Foty Virus

7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.

*Foty is a variant of Stop/DJVU. Source of claim SH can remove it.


Ransomware viruses like Foty are widespread malware threats that are developed to serve the purpose of blackmailing and money extortion. The Foty achieves its goal is by encrypting the files on the user’s PC or by locking the PC itself and demanding a ransom payment to have it unlocked.

Stop 2 1024x575

This separates the ransomware virus category into two subgroups that differ in the way the function. The first one, the so-called screen-lockers, tend to block the access to the infected machine through the use of a simple pop-up banner that is superimposed onto the screen of the infiltrated machine. The idea is that the said banner would cover everything on the screen meaning that the user wouldn’t be able to access or interact with any folder, program or menu and their only way of regaining access to their screen would be through paying the hackers the demanded ransom sum.

The screen-locker viruses, however, are not that advanced and it is oftentimes possible to deal with them manually as long as the user knows what the necessary steps that need to be taken are. The second major form of ransomware are the cryptoviruses and those threats tend to be much more advanced in comparison to their screen-locker counterparts. This is the category that Foty falls into. 

The Foty virus

The Foty virus employs an encryption process in order to render any personal data located on the infected PC inaccessible. The only way the Foty virus will have you believe you can “unlock” the encryption is through the use of a specialized decryption key that the virus generates.

However, this key is initially only available on the hacker’s server who will supposedly send it to you if you make the requested payment. And this is where the inevitable question comes: Is paying the ransom ever a viable option?

To be honest with you, the answer here might vary depending on each separate situation. Typically, going for the payment “option” isn’t the most advisable course of action as you can easily lose your money without receiving the needed key. Oftentimes the hackers simply take the ransom sum and “forget” to send back the decryption details which is why you can never be sure if transferring the money will actually have the needed effect.

On the flip side, however, there are few other methods that might recover your files. But pretty much none of them guarantee success in all cases. Some of those methods we have added to our removal guide for Foty that you can find below.

The Foty file encryption

The Foty file encryption rarely has any symptoms and usually manages to remain unnoticed by the majority of antivirus programs. The core reason for that seems to be the “harmless” nature of the Foty file encryption itself.

Foty File

This process isn’t inherently damaging and though it renders your data inaccessible to anybody who doesn’t have the decryption key, it causes no harm to the targeted files or to the PC system which makes it really difficult to detect. The only possible symptoms that might be noticed sometimes are RAM and CPU spikes and temporarily decreased HDD space, so be on the lookout for that if you suspect a ransomware cryptovirus infection.



Detection Tool

anti-malware offerOFFER Read more details in the first ad on this page, EULA, Privacy Policy, and full terms for Free Remover.

*Foty is a variant of Stop/DJVU. Source of claim SH can remove it.

Remove Foty Ransomware


You really must do everything in your ability to eliminate the ransomware that has attacked you as quickly as possible, and in this article, we will teach you precisely what actions to take in order to accomplish this goal. Unplug all external storage devices, including any USB drives, as the first step in the process. Next, you will need to disconnect your system from the Internet so that the ransomware will not be able to communicate with its servers and get instructions.

Be careful to add this page to the bookmark section of your internet browser so that you can easily access it in the event that your computer has to be restarted after while you are completing some of the steps outlined in this guide.

The next thing in the process of removing the ransomware is to restart the infected computer in Safe Mode. This will allow the next steps of the process to go more swiftly and without any complications. If you don’t know how to reboot in Safe Mode, you may activate Safe Mode by going to this link and then following the steps that are shown on that page. After the computer has finished restarting, you will need to come back to this page to complete the rest of the Foty removal instructions.



*Foty is a variant of Stop/DJVU. Source of claim SH can remove it.

On the computer that has been compromised, you need to open the Task Manager by simultaneously pressing Ctrl+Shift+ESC. Check that the Processes tab is chosen from the list of available tabs that appear at the top of the screen. After you have sorted all the processes based on how much memory and CPU they are using, check through the results for processes that have names that are not typical or are using too many resources without any particular reason.


The next step is to right-click on the process that seems to be malicious, and from the context menu, choose Open File Location. This will allow you to get more details on the files that are associated with the process. Using the scanner that is provided below, you may examine these files to see whether they include any malicious software.

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    After the scan has finished and it has been found that the folder contains threats, make sure that the process that is now running is first ended by right-clicking on it in the Processes tab and choosing the End Process option from the context menu. After that, you need to return to the files that were discovered by the scanner and delete them from the folder that is called File Location.


    In the third step, you will need to simultaneously press the Winkey and the R key, then you will need to write the following command in the Run box that appears, and then you will need to click the Enter key.

    notepad %windir%/system32/Drivers/etc/hosts

    This will prompt the instant opening of a file on the screen titled Hosts. Searching for “Localhost” in the file’s content and looking for any strange IP addresses below will help you find illegal modifications that may have been made to your Hosts file. IPs that do not seem to be reliable should be reported in the comments area of this post so that we can have a look at them and provide you guidance on what steps to take next.

    hosts_opt (1)


    After you have closed the Hosts file, open a System Configuration window by entering “msconfig” in the Windows Search bar located in the Start menu and hitting the Enter key on your computer. The next step is to go to the “startup” tab. Once there, take a look at the different startup items that are mentioned under that tab. If you discover a startup item that you have reason to suspect is connected to the ransomware, remove the tick that is placed in the checkbox next to it, and then click “OK” to preserve your configurations.



    *Foty is a variant of Stop/DJVU. Source of claim SH can remove it.

    It is possible for malicious software such as Foty to disguise its components on a computer in a number of system locations, one of which is the registry. As a direct consequence of this, you will have to do an exhaustive search inside the Registry Editor and delete any files that are connected to Foty. The Registry Editor may be accessed by going to the Windows search bar, typing “regedit“, and then pressing the Enter key on your keyboard.

    Once inside the Registry, open a Find window on your screen by simultaneously hitting the CTRL and F keys. You can search for files that are related to the infection using this window. Enter the name of the potential danger that you are trying to locate in the box that is labeled Find, and then click the button that is labeled Find Next.

    Attention! Those of you, who are not experienced in dealing with malware may have difficulty with the procedure of deleting ransomware-related files from the system’s registry. This is due to the fact that any incorrect deletions performed in the registry carry with them the potential of severely corrupting the system. Because of this, if you believe that your computer is still infected and that Foty-related files are still present in the system and are not fully removed, we highly recommend that you make use of the professional malware removal tool that is provided on our website

    In addition, you should hunt for more files that could be associated to the infection in the following five locations on your computer:

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    In the Windows search box, type each of the search phrases that are mentioned above, and then press the Enter key to get access to them. Next, take a look at the files of each of the folders, but don’t remove any files unless you are absolutely convinced that they are connected to the danger. You may delete temporary files by first selecting the files inside the Temp folder, and then pressing the Delete key on your computer after making your selection. 


    How to Decrypt Foty files

    The process of decrypting data that has been encrypted by ransomware may be difficult for those who have never dealt with this before. Besides, data that has been encrypted is far more difficult to recover since the methods for decrypting ransomware may differ depending on the variant of ransomware that has attacked you. As a start, you need to check the file extensions that have been added to the end of the encrypted files if you are unsure about the exact ransomware variant that has attacked your system.

    You are also required to run a thorough virus scan with a modern anti-virus tool before initiating any form of data recovery. Until the results of the virus check show a clean computer, you should not even think about looking into the possibilities for file recovery.

    New Djvu Ransomware

    STOP Djvu is a new ransomware variant that is now causing a lot of trouble by encrypting files and demanding a ransom payment from people whose data has been encrypted by it. Attacks of this malware have been documented to have taken place in a variety of locales around the globe.

    It is common for this threat to attach the .Foty suffix to the files that it encrypts and this serves as an indication for the victims. If you have lost access to your data, you should not give in to the demands for a ransom because there are decryptors available, such as the one at the link below, that may be able to assist you in restoring encrypted data if you give it a try.

    Make sure that you have the STOPDjvu executable file downloaded from the URL and that you have read the licensing agreement, as well as any instructions that may come along with the file, before beginning the decryption process. It is essential to keep in mind that this program may not be able to decode all the encrypted data, especially files that were encrypted using online encryption techniques or unknown offline keys. Keeping this in mind will help ensure that you have a successful experience.

    If the manual techniques provided in this post are not enough to fix the issue with Foty, you may want to use the professional anti-virus software that is linked in the article in order to get rid of Foty in a way that is both quick and effective. If you are worried about the safety of a specific file on your system, you may also want to use our completely free online virus scanner to do a manual scan on the file in question.



    About the author


    Violet George

    Violet is an active writer with a passion for all things cyber security. She enjoys helping victims of computer virus infections remove them and successfully deal with the aftermath of the attacks. But most importantly, Violet makes it her priority to spend time educating people on privacy issues and maintaining the safety of their computers. It is her firm belief that by spreading this information, she can empower web users to effectively protect their personal data and their devices from hackers and cybercriminals.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1