Jigsaw cryptographer plays with the user, like the character of the movie "Saw" (+ neutralization instructions)

The malware deletes files once an hour and when trying to restart the PC



Malicious programs that threaten the safety of user data is becoming more and more. We did not have time to solve the problem with the Petya cryptographer, which encrypts the user's hard disk instead of individual files, as another ransomware appeared - the Jigsaw cryptographer. This software does not just encrypt user files and requires a ransom for their decryption. Every 60 minutes, one user file is deleted, and the data is also deleted by the extortioner when attempting to restart the PC. After some time, the hourly "execution" affects not one, but more files. When restarting, not one or two files are deleted, but just a thousand.
')
All this has a very strong effect on the user, and he, in most cases, prefers to pay. In this case, the screen gives instructions on how much to pay (Bitcoin equivalent of $ 150) and where you can get Bitcoins to pay for the “buy-out”. Already scary? In general, all this may also have an effect on a technically trained user ... But there is a way out - as was the case with Petya, there were users who learned how to neutralize ransomware. Now these users share their experiences with others.

What to do?

Thanks to the analysis carried out by Twitter users MalwareHunterTeam , DemonSlay335 , and BleepinComputer , a method has been found to neutralize the software. A decryptor has been released that can decrypt files affected by Jigsaw.

Initially, you need to terminate the firefox.exe and drpbx.exe processes in the task manager. This will avoid deleting files. Then we start MSConfig and stop the process firefox.exe, which is located in% UserProfile% \ AppData \ Roaming \ Frfx \ firefox.exe. Next, we decrypt the files using this program .

It's pretty simple:



If you need to decrypt all the files on the disk, choose not the folder, but the root of the disk, and click on "Decrypt my files".



And then - then we run antivirus software with new databases, and check the PC.



Jigsaw Technical Details

After the malware gets to the user's computer, it starts searching for files with a certain extension, and encrypts them with AES encryption. Native extensions are replaced with .FUN, .KKK, or .BTC.



Their list is located in% UserProfile% \ AppData \ Roaming \ System32Work \ EncryptedFileList.txt. The bitcoin address is stored in the% UserProfile% \ AppData \ Roaming \ System32Work \ Address.txt file.

Files associated with this malware:

% UserProfile% \ AppData \ Roaming \ Frfx \
% UserProfile% \ AppData \ Roaming \ Frfx \ firefox.exe
% UserProfile% \ AppData \ Local \ Drpbx \
% UserProfile% \ AppData \ Local \ Drpbx \ drpbx.exe
% UserProfile% \ AppData \ Roaming \ System32Work \
% UserProfile% \ AppData \ Roaming \ System32Work \ Address.txt
% UserProfile% \ AppData \ Roaming \ System32Work \ dr
% UserProfile% \ AppData \ Roaming \ System32Work \ EncryptedFileList.txt

Finally, registry entries:

HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ firefox.exe% UserProfile% \ AppData \ Roaming \ Frfx \ firefox.exe

As we see, the cryptographer is not the most dangerous, but the idea, of course, is strong. If future versions of the cryptographer will be better protected, it will be much more difficult to cope with Jigsaw.