How to remove iTunes (FlyStudio) ransomware from PC

Tips to recover files from iTunes (FlyStudio) ransomware

iTunes (FlyStudio) ransomware is dangerous computer malware that was discovered by GrujaRS. It is able to encrypt all type of file format and only focused on getting ransom money. Further, this harmful virus will silently enter into the computer and encrypt all your system files without having permission. After that, it will add “.iTunes” extension to the end of encrypted files. As soon as locking process completed, it generates a text file named “.itunes-DECRYPT—[random-number].txt” and dropped it on your computer screen.

The displayed note contains ransom demand and all the necessary instructions to decrypt your files. You must know that ransom note generated by iTunes (FlyStudio) ransomware is written in Chinese language that contains instructions on how to contact cyber criminals. In order to restore files, users are instructed to contact cyber criminals through email as soon as possible. Users are also warned not to rename encrypted files or shut down the infected computer because it may cause data loss.

Regrettably, there are no any tools available that could decrypt files encrypted by iTunes (FlyStudio) ransomware, cyber hackers behind the ransomware are the only ones who have it. In order to gain the trust of user that decryption is possible they offer free decryption test of some encrypted files. Thus, to prevent this malware from further encryptions you are highly advised to remove it as quickly as possible from the PC by using some reputable antivirus removal tool.

Short description

Name: iTunes (FlyStudio) ransomware

File Extension: .itunes

Type: Ransomware, Cryptovirus

Short Description: The ransomware encrypts files on your computer system and demands a ransom to be paid to allegedly recover them.

Symptoms: This ransomware will encrypt your files by appending the .itunes extension to them and makes totally useless.

Ransom Demanding Message: itunes-DECRYPT—-[random-number].txt

Cyber Criminal Contact: [email protected]

Distribution methods: Infected email attachments, torrent websites, malicious ads, pirated software, suspicious links, file sharing on unsafe network and other social engineering methods.

Damage: All files are encrypted and cannot be accessed without paying a ransom. Additional password-stealing Trojans and other malware infections can be installed together with a ransomware.

Removal: If your PC gets infected with iTunes (FlyStudio) ransomware then we recommend running a scan with powerful anti-malware tool. Once malware gets removed, you can recover your files using data recovery software.

What to do after encryption?

As all your files are encrypted and you are unable to access them anymore. Paying money to iTunes (FlyStudio) ransomware is highly risky as it does not generate any positive results. It is also possible that after getting money hackers will stop communicating and even don’t answer your calls or messages. In such case, you are advised to use strong anti-malware removal tool in order to remove nasty threat completely from the system. Once PC gets cleaned as well as malware removed, recover your encrypted files through backups or any other data recovery software.

How iTunes (FlyStudio) ransomware attack?

iTunes (FlyStudio) ransomware gets inside the PC with the help of spam email attachments, clicking on malicious links, updating system software, visiting commercial or pornographic websites and other tricky ways. Once activated, it will take control over the targeted system and encrypt all kinds of data found on your computer hard disk. It can also disable your antivirus and firewall security programs due to which you will not be able to remove this infection. So, you must stay away from these vicious sources. Avoid downloading and installing software from third party websites. Use only official sources and direct download links.

Remove iTunes (FlyStudio) ransomware

Manual malware removal instructions might be lengthy and complicated as it requires lots of advanced computer knowledge to perform virus removal process. In order to remove iTunes (FlyStudio) ransomware, you are recommended to use some reputable antivirus removal tool such as Spyhunter that can remove infiltrated malware infection as soon as possible.

Text presented in pop-up window:

你的资料已被加密，请勿关机以免丢失文件。
请发送邮件到：[email protected]
恢复你的资料。
你的机器码为:
–

注意：请勿关机和修改文件，以免影响恢复文件。

Rough English translation:

Your data has been encrypted, please do not shut down to avoid losing files.
Please send an email to: [email protected]
Restore your data.
Your machine code is:
–

Note: Do not shut down and modify files, so as not to affect the recovery of files.

Antimalware Details And User Guide

Click Here For Windows

Click Here For Mac

Step 1: Remove iTunes (FlyStudio) ransomware through “Safe Mode with Networking”

Step 2: Delete iTunes (FlyStudio) ransomware using “System Restore”

Step 1: Remove iTunes (FlyStudio) ransomware through “Safe Mode with Networking”

For Windows XP and Windows 7 users: Boot the PC in “Safe Mode”. Click on “Start” option and continuously press on F8 during the start process until the “Windows Advanced Option” menu appears on the screen. Choose “Safe Mode with Networking” from the list.

Now, a windows homescreen appears on the desktop and work-station is now working on “Safe mode with networking”.

For Windows 8 Users: Go to the “Start Screen”. In the search results select settings, type “Advanced”. In the “General PC Settings” option, choose “Advanced startup” option. Again, click on the “Restart Now” option. The work-station boots to “Advanced Startup Option Menu”. Press on “Troubleshoot” and then “Advanced options” button.  In the “Advanced Option Screen”, press on “Startup Settings”. Again, click on “Restart” button. The work-station will now restart in to the “Startup Setting” screen. Next is to press F5 to boot in Safe Mode in Networking.

For Windows 10 Users: Press on Windows logo and on the “Power” icon. In the newly opened menu, choose “Restart” while continuously holding “Shift” button on the keyboard. In the new open “Choose an option” window, click on “Troubleshoot” and then on the “Advanced Options”. Select “Startup Settings” and press on “Restart”. In the next window, click on “F5” button on the key-board.

Step 2: Delete iTunes (FlyStudio) ransomware using “System Restore”

Log-in to the account infected with iTunes (FlyStudio) ransomware. Open the browser and download a legitimate anti-malware tool. Do a full System scanning. Remove all the malicious detected entries.

In case if you cannot start the PC in “Safe Mode with Networking”, Try using “System Restore”

• During the “Startup”, continuously press on F8 key until the “Advanced Option” menu appears. From the list, choose “Safe Mode with Command Prompt” and then press “Enter”

• In the new opened command prompt, enter “cd restore” and then press “Enter”.

• Type: rstrui.exe and Press “ENTER”

• Click “Next” on the new windows

• Choose any of the “Restore Points” and click on “Next”. (This step will restore the work-station to its earlier time and date prior to iTunes (FlyStudio) ransomware infiltration in the PC.

• In the newly opened windows, press on “Yes”.

Once your PC gets restored to its previous date and time, download the recommended anti-malware tool and perform a deep scanning in order to remove iTunes (FlyStudio) ransomware files if they left in the work-station.

In order to restore the each (separate) file by this ransomware, use “Windows Previous Version” feature. This method is effective when “System Restore Function” is enabled in the work-station.

Important Note: Some variants of iTunes (FlyStudio) ransomware delete the “Shadow Volume Copies” as well hence this feature may not work all the time and is applicable for selective computers only.

How to Restore Individual Encrypted File:

In order to restore a single file, right click on it and go to “Properties”. Select “Previous Version” tab. Select a “Restore Point” and click on “Restore” option.

In order to access the files encrypted by iTunes (FlyStudio) ransomware, you can also try using “Shadow Explorer”. In order to get more information on this application, press here.

Important: Data Encryption Ransomware are highly dangerous and it is always better that you take precautions to avoid its attack on your work-station. It is advised to use a powerful anti-malware tool in order to get protection in real-time. With this help of “SpyHunter”, “group policy objects” are implanted in the registries in order to block harmful infections like iTunes (FlyStudio) ransomware.

Also, In Windows 10, you get a very unique feature called “Fall Creators Update” that offer “Controlled Folder Access” feature in order to block any kind of encryption to the files. With the help of this feature, any files stored in the locations such as “Documents”, “Pictures”, “Music”, “Videos”, “Favorites” and “Desktop” folders are safe by default.

It is very important that you install this “Windows 10 Fall Creators Update” in your PC to protect your important files and data from ransomware encryption. The more information on how to get this update and add an additional protection form rnasomware attack has been discussed here.

How to Recover the Files Encrypted by iTunes (FlyStudio) ransomware?

Till now, you would have understood that what had happed to your personal files that got encrypted and how you can remove the scripts and payloads associated with iTunes (FlyStudio) ransomware in order to protect your personal files that has not been damaged or encrypted until now. In order to retrieve the locked files, the depth information related to “System Restore” and “Shadow Volume Copies” has already been discussed earlier. However, in case if you are still unable to access the encrypted files then you can try using a data recovery tool.

Use of Data Recovery Tool

This step is for all those victims who have already tries all the above mentioned process but didn’t find any solution. Also it is important that you are able to access the PC and can install any software. The data recovery tool works on the basis of System scanning and recovery algorithm. It searches the System partitions in order to locate the original files which were deleted, corrupted or damaged by the malware. Remember that you must not re-install the Windows OS otherwise the “previous” copies will get deleted permanently. You have to clean the work-station at first and remove iTunes (FlyStudio) ransomware infection. Leave the locked files as it is and follow the steps mentioned below.

Step1: Download the software in the work-station by clicking on the “Download” button below.

Step2: Execute the installer by clicking on downloaded files.

Step3: A license agreement page appears on the screen. Click on “Accept” to agree with its terms and use. Follow the on-screen instruction as mentioned and click on “Finish” button.

Step4: Once the installation gets completed, the program gets executed automatically. In the newly opened interface, select the file types that you want to recover and click on “Next”.

Step5: You can select the “Drives” on which you want the software to run and execute the recovery process. Next is to click on the “Scan” button.

Step6: Based on drive you select for scanning, the restore process begins. The whole process may take time depending on the volume of the selected drive and number of files. Once the process gets completed, a data explorer appears on the screen with preview of that data that is to be recovered. Select the files that you want to restore.

Step7. Next is to locate the location where you want to saver the recovered files.