Jigsaw malware hijacks PCs and deletes files every hour until a ransom is paid
A new and extremely ruthless kind of ransomware has evolved that not only locks your files away, but deletes them if you don’t pay up promptly to the cybercriminals who created it.
Called Jigsaw, the ransomware begins deleting an infected computer’s files within just one hour if they don’t cough up the Bitcoin ransom demanded – equivalent to around $150. Jigsaw starts with just one file, as a warning that it’s deadly serious, but quickly ratchets things up, deleting multiple files with each and every hour that passes. Turning off the computer won’t help either – once it restarts, 1,000 files are deleted. After 72 hours, if no payment is received, Jigsaw immediately removes all remaining files.
“Try anything funny and the computer has several safety measures to delete your files,” reads Jigsaw’s ransom note, which is accompanied by a pic of the notorious Jigsaw killer’s mask from the horror movie series Saw.
Sounds pretty horrible, right? Jigsaw is rare in that it’s one of the first malwares to actually carry out its threats. Others, like Chimera, threaten to post users’ files onto the Internet but researchers say it’s an idle threat, as it doesn’t have the ability to do this. But Jigsaw does, and will do so very quickly.
But luckily for anyone unfortunate enough to come across Jigsaw, researchers have discovered a way to remove it without needing to pay the ransom.
BleepingComputer.com’s Lawrence Abrams explains that the first step is to open the Windows Task Manager terminal and kill all processes called firefox.exe or drpbx.exe, which were created by Jigsaw. Then, users need to launch Windows MSConfig and disable the entry that points to %UserProfile%\AppData\Roaming\Frfx\firefox.exe. Doing so halts the file deletion process and prevents the ransomware from restarting when the computer is rebooted.
Once that’s done, just download BleepingComputer’s free Jigsaw Decrypter utility to decrypt the files. Then perform a full scan of the computer using an anti-malware program to remove any remaining traces of Jigsaw.
All well and good but BleepingComputer’s Abrams warns that while they managed to find a way to decrypt user’s files and remove the malware this time, there’s a good chance Jigsaw’s creators will update the malware to prevent the fix from working.
Source | SilliconAngle
