Frozrlock Ransomware

Frozrlock Ransomware is a new severe threat that can sneak upon your computer without your knowledge and encrypt your personal files and more within just a few minutes. Possibly the worst thing about this ransomware infection is that it is indeed a new RaaS (Ransomware as a Service), which means that it is for sale on the dark web for $200 and anyone can make a new variant with some settings changes. This makes it more difficult to identify and to crack this malicious program. The only real weapon against such a major hit is prevention. For example, it is important that you regularly upload your files to a cloud account or onto a removable drive. Transferring any money to such criminals is always a risky thing to do unless you want to lose your money on top of your files. We recommend that you remove Frozrlock Ransomware immediately if you want to restore your PC.

It is possible that this ransomware is spread in a couple of ways since there could be lots of criminals creating their own variants. Therefore, we cannot really pick one method only. We can, of course, say that it is most likely for you to get infected via spam e-mails. This means that the malicious executable file of this malware infection travels the web in a spam mail disguised as an attachment. This attached file could be an image, a video, a document with macro, or even a .zip archive. This spam wants to strike you as an important and urgent matter that requires your immediate attention.

This matter can be anything an average person or even an office worker would be interested in to see it right away. For example, a hotel booking made with the wrong credit card details, a parcel that could not be delivered, an unpaid invoice, and so on. It is quite hard to say no to such matters even when you doubt that it could relate to you. The problem is that once you open this spam and download the attached file believing that you are going to see the invoice or booking in question, you practically infect your computer with this vicious ransomware. In other words, even if you delete Frozrlock Ransomware from your system at this point, it will not affect your files that have been encrypted.

It is also possible that you end up on a malicious webpage that contains Exploit Kits. When your browser loads such a page, the malicious Java or Flash codes are triggered and drop this infection onto your machine and you will not even see it coming. You can be redirected to such a page when you click on unsafe third-party advertisements or links. This is possible if your system is infected with adware or a browser hijacker, or when you are viewing shady websites hosting several questionable third-party ads, such as file-sharing websites, online gambling pages, and so on. Again, keep in mind that although you may lose all encrypted files to this attack, you must remove Frozrlock Ransomware ASAP.

When you launch the downloaded executable, it makes a copy of itself possibly to your "%APPDATA%” folder under the name of “UpdateServices.exe” and starts communicating with its C&C (Command and Control) server (“104.20.16.242”). This ransomware program targets your personal files (photos, videos, documents, and archives) as well as .exe files. However this infection leaves %WINDIR% and other windows components untouched. AES-256 and RSA-4096 algorithms are used in this attack to encrypt your files, which will have no new extension added this time. The whole encryption process does not take more than about 5 minutes.

The ransom note called "THIS_YOU_MUST_READ.txt" is dropped on your desktop. This file contains instructions regarding the payment method. You have to pay 0.1 BTC, which is about 176 US dollars, to a given Bitcoin address. You can contact these criminals via e-mail ("frozrteam@protonmail.com") and send them a file to be decrypted as a proof. Nevertheless, we do not advise you to pay this amount because there is no guarantee that you will have your files decrypted anyway, not to mention the fact that you would simply support cybercrime. We recommend that you delete Frozrlock Ransomware as soon as possible. Unfortunately, there seems to be no free tool on the web that you could use to recover your encrypted files after this attack. This means that if you do not have a backup copy, you may lose all your important files now.

If you want to manually eliminate this threat, you can use our guide below. Basically, you only need to delete all the related files and restart your computer. Since such a dangerous program managed to land on your system, it may be time for you to think of a better way to protect your virtual world. Of course, you can become a more cautious web surfer and computer user, and this could help you against a number of types of malware threats. Nevertheless, we believe that the best possible protection is provided by an up-to-date anti-malware program, such as SpyHunter. But we also need to mention the importance of keeping all your programs and drivers updated, which can also help you avoid certain cyber attacks.

How to remove Frozrlock Ransomware from Windows

1. Press Win+E to open File Explorer.
2. Find the malicious file you saved from the spam and launched.
3. Delete the malicious file.
4. Find the copy possibly in %APPDATA%, with the possible name of "UpdateServices.exe" and delete it.
5. Remove the ransom note text file from the desktop.
6. Empty your Recycle Bin.
7. Restart your PC.