Jigsaw Ransomware (.fun extension)

The malicious Jigsaw Ransomware (.fun extension) is a new variant of a well known infection that goes by the same name. While we have seen the “.fun” extension attached to the files corrupted by this malware before, according to our research, the ransom note has been overhauled. Most likely, you will learn that this malicious infection got into your operating system only after the ransom note (shown via a window) is displayed. Before that, the threat is stealthy and silent, and you are not supposed to uncover it. The worst part is that you are likely to be included in the execution of this threat. Its launcher should be concealed and introduced to you as a harmless document file (sent via spam email, for example) or a useful program. Once executed, the threat takes no time to pounce on your personal files. There is a ton of different files that the infection could attack (GIF, JPG, DOC, PDF, and ZIP to name a few). Unfortunately, these files are not restored when you remove Jigsaw Ransomware (.fun extension). That being said, deleting this threat is crucial.

It appears that Jigsaw Ransomware (.fun extension) was created to attack those who speak French because the ransom note is delivered in French. That being said, we cannot say if it will only affect those living in France, Canada, DR Congo, or any other country whose official language is French. All in all, according to the message, a hacker is responsible for the corruption of your files, and you need a decryption key that costs money. The sample we tested in our internal lab demanded a ransom of 0.095 Bitcoin (at the time, that converted to 300 Euro) to be paid to the attackers’ Bitcoin wallet. Although you have everything to make a successful payment, paying the ransom is the last thing you should do. In fact, you shouldn’t do it at all. Why? Because you are dealing with cyber criminals, and you cannot trust them! Their promises to help you decrypt files are most likely empty, and you do not want to waste your money on that. Of course, if money is not an issue for you, you might decide that the ransom is small enough to take risk. Even if you pay the ransom and even if you get your files decrypted, you must delete Jigsaw Ransomware (.fun extension) from your system ASAP.

Once your files are encrypted, decrypting them is unlikely to be possible. That means that all files with the “.fun” extension added to them could be locked up forever. We are sure you do not want to lose personal photos or documents you cannot replace, and, hopefully, you assessed the risk before the malicious Jigsaw Ransomware (.fun extension) attacked. If you did, you have your personal files backed up, in which case, it is important that you remove Jigsaw Ransomware (.fun extension) quickly. After that, if you need it, you will be able to move backup copies onto the system to replace the corrupted files. It is important that you do not forget to back up your personal files because ransomware is not the only threat you are facing. Your computer’s hard drive could be damage, or you could lose your computer in general. While computers and hard drives can be replaced, personal files cannot, unless backups exist. We advise using online backup or external drives. You can combine the two methods too.

Where is the file that launched Jigsaw Ransomware (.fun extension)? This is the most important file, and if you delete it successfully, it should not be difficult to eliminate the remaining components. The manual removal guide below was set up to assist you with that. Of course, even if you are a more experienced user, and you can delete Jigsaw Ransomware (.fun extension) on your own, you need to think about anti-malware software. It can automatically remove threats and enable protection against them for the future. A good defense mechanism does a lot for the overall security of your operating system, and it is your responsibility to implement anti-malware software that could assist you efficiently. If you have questions about that, post them in the comments area below.

Jigsaw Ransomware (.fun extension) Removal

1. Delete the launcher of the ransomware (name and location are random).
2. Tap Win+E keys to access Windows Explorer.
3. Enter %APPDATA% into the quick access field at the top.
4. Delete a folder named Frfx.
5. Move to %LOCALAPPDATA% (or %USERPROFILE%\Local Settings\Application Data\).
6. Delete a folder named Drpbx.
7. Tap Win+R to access RUN.
8. Type regedit.exe and click OK to access Registry Editor.
9. Go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
10. Delete the value called firefox.exe (the value data should point to a ransomware file).
11. Empty Recycle Bin to complete the task.
12. Install a malware scanner to examine your system for leftovers that might still require attention.