How to remove FSociety ransomware virus

FSociety virus inspired by Mr. Robot series

FSociety virus is the name of a new crypto-ransomware computer infection, which encrypts victim’s files using AES and RSA encryption methods. Please note that some other sources may adopt the leetspeak elements used by the ransomware creators and refer to this virus as FS0ciety. Getting back to the virus itself, it seems its author is a fan of Mr. Robot TV series because it sets FSociety logo wallpaper on victim’s computer screen immediately after infiltrating the computer system. The name of this ransomware sends a message “F*** Society,” so it is pretty clear what message the ransomware author tries to send to the victims. It is also worth noting that this virus has been created based on open source EDA2 ransomware project, so it encrypts victim’s files using AES encryption, then encodes the encryption key using RSA cipher. The decryption key, which is required to recover corrupted files, is stored in criminals’ command and control servers and is virtually inaccessible for the victim. But the users are not left stranded for too long as the virus drops a ransom note called “fs0ciety.html” explaining how the decryption key can be recovered. The victims’ are provided with a unique identifier number, consisting of 16 random characters which has to be sent to the victims in order to retrieve data. Does paying for the file decryption work? We do not know yet. But there is a high possibility that the criminals are only trying to extort the money without even considering giving the users their files back. What we know for sure is that this virus may cause serious trouble if you start interacting with it, so we recommend heading straight to the FSociety removal if you found out your system has been infected.

New things start to emerge about this FSociety malware as more and more users report on being infected. This gives us an idea that this ransomware is growing slowly but steadily. The recent reports, for instance, claim that the virus now changes the encrypted file extensions to .realfs0ciety@sigaint.org.fs0ciety. Typically to the recent ransomware variants, in this extension the virus creators include their email address so that the user could contact cyber criminals more easily and receive further data recovery instructions. The previously mentioned identifier number should be sent the same address too. Since there is no way to decrypt your files, you should remove FSociety virus without hesitation. To delete it, use Reimage or Webroot SecureAnywhere AntiVirus malware removal tool, in case your Mac OS is infected. Please do not try to remove FSociety manually because if you miss at least one or two components of it, your computer will be at risk.

Methods used to distribute this malware variant

This ransomware is at early development stage at the moment, so it seems that it is being distributed via email only. It means that you can download it by opening an infectious email attachment sent by an unknown party, or opening a corrupted link provided in the email message. Beware that bogus emails can inject malicious links behind safe-looking “Unsubscribe” button and other clickable content, so please, stay clear of email messages that come from unknown sources. Sometimes such malicious emails manage to pass email Spam and Junk filters and end up in Inbox folder. However, ransomware can be spread via malvertising, too, so please stay away from suspicious Internet sites, do not click on aggressive web advertisements and avoid installing software updates from websites that do not belong to official developer of the suggested software. In most cases, malware is distributed along with bogus Java or Flash updates.

How to remove FSociety ransomware from your computer and retrieve your files?

To remove FSociety virus, you will need to scan your computer system with a good anti-malware software. Make sure you use the latest version of it; otherwise it might not be able to catch FSociety ransomware. If you want to run your computer security software but this virus does not allow you to do so, run your computer in a Safe Mode first. FSociety removal guidelines provided below will guide you what to do and help you to complete the uninstall process easier. To decrypt your files, use data backups (if you have them). We also suggest being patient, because sometimes malware researchers manage to find flaws in ransomware’s code that allows creating free decryption tools, which is likely to happen with this version of ransomware.