virus from your computer system, you need to download and install a reliable anti-malware tool and perform the elimination process. After you do that, we suggest using Reimage, Malwarebytes MalwarebytesCombo Cleaner, or Plumbytes Anti-MalwareMalwarebytes Malwarebytes to fix the damage that was done by the ransomware infection. Note that, manual elimination is not possible for this case as the virus might be too hard to remove on your own.

After you perform the F1220@tuta.io removal, you should not forget to complete some system backups to make sure that all virus-related content was disabled correctly. Moreover, you can start thinking about the data recovery process. We have provided some methods which might be helpful in this case. You can find them below this article.

Offer
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.

If you decided to select another anti-spyware, uninstall Reimage from your computer.
Press mentions on Reimage
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove F1220@tuta.io virus, follow these steps:

Remove F1220@tuta.io using Safe Mode with Networking

Reboot your computer to Safe Mode with Networking by using these guiding steps:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove F1220@tuta.io

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete F1220@tuta.io removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove F1220@tuta.io using System Restore

Turn on the System Restore feature to deactivate the ransomware virus:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of F1220@tuta.io. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that F1220@tuta.io removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove F1220@tuta.io from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

Recover locked data by trying our suggested methods. It is better to try all other options than paying the demanded ransom as you risk being scammed.

If your files are encrypted by F1220@tuta.io, you can use several methods to restore them:

Try Data Recovery Pro and restore important documents:

This data restoring method might be helpful if you use it as shown in the instructions.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by F1220@tuta.io ransomware;
  • Restore them.

Maybe Windows Previous Versions feature will be helpful in data recovery:

This method will work only if you have enabled the System Restore feature before the ransom attack emerged.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Try using Shadow Explorer if the virus did not erase Shadow Volume Copies of corrupted data:

However, if the Shadow Volume Copies of your locked files were erased or damaged in a certain way, there are almost no chances that this method will work.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

There is no official decryptor found yet.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from F1220@tuta.io and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions

References