Fantom Ransomware - How To Remove?

Type: Ransomware
Other names: Fantom virus

A new crypto-ransomware variant has been getting a lot of buzz since it is an extremely elaborate scam. The creators of Fantom virus have definitely put a lot of efforts into making this masterpiece as it seems to use high-quality techniques to secretively encrypt victims’ files. Users might be completely clueless while the encryption process is actually happening under their nose. Fantom virus is noticed to follow the well-known EDA2 project. The most unusual feature of this ransomware is that the encryption process is attempted to be overshadowed by a Windows Update Screen, suggesting that your computer needs to overcome a critical update.

About Fantom ransomware

If your computer suddenly declares that it has to go through an update, make sure that this is actually originating from the right source. Finding out the truth when it comes to Fantom virus might be a little more difficult. There is a great chance that people won’t understand the actual meaning behind a so-called “critical update”. The main file of the Fantom virus will suggest that it belongs to the legitimate Microsoft company. However, this is a total sham and people should never assume that this corporation is definitely the one suggesting an update. Another file will also be spotted, called WindowsUpdate.exe which will be responsible for the good-old Windows Update screen. After that, it basically feels like you are on lockdown. Victims no longer can reach their desktops and are unable to do anything else but stare at a screen with slowly increasing percentage number (this screen will suggest that your system is being configured). This is just a coverup so Fantom virus could successfully encrypt your files without you finding out about it before the process is completed. No actual update is going to be prepared after the percentage number hits 100. If you are suspecting that there is something fishy about this screen or have to immediately access your system, you can press a combination on your keyboard (CTRL+F4) and you will exit the Windows Update Screen. However, we wish we could tell you that this will put and end to the ongoing encryption process. Sadly, no such luck. Fantom virus continues to do its job and encrypts your files using an AES-128 key for encryption. In addition to that, infection will also use RSA to encrypt the generated keys. Speaking about the encryption, we should mention that this ransomware targets an extremely wide range of files. Some of them are these:

.docm, .docx, .dot, .dotm, .dotx, .dox, .dpk, .dpl, .dpr, .dsk, .dsp, .dvd, .dvi, .dvx, .dwg, .dxe, .dxf, .dxg, .elf, .epk, .eps, .eql, .erf, .err, .esm, .euc, .evo, .ex, .exif , .f90, .faq, .fcd, .fdr, .fds, .ff, .fla, .flac, .flp, .flv, .for, .forge, .fos, .fpk, .fpp, .fsh, .gam, .gdb, .gho, .gif, .grf, .gthr, .gz, .gzig, .gzip, .h3m, .h4r, .hkdb, .hkx, .hplg, .htm, .html, .hvpl, .ibank, .icxs, .idx, .ifo, .img, .indd.

After the encryption is successful, victims will notice that the encrypted files have a new extension appended to them: .fantom. They will also spot a new piece of data: DECRYPT_YOUR_FILES.HTML, offering them information about the situation at hand. To make this situation even more intense Fantom virus will delete Shadow Volume Copies and even use a self-destruct button for the WindowsUpdate.exe.

How to Decrypt Files Encrypted by Fantom Ransomware?

Sadly, this ransomware uses a combination of two encryption algorithms, so IT specialists will have to take their time to find out how to crack this virus. However, Fantom virus has its own idea about how you can get back your files. It will urge users to contact the hackers via email addresses ( or Do not engage in a conversation with the people behind this ransomware: it will do you no good. They will simply demand you to pay a fee for the decryption key. The exact amount is unknown so it might depend on the number of encrypted files. Either way, never pay the ransom. Even if the ransom note suggests that hackers will delete the decryption key after a week. The best idea for Internet users would be to backup their files or make copies and store them in an USB. This is one of the easiest ways to become immune to ransomware viruses.

How is Fantom Ransomware Distributed?

As the encryption of the files might be difficult, it is extremely easy to become infected with Fantom virus. Even after visiting a seemingly harmless domain, you might notice that your system is being influenced by a critical update. Furthermore, email accounts can also play a major role in the distribution of ransomware viruses. It might be that users opened a spam letter and downloaded and attachment inside it. Of course, without being aware of the fact that the downloaded file might have been a payload of a ransomware.

Eliminate Fantom virus and proceed with the possible ways to decrypt your files. You can do this by employing Reimage, Spyhunter or Hitman for the this important task. These antivirus programs will protect your device and make sure that no threats are making changes to it.

How to recover Fantom ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP
  • Start Shutdown RestartOK.
  • Press F8 key repeatedly until Advanced Boot Options window appears.
  • Choose Safe Mode with Command Prompt. Windows 7 enter safe mode

for Windows 8 / 10
  • Press Power at Windows login screen. Then press and hold Shift key and click Restart. Windows 8-10 restart to safe mode
  • Choose TroubleshootAdvanced OptionsStartup Settings and click Restart.
  • When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings. Windows 8-10 enter safe mode

2.Restore System files and settings.

  • When Command Prompt mode loads, enter cd restore and press Enter.
  • Then enter rstrui.exe and press Enter again. CMD commands
  • Click “Next” in the windows that appeared. Restore point img1
  • Select one of the Restore Points that are available before Fantom virus has infiltrated to your system and then click “Next”. Restore point img2
  • To start System restore click “Yes”. Restore point img3

Step 2. Complete removal of Fantom ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Reimage and remove all malicious files related to Fantom virus. You can check other tools here.

Step 3. Restore Fantom ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Fantom virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so.

Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer.

a) Native Windows Previous Versions

Right-click on an encrypted file and select PropertiesPrevious versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

Previous version
b) Shadow Explorer

It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.
Shadow explorer

Step 4. Use Data Recovery programs to recover Fantom ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

  • We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
  • Download Data Recovery Pro (commercial)
  • Install and scan for recently deleted files. Data Recovery Pro

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.


About the author

 - Main Editor

I have started in 2007 after wanting to be more or less independent from single security program maker. Since then, we kept working on this site to make internet better and safer place to use.

August 26, 2016 00:23, January 3, 2017 06:40

Leave a Reply

Your email address will not be published. Required fields are marked *