Obliterating FRS Ransomware (Crypto-Malware/Ransomware)

What is FRS ransomware? And how does it execute its attack?

FRS ransomware is another file-encrypting threat that has similarities with FCP ransomware. However, this ransomware might not what it seems to be as security experts found that this ransomware don’t actually encrypt files but just renames them to make them look like they were encrypted when in fact they’re not.
FRS first execute its attack by connecting to a remote Command and Control or C&C server where it sends information about the infected computer as well as download additional malicious files it will be using for its attack. After that, it will modify the Windows Registry so it can run on every system boot. Then it pretends to encrypt the following file types by renaming them to make them look like they’ve been encrypted by FRS ransomware:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip
During its supposedly encryption but more like renaming the files process, FRS ransomware executes the following commands:

Desktop\*.*” *.*.FRS
ren “C:\Users\%USERNAME%\Saved Games\*.*” *.*.FRS
ren “C:\Users\%USERNAME%\Links\*.*” *.*.FRS
ren “C:\Users\%USERNAME%\Favorites\*.*” *.*.FRS
ren “C:\Users\%USERNAME%\Searches\*.*” *.*.FRS
ren “C:\Users\%USERNAME%\Videos\*.*” *.*.FRS
ren “C:\Users\%USERNAME%\Pictures\

After it renames all its targeted files, FRS ransomware changes the desktop wallpaper of the infected computer with the national flag of China. It then generates its ransom note named “READ_ME_HELP_ME.txt” that contains the following message:
“Oops! Your important files have been encrypted!
Is the content of your files not readable? It is normal because your important files have been encrypted by the “FRS Ransomware.” It means your files are NOT DAMAGED! Your files are just encrypted. From not it is not possible to use your files until they will be decrypted. The only way to decrypt your files safely is use special decryption tool “FRS Decryptor.” Please wait for “FRS Decryptor” to start automatically. If “FRS Decryptor” does not start automatically, open “FRS Decryptor” on the desktop”
How does FRS ransomware disseminate its malicious file(s)?
It isn’t clear yet how FRS ransomware disseminate its malicious files but it most likely uses the most common distribution method used by ransomware threats – malicious spam email campaigns.
Follow the steps below to obliterate FRS ransomware from your system successfully.
Step 1: Close the ransom note of FRS ransomware and tap the Win + E keys to open File Explorer.
Step 2: Navigate to the following locations and look for a malicious executable file which is randomly named used to install FRS ransomware into the computer as well as its ransom note named READ_ME_HELP_ME.txt and the executable file named FRS_Decryptor.exe and the desktop wallpaper named Chinese_national_flag.png and then delete all of them.

%TEMP%
%APPDATA%
%DESKTOP%
%USERPROFILE%\Downloads
%HOMEDRIVE%\user | ransom.jpg
%USERPROFILE%\Desktop | READ_IT.txt

Step 3: Close the File Explorer and tap Ctrl + Shift + Esc keys to open the Task Manager.

Step 4: After opening the Task Manager, look for FRS ransomware’s malicious process, right click on it and select End Process or End Task.

Step 5: Close the Task Manager.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then by all means go on to the next steps.
Step 6: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 7: Navigate to the following path:

HKEY_CURRENT_USER\Control Panel\Desktop\
HKEY_USERS\.DEFAULT\Control Panel\Desktop\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Step 8: Look for any suspicious values created by FRS ransomware and delete them.
Step 9: Close the Registry Editor and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 10: Look for FRS ransomware or any suspicious program and then Uninstall it/them.

Step 11: Empty your Recycle Bin.
Restore the previous state of your files using the Shadow Volume copies
Since the FRS ransomware has messed up the file names of your files, it’s now hard to tell which is which so you have to restore them back to their previous state using their shadow volume copies.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Ensure the removal of FRS ransowmare from your computer as well as the malicious files it created with the help of the advanced removal instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the Safe Mode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. Installation will start automatically once download is done.