Frs Ransomware Removal Guide

Malware researchers report that a new infection has emerged, and it is called Frs Ransomware. It is unknown who the target of this malicious infection is because it contains messages that are available in Chinese and in English. Of course, it is highly likely that those located in China are the main target, but it is possible that the developer of the threat could be looking at other regions too. Not a lot is known about the distribution of this malware, but it is believed that spam emails could be employed to deliver the malicious launcher to unsuspecting Windows users. Unfortunately, if the attachment is opened, not much can be done to stop the threat. Of course, we are hopeful that you could delete Frs Ransomware before it did any damage, but, most likely, you would not even recognize the existence of this threat until it chose to reveal it. That is not all you need to know, and so we suggest reading this report, which also contains a full removal guide.

When Frs Ransomware slithers in and encrypts files, it also creates its own files. One of them is called “Chinese_national_flag.png,” and it represents an image of the national flag of China. Another image file, called “READ_ME_HELP_ME.png,” should replace the Desktop background image to introduce you to some information. The same message is also shown via the “READ_ME_HELP_ME.txt” file. The fourth file that you will need to delete when you initiate the removal process is FRS_Decryptor.exe, and it represents the FRS_Decryptor application. You are introduced to it briefly via the PNG and TXT messages, where it is stated that you need to use the application to decrypt files. The application is launched automatically, and the first thing you need to do is choose which language you want to use (Chinese or English). The application also offers you an opportunity to decrypt one single file. According to our research, the feature works, and that is how the criminals behind Frs Ransomware might trick you into paying the ransom, which is also represented via the same application.

The ransom message of Frs Ransomware is meant to push you into paying a ransom, which is set at 0.05 BTC (Bitcoin). Because this currency is unstable, it is hard to say how it converts at the time you are reading. When we were researching the threat, 0.05 BTC was 410 USD or 2,600 CNY. The creator of the infection has set up a wallet (1Mz7153hMuFiFcOme1T73mGsDzqAtMbBwX) and an email address (FRSDecryptor@fifcom.cn) to receive the ransom. If you were to pay it, you would have to set up your own Bitcoin wallet, purchase Bitcoins, transfer them to the wallet, and then confirm the transaction by emailing cyber criminals. Although the process might seem easy, and the ransom is not ridiculously huge – at least, not compared to some threats – you have to think carefully if you want to take the risk. More likely than not, once you pay the money, you will remain stuck with your files encrypted still, but your wallet will be lighter. Unfortunately, at the moment, there is no way to decrypt files without getting involved with cyber criminals, which means that you are safe only if backups exist. If they do not, do not forget to set up a backup as soon as you remove Frs Ransomware.

Have you let Frs Ransomware in via a corrupted spam email? Do you remember downloading it via an unreliable installer? Whatever it is, hopefully, you know where the .exe file is because you need to delete it. Besides that, you also need to remove Frs Ransomware files that are created after it is launched, and the instructions below show how to find and remove them. Do you feel overwhelmed or lost? If you do, installing an anti-malware program is the perfect solution for you. This program – if you choose it correctly – will automatically delete the ransomware, as well as other threats if they exist. After that, it will maintain full-time protection to ensure that you do not face malware in the future. As for the corrupted files – the ones with the “.FRS” extension – you might be unable to recover them, and that is why you need to make sure that you start backing up personal data online or using an external drive.

How to delete Frs Ransomware

1. Right-click and Delete the {launcher’s name}.exe file (its location is unknown).
2. Tap Win+E to launch Windows Explorer.
3. Enter %HOMEDRIVE%\FRSRANSOMWARE into the bar at the top.
4. Right-click and Deletethese files:
   • Chinese_national_flag.png
   • FRS_Decryptor.exe
   • READ_ME_HELP_ME.png
   • READ_ME_HELP_ME.txt
5. Delete the FRSRANSOMWARE folder.
6. Enter %USERPROFILE%\Desktop into the bar at the top and then repeat step 4.
7. Enter %LOCALAPPDATA%\[11 random characters] (if you are on Windows XP, enter %USERPROFILE%\Local Settings\Application Data\[11 random characters]) and then repeat step 4.
8. Empty Recycle Bin and then immediately run a full system scan to check if no leftovers remain.