How to remove FBLocker ransomware

FBLocker ransomware – Facebook-themed ransomware that locks files, but does not save any encryption keys

FBLocker is as a file-encrypting virus^[1] that locks personal data to express dislike to the Facebook social network. Detected on 11 May 2018 disguised under svchost.exe and MicrosoftWindowsOperating System files, the ransomware locks files using .facebook file extension and renders them inaccessible. FBLocker ransomware uses multilayer encryption, which generates a new key per file. Unfortunately, crooks troll PC users by not storing encryption keys anywhere, so there's no chance for people to get a decryptor, neither paid not free.

FBLocker virus is also dubbed as the Facebook ransomware. Judging from its design and content of the note, it seems that developers of the virus disapprove of the social network. Based on some personal experience or the recent Facebook's data scandals,^[2] crooks represent the ransomware as a “masterpiece” of Mark Zuckerberg. Victims can see his photo on the lock screen and a short note on the left side saying:

What Happened to My Computer?

Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Do not waste your time looking for a way to recover your files. Nobody can recover your files.

Can I Recover My Files?

No. My name is Mark Zuckerberg, and I have encrypted your files without saving any encryption keys. I appreciate you executing my program because you have allowed me to ruin more lives.

“A squirrel dying in front of your house may be more relevant to your interests right now than people dying in Africa.”

The FBLocker note is translated into English and Russian languages. Although it may seem that its original language is Russian, experts claim that it has been written in English and then translated into Russian using Google Translator to make it look like another Russian-related threat. By the way, FBLocker ransomware has been found connected to the 93.184.221.240:80 IP, which is situated in European Union.

According to Michaell Gillespie analysis,^[3] the FBLocker ransomware if being disseminated in the form of svchost.exe. This particular executable file is a legitimate component of Windows OS, though it's frequently misused by hackers to disguise malicious processes. It may also be distributed hidden under fake Windows OS updates in the form of MicrosoftWindowsOperating System file.

If the potential victim opens the infected file, the svchost.exe payload is being executed. Consequently, not only most of the personal files get the .facebook file extension. Multiple system's files are compromised, including Windows Registries, executable files, Windows startup processes, and others.

Unfortunately, but there's no way to recover files encrypted by FBLocker malware. The virus renders multi-layers cryptography, meaning that each file is locked using a unique key. Unfortunately, its developers, just like they said on the lock screen, does not store encryption keys anywhere. Therefore, there's no other way to recover your files as to remove FBLocker and scan the system with third-party data recovery programs listed at the end of this article.

FBLocker removal may turn out to be difficult as well. Developers of this ransomware are experienced programmers as they apply no only advanced encryption technique, but also use intricate ransomware helpers that may lock most of the anti-virus programs.

The svchost.exe ransomware payload sample has been uploaded to the VirusTotal.^[4] It turns out that 27 AV engines out of 65 are capable of detecting and removing it.

If FBLocker or Facebook ransomware blocks your antivirus, you may need to reboot your PC into Safe Mode with Networking, and them scan it with a professional anti-virus. We recommend using FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. A full guide on how to get rid of this pest is given down below.

Ransomware spread via malicious emails that pretend to be sent from well-known companies

As we have already pointed out, the payload of this ransomware is disguised under SvcHost.exe file which is usually attached to the malicious emails. Subject email may indicate a number of a document or simply claim URGENT. In most of the cases, such emails mimic well-known companies like Amazon or Microsoft.

In addition to spam, the ransomware is distributed via rogue Windows updates in the form of MicrosoftWindowsOperating System. It may occur in the form of a pop-up while visiting illegal websites. The web browser may redirect to a site with MicrosoftWindowsOperating System installer after clicking on JavaScrip infected link.

Avirus.hu security team^[5] points out to the essence of safe-browsing tips, i.e. staying away from any content that raises suspicions. If you haven't made purchases on Amazon or other shops, do not fall for opening emails reporting parcel deliver problems or unpaid purchases.

Additionally, never download software updates that are offered to you on random websites in the form of the full screen or pop-up ads. If you believe the software to be outdated, install updates from trusted sources.

Elimination of the FBLocker ransomware virus

To remove FBLocker from the system, you have to install a reputable malware removal software or update the one that is currently running. Trying to detect and removal ransomware-related entries manually might lead to permanent data loss or system's damage.

We recommend FortectIntego or MalwarebytesMalwarebytes for FBLocker removal. However, feel free to use your preferred software as well. However, don’t forget to update it before running a system scan because outdated software may lack the latest virus definitions. Additionally, if malware prevents from installing or running security tool, follow the guide below.