Jigsaw Ransomware

The Jigsaw Ransomware is a file encryptor that encrypts and deletes files until the victim pays a ransom through its included pop-up interface. Due to the availability of free decryptors, no ransom payments should be required for restoring the data that's modified by the Jigsaw Ransomware. However, the Jigsaw Ransomware will continue to delete digital content periodically, although one of its versions doesn't deliver any of the data-locking or erasing features, which makes paying its ransom especially frivolous. Removing the Jigsaw Ransomware with anti-malware tools as soon as possible is essential for accomplishing full data recovery.

The Jigsaw Ransomware: the Trojan Sawing Through Your Files

A favorite threat amongst ransom-based threats is to warn that refusing to pay their fee will result in incurred hardware damage, digital content deletion, or the destruction of the key required to access your files. In almost all cases, these threats are bluffs without any corresponding function. However, at least one threat author has seen fit to follow through on his threats dramatically, via the Jigsaw Ransomware. Updated versions of the Jigsaw Ransomware so far seem to be disguising themselves as installers or updates for the Chrome Web browser, which could circulate via torrents or compromised websites. Exploits more liable than most for installing the Jigsaw Ransomware and its variants include website-based attacks that use JavaScript, Flash, or similar content platforms to deliver drive-by-downloads with automatic installation processes. Disabling these advanced features while browsing any sites you don't trust implicitly and having monitoring anti-malware programs able to detect such threats can prevent your PC from becoming infected. Once compromised, malware experts recommend using a non-compromised device to boot your PC into Safe Mode, which will help you remove the Jigsaw Ransomware without its pop-up blocking the appropriate security software.

As a form of file encryptor, the Jigsaw Ransomware follows the standards laid out by previous Trojans.The Jigsaw Ransomware scans for files, isolating ones of work or entertainment media formats such as GIF, DOC, or WAV. An AES encryption sequence blocks the users from opening their files while the addition of a new extension tag ('.fun') highlights them for identification. Then the Jigsaw Ransomware loads a pop-up, including a ransom demand and an embedded decryptor UI. After the victim makes a Bitcoin payment of roughly 160 USD to the provided address, the Jigsaw Ransomware verifies the transaction and runs the decryption function, returning all data to its previous state. However, the Jigsaw Ransomware is using an invalid Bitcoin address that makes any attempted ransom transactions fail currently.

However, the Jigsaw Ransomware also may include an active data-deleting function. This aspect of the payload operates on an hourly timer, but also loads automatically, whenever the Jigsaw Ransomware starts. Since the Jigsaw Ransomware starts every time the PC's operating system boots up, each restart costs the victim one thousand files' worth of data.

Solving a Threat Puzzle on a Tight Timer

The Jigsaw Ransomware gets its name from the Saw movie-themed imagery in its ransom demand. Like the death traps of that movie series, the Jigsaw Ransomware places its victims on a strict schedule to respond before receiving irreparable damage. However, the Jigsaw Ransomware also has more solutions than its cinematic universe equivalent. Security researchers already have developed a free decryptor that can restore your content, once the Jigsaw Ransomware is shut down and removed.

Because of the strict behavioral considerations with the Jigsaw Ransomware, malware researchers recommend disabling this threat before taking any other steps. You should terminate all corrupted 'firefox.exe' and 'drpbx.exe' memory processes through your Task Manager application, which will halt the ongoing timer and data deletion process. Then, you can delete the Jigsaw Ransomware with your preferred anti-malware product.

PC users without any interest in going through a potentially lengthy decryption process should, instead, consider alternative forms of data protection, such as remote backup resources. While the Jigsaw Ransomware is only the first kind of file encryptor with a confirmed ability to follow through on its threats, if its campaign proves profitable, some similar threat also may follow in its footsteps.

Technical Details