How to remove Fast_Decrypt_and_Protect@Tutanota.com ransomware virus

Fast_Decrypt_and_Protect@Tutanota.com is a file encrypting virus that is used to blackmail people

Fast_Decrypt_and_Protect@Tutanota.com is a ransomware virus,^[1] and its primary goal is to encrypt certain computer files. This crypto-locker is a part of Xorist ransomware family that been lurking around the world wide web since 2016. It uses XOR or TEA cipher to encrypt data and appends .fast_decrypt_and_protect@tutanota.com file extension. The virus then drops ransom note HOW TO DECRYPT FILES.txt which explains that payment of 3 BTC should be transferred to crooks in order to obtain a decryption key. Nevertheless, victims can use a free Xorist decryptor that might be useful for data recovery.

Criminals put victims under time pressure and give mere 24 hours to make the payment. If the ransom isn’t transferred within this time, the extortionists threaten with the complete destruction of the encrypted data. This way, different documents, files archives, video and audio material will supposedly be destroyed. We don’t know whether the criminals stick to this promise, but it is definitely not worth risking it. A safer solution is to remove Fast_Decrypt_and_Protect@Tutanota.com virus from the PC and prevent further data encryption.

The ransom note states the following [sic]:

All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encryption was produced using unique KEY generated for this computer.

To decrypt files, you need to obtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet; The server will destroy the key within 24 hours after encryption completed. Payment have to be made in maxim 24 hours. To retrieve the private key, you need to pay 3 BITCOINS.

Bitcoins have to be sent to this address: 

After you've sent the payment send us email to: fast_decrypt_and_protect@tutanota.com with subject : ERROR-ID-random(3BITCOINS) . If you are not familiar with bitcoin you can buy it from here: SITE : www.localbitcoin.com. 

After we confirm the payment, we send the private key so you can decrypt your system.

Security specialists^[2] advise not to contact Fast_Decrypt_and_Protect@Tutanota.com malware creators under any circumstances. Even if you manage to get the decryptor, you will be doing a big favor to cybercriminals and encourage them to produce more viruses. Thus, instead stick to Xorist decryptor or use third-party software to recover your files. 

There is no much that the cybersecurity experts know about this virus. Its distribution is rather low, and it is quite challenging to come across its samples. Judging from the ransom note, it is clear that hackers are not native English speakers, as the message is littered with mistakes.

Nevertheless, what the experts do know is how to recognize the threat once it is on the computer. The infected device starts working slower, its RAM and CPU utilization^[3] will increase to the highest levels, and different strange processes will show up in the Windows Task Manager. Additionally, ransomware viruses are known to weaken the system which allows other infections to slip through into machines easily.

Even if you don’t notice the initial processes of the ransomware attack, you will inevitably become aware of this problem after you unexpectedly lose access your files and find a ransom note on your PC demanding you to pay. Of course, you should refuse any collaboration with the cybercriminals and perform Fast_Decrypt_and_Protect@Tutanota.com removal instead. Fix your PC with FortectIntego or similar antivirus software. Professional tools will make sure that the virus is banished from the system to the last bit of its malicious components.

Ransomware distribution: spam emails dominate

There are a few techniques that modern ransomware use for the system infiltration. One of these methods relies on spam emails and their attachments. Malicious spam campaigns send around counterfeited emails with an attached files disguised as invoice or tax information. The virus payload is activated once the victim opens an infected attachment.

Another way that crypto-ransomware can infiltrate computer is through brute force attacks. Weak passwords of RDP^[4] networks and outdated software vulnerabilities highly increase the chances of ransomware attack.

Finally, ransomware developers may employ exploit kits and Trojans to deploy their malicious creations on the victim’s computer. Typically such infectious programs will be delivered through Torrent networks or other peer-to-peer file sharing domains as well as unsafe websites.

As you can see, file-encrypting malware can easily catch you off guard. Thus, we highly recommend following these simple precautions:

• Install a reputable anti-malware software and keep it up to date;
• Always update your software and operating system as soon as new patches are out;
• Only download updates from trusted sources;
• Protect your RDP with a strong password;
• Do not open spam emails (especially attachments);
• Avoid suspicious websites, such as porn, gambling, file-sharing and other similar domains.

Quick suggestions for Fast_Decrypt_and_Protect@Tutanota.com removal

If you find yourself in a situation when you have to remove Fast_Decrypt_and_Protect@Tutanota.com virus from your PC but have no experience in any malware elimination whatsoever, you should not panic and trust this job to the specialized antivirus software, such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. These tools will locate hazardous components on your computer and expose virtual threats, including exploits, rootkits, and trojans.

After Fast_Decrypt_and_Protect@Tutanota.com removal, you will then be able to attempt data recovery. Though there is official decryption tool for Xorist invented, it might not help with this version of ransomware. Nevertheless, you should be able to restore at least some of your files using alternative recovery suggestions below.