Fedasot ransomware (Virus Removal Instructions) - Bonus: Decryption Steps

What is Fedasot ransomware?

Fedasot ransomware is crypto malware that initiates a variety of system changes to encrypt personal user files

Fedasot ransomware is a file locking malware that belongs to STOP (Djvu) virus family

Fedasot is a file locking threat that was discovered when victims reported the infection in early May 2019. Belonging to the STOP/Djvu virus family, this ransomware^[1] focuses on money extortion and demands $980 or $490 payment in Bitcoin or any other cryptocurrency.

As soon as Fedasot ransomware enters the machine, it performs a variety of system changes, contacts C2 server, and then begins the file encryption process that is performed with the help of AES^[2] or another algorithm. During this process, the malware displays a fake Windows update pop-up that is developed to mislead the victims and prevent the interruption of the process.

Once the process is over, each of the personal files like pictures, music, databases, documents, and others are marked with a .fedasot appendix. Unfortunately, from this time victims are unable to open any of the data affected by the virus. Instead, they can access a ransom note _readme.txt that explains to users what happened to their machines and what to do next.

Just as in previous STOP variants, crooks behind the threat ask users to contact them via the @datarestore Telegram account or vengisto@firemail.cc/gorentos@bitmessage.ch email addresses. If you are infected with the virus, you should immediately remove Fedasot ransomware with the help of the instructions that can be found in the bottom section of this article.

There are a variety of ways one can get infected with Fedasot virus. The most common infection methods used by hackers are:

• Spam emails;
• Exploit kits;^[3]
• Cracks or keygens;
• Pirated software installers;
• Web injects;
• Fake updates, etc.

Once inside the system, Fedasot ransomware performs a variety of changes to the Windows operating system. For example, it modifies Windows registry to gain persistence and deletes Shadow Volume Copies to prevent file recovery after Fedasot ransomware removal.

These modifications to the system help the malware to perform file encryption without interruptions. Unfortunately, users then find out that are unable to view documents, pictures or any other data located on their machine. Instead, they can open the _readme.txt ransom note which reads:

ATTENTION!

Don't worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted
with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-1aTCryfzhK
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
vengisto@firemail.cc

Reserve e-mail address to contact us:
gorentos@bitmessage.ch

Our Telegram account:
@datarestore

Depending on where you live, $980 or $490 might be a large or small sum. Regardless of the price, you should ignore the message from cybercriminals and never contact them, as chances of being scammed remains. Besides, paying threat actors will only prompt them to infect more victims and create new versions of Fedasot ransomware.

Thus, use anti-malware software to terminate the Fedasot virus, scan your computer with FortectIntego to repair the infected system files and only then attempt file recovery. You can connect your backup device or retrieve data from virtual storage.

If you did not have backups, restoring files might be almost impossible, unless the encryption process took place when your machine was not connected to the internet. Nevertheless, we suggest you try using third-party software as it might be able to recover at least some of your files.

Fedasot ransomware is a type of malware that locks up users' files and demands ransom of $980/$490 to be paid for the decryption tool

Take care of your online safety to avoid ransomware infections

While avoiding computer viruses 100% might be impossible, there are several precautionary measures that you could make use of – it would reduce the chance of the infection to a minimum. Nevertheless, installing anti-malware software and updating it on time is not enough, especially if being careless online.

Anti-malware software is a great tool to protect yourself from already known viruses, although most paid programs use machine learning technology, which can recognize suspicious patterns of completely new malware. Nevertheless, hackers are intelligent people, and they are always looking for new ways to trick security software.

Therefore, besides using the anti-virus application, you should also:

• Keep your Windows updated, along with all the installed programs;
• Use caution when handling spam emails, especially those with attachments or hyperlinks (be aware that some phishing emails manage to bypass the built-in scanners and end up in your Inbox);
• Use ad-blocker when visiting high-risk sites (torrents, adult-oriented, third-party downloads, etc.);
• Enable Firewall;
• Do not download and install pirated software or its cracks;
• Disable Adobe Flash plugin or set it to click to run;
• Use strong passwords for all your accounts and enable two-factor authentication.

Avoid paying ransom and instead remove Fedasot ransomware from your PC

To remove Fedasot ransomware, you will have to install a reputable anti-malware tool. There are plenty on the market available, although be aware that the same AV engine might not detect each of the ransomware versions. Therefore, you might have to try another software before you succeed. Additionally, you should access Safe Mode before you perform Fedasot ransomware removal, as the safe environment would temporarily disable malware's operation.

As soon as you delete Fedasot virus, you can then attempt file recovery. As we previously mentioned, the STOPDecrypter might be useful if the encryption process was performed when offline. If that does not work, you can try out third-party recovery software, download links of you can find below.