Check Out Your COMPUTER, NEW THREAD RANSOM-F is Spreading

I got 2 virus warning in my box lately, but the most interesting one is RANSOM-F. This is new virus reported on March 25, 2009. It’s name varied :

• Trojan.Xrupter [Symantec]
• Trojan-Ransom.Win32.Fixer.a [Kaspersky Lab
• Trojan:Win32/Fakecorr [Microsoft]

Behaviour

You got this virus if :

When you open your documents (almost all document type), you got a message telling that your document is corrupt. If you click Repair File, the virus then download some File calls Filefix Professional 2009.

FileFix Professional is ransomware that requires you to purchase it in order to fix files that have been encrypted on your computer. This program is advertised through a Trojan that has a filename of C:/Windows/system32/fpfstb.dll. When you are infected with this Trojan, every time you open a Office document, PDF, etc, it will encrypt the file so that it becomes unreadable by it’s normal application. When you try to open these files, this same Trojan will display an alert stating that your file is corrupted and that you should click on the alert in order to fix the file. When you click on this alert, it will automatically download and install FileFix Professional on to your computer.

When FileFix Professional runs it will scan your computer for encrypted files and then allow you to fix only one of these corrupted files. Unfortunately, if the Trojan is still installed on your computer it would just encrypt it again when you access the document.

This program give Fake error on Windows Protection

Check out this file infected list. It’s almost all of your document files

• ppsm
• ppam
• potx
• pptx
• ppsx
• potm
• pptm
• xlam
• xltm
• xlsm
• dotm
• docm
• xlsb
• xltx
• xlsx
• dotx
• docx
• pst
• mdb
• wma
• mp3
• png
• jpeg
• jpg
• pdf
• ppt
• xls
• doc

File Dropped

The following files are added by FileFix (also detected as Ransom-F):

• %ProgramFiles%/FileFix Professional 2009/unins000.dat
• %ProgramFiles%/FileFix Professional 2009/unins000.exe
• %ProgramFiles%/FileFix Professional 2009/wizard.exe – detected as Ransom-F
• %ProgramFiles%/FileFix Professional 2009/wizard.url
• C:/Documents and Settings/All Users/Start Menu/Programs/FileFix Professional 2009/FileFix Professional 2009 on the Web.lnk
• C:/Documents and Settings/All Users/Start Menu/Programs/FileFix Professional 2009/FileFix Professional 2009.lnk
• C:/Documents and Settings/All Users/Start Menu/Programs/FileFix Professional 2009/Uninstall FileFix Professional 2009.lnk

Where %ProgramFiles% is usually C:/Program Files

The following registries are added:

• HKLM/SOFTWARE/Microsoft/Windows NT/Current Version/WOW/keyboard/advanced
  • wizard_installed = “1”
  • wizard_path = “%ProgramFiles%/FileFix Professional 2009/wizard.exe”
• HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/
  CurrentVersion/Uninstall/FileFix Professional 2009_is1
  • DisplayName = “FileFix Professional 2009”
  • HelpLink = “http://filefixpro.com”
  • Inno Setup: App Path = “%ProgramFiles%/FileFix Professional 2009”
  • Inno Setup: Deselected Tasks = “”
  • Inno Setup: Icon Group = “FileFix Professional 2009”
  • Inno Setup: Selected Tasks = “desktopicon,quicklaunchicon”
  • Inno Setup: Setup Version = “5.1.7”
  • Inno Setup: User = “{User name}”
  • InstallLocation = “%ProgramFiles%FileFix Professional 2009”
  • NoModify = “1”
  • NoRepair = “1”
  • Publisher = “DataHelper Inc.”
  • QuietUninstallString = “%ProgramFiles%/FileFix Professional 2009/unins000.exe” /SILENT”
  • UninstallString = “%ProgramFiles%/FileFix Professional 2009/unins000.exe”
  • URLInfoAbout = “http://filefixpro.com”
  • URLUpdateInfo = http://filefixpro.com”

Removal Guide

Automatic Removal using Malware Byte Anti Malware. You can download the trial version here. Unfortunately, this utility can’t decript file encripted by Filefix. To do so, you need another tools name Anti Filefix. Download here.

• First, Remove the Thread with Malware Byte Anti Malware.
• Second, Use anti_Filefix to fix encripted file

In order to use the program you should follow these steps:

1. Run Anti FileFix
2. When the program opens, click on the Select Folder button and then select the folder you would like to scan. If you wish to scan an entire drive, then select the particular drive letter. When the drive is selected, press the OK button.
3. At this point you can click on the Scan button in order for the program to scan your computer for encrypted files. This mode does not decrypt these files. On the other hand, if you wish to find and decrypt any files that Anti FileFix finds, then you should click on the Scan and Fix button.

When the files are decrypted, they will be decrypted into a new filename in the same folder with _fixed(1) appended to the original filename. So if the file was named test.doc, the decrypted version will be test_fixed(1).doc.

To simplify your job, you can use Total Commander Multi Rename Tool to Rename files decripted by Anti Filefix.