How to remove FileFrozr ransomware virus

FileFrozr RaaS – the new threat on the horizon

March 19 is the day when FileFrozr virus debuted in the ransomware industry^[1]. It seems that FileFrozr ransomware developer kit is currently being sold on underground forums for approximately 100-150 USD, which obviously reveals that this virus is Ransomware-as-a-Service type^[2]. Apparently, cyber criminals have even set up a Tor website for those who want to contribute to virus’ distribution. Here’s a short explanation of what is the purpose of this virus, which is widely known as ransomware – it is a malicious program that encodes all files on the system and leaves a message in a .txt or .html file to inform the victim about the attack and ask to pay a ransom in exchange for data recovery tool.

Offenders who sell this extortion^[3] program dubbed FileFrozr say that it is capable of encrypting more than 250 file types, generating a random key for every target file and using a mixture of AES-256 and RSA-4096 encryption standards to lock files securely. The ransomware itself is built using C# programming language, and, according to its authors, “no public sources were used, which makes File Frozr fully undetectable.” Later on, crooks mention a few anti-ransomware programs that cannot detect it due to ransomware builds that are obfuscated at secret servers. Finally, the presentation of the ransomware ends with a slideshow that presents “easy to use and minimalistic panel” that wannabe cybercriminals are going to use after purchasing the virus development kit. For support, potential customers are invited to contact crooks via filefrozr@protonmail.com email address.

While other RaaS viruses(Dot, Stampado, Satan, Petya and others) provide malware development kits^[4] for free, giving amateur hackers a chance to get their hands on a ready-to-use extortion tool and keeping a percentage of the profits that affiliates earn. However, FileFrozr developers did not seek to create an affiliate system – they chose to sell the ransomware as a product. Unfortunately, we have to say that easy money attracts a lot of bad people, so we expect the number of this virus’ versions to escalate shortly. If you have suspicions that your computer was compromised by this virus, run a system scan with anti-malware software like FortectIntego and let it remove FileFrozr virus for you. We highly recommend you not to try to delete the virus manually because this way it could damage your files even more severely. To start the FileFrozr removal procedure, we suggest you read the instructions given below the text.

How can I get infected with this malicious virus?

Since this virus can get into hands of random cyber criminals, we assume that it is going to be distributed using all kinds of malware distribution tricks. Most likely, the majority of these viruses will be distributed via so far the most “popular” ransomware distribution technique – email spam. It means that criminals are going to do their best creating convincing messages, renaming the malicious executives or pressing them down into ZIP archives or transforming them into malware-laden Word documents^[5]. In case the described virtual extortion tool gets into hands of more advanced cyber criminals or even a cybercrime gang, it is likely that the virus is going to be disseminated using exploit kits or malware-laden ads. Such malicious attacks can be easily prevented, but many computer users still do not know how to protect their computers from ransomware. Here’s what we recommend doing:

• Create a data backup. It is one of the most important things you should do!
• Install anti-malware software and keep it up-to-date at all time.

What is the right way to remove FileFrozr ransomware?

We are afraid that the distribution of FileFrozr ransomware is about to begin shortly, so prepare for it in advance – create a data backup. In case you have become a victim of such cyber attack, we strongly recommend you to remove FileFrozr virus rather than paying the ransom to frauds. Despite the fact that virus corrupted your files, despite the fact that you cannot recover them, do not obey to criminals’ commands and do not give your money to them. No one gives you guarantees that your files will be recovered; therefore, we suggest you invest that money somewhere else. If you haven’t deleted the virus yet, we suggest you to follow these FileFrozr removal instructions: