Sysfrog Ransomware - How to remove

If you have found your files renamed with the sysfrog extension and the [email protected] address in their names — the files unopenable, not recognizable by your programs — your computer must have been infected with Sysfrog. Sysfrog is a ransomware virus that encrypts files and demands money (around $3000) for fixing them.

Even when the Sysfrog virus is removed, the files are still encrypted. In fact, only Sysfrog’s developers know the code needed to decrypt files (modern ransomware viruses incorporate public-key cryptography). This impossibility of breaking well-implemented encryption, coupled with the fact that many ransomware developers don’t even bother to return files after they were paid the ransom, make Sysfrog an immensely destructive virus.

Details about Sysfrog

According to experts, possibly related to Katyusha. The ransom note is very similar, too, though instead of “_how_to_decrypt_you_files.txt” it’s called “how_to_decrypt.txt”, and instead of the encrypted files receiving a suffix “.katyusha”, the new extension is “[[email protected]].sysfrog”

Your files have been encrypted.
If you want to get your files back, send 0.3 bitcoin to my wallet
my wallet address : 3FoiK3TTfA42Du34aFWTV9qTg5XChVh18c
If you have any questions, please contact us.
Email: [email protected]
Your Id:[id]
Your Key:
=============================================
[key]
=============================================
Payment site https://www.gopax.co.kr/
Payment site https://www.bithumb.com/
Payment site http://www.coinone.com/
Payment site http://www.localbitcoins.com/
Officail Mail: [email protected]

At the moment, 0.3 Bitcoin is a bit under $3000. Sysfrog’s developers are likely using Bitcoin because it’s simpler and hassle-free online. What Bitcoin means for the victims of Sysfrog, though, is that there is no way to get back the money if Sysfrog’s developers don’t provide a key after the ransom was paid — which happens often enough.

Who are the most vulnerable to ransomware infections?

Sysfrog can infect small companies and businesses if they are targeted manually. Usually, this is done by hacking through RDP (Remote Desktop) with stolen or guessed passwords It’s not just about losing files — the time of the business is also very expensive. Developers of Sysfrog know this — ransomware is a lucrative business for cybercriminals. STOP/DJVU, GandCrab, Dharma/CrySiS are still going strong, still releasing new versions, and still taking in the ransom money.

Individuals are more likely to get infected not through Remote Desktop, but by pirating files and downloading freeware from shady websites. The fact that pirated files, like software cracks, can carry Sysfrog might not be surprising. But some ransomware is known to have been distributed in bundles with free software.

Maybe the most common way currently, one that affects both individuals and businesses, is ransomware in email attachments. Malicious spam emails can attach infected files or include links that automatically download malicious files, but the recipient has to run them themselves to get Sysfrog to infect the computer. Various deceptive tactics are used to get people to actually open these files, such as posing as the post office and writing about a parcel that couldn’t be delivered, or an urgent bill that needs to be paid.

It’s important to protect yourself from ransomware:

• Update your software, like the operating system and browsers. Some updates include critical security fixes. Cybercriminals know that a lot of people refuse to update their software, so when they find out about a bug, someone will exploit, even if a security patch has already been released.
• Keep your backups safe and updated. First, the backup should not be always connected to the disk that’s being backed. Second, the files there should be up-to-date. Losing new files is going to be a lot less painful when only a day of work was lost, rather than a week.
• Be careful with free software, and especially pirating. Not only is pirating illegal in most cases, but various malware, including Trojans, miners, and ransomware is distributed using filesharing. Free software bundles, too, sometimes bring malware included; not just PUPs (potentially unwanted programs), but even Trojans.
• Remember all the social engineering tactics and the red flags that give away a malicious email: urgency, no identification, updates about events that you never participated in, unnecessary attachments and links that you’re told to open. Teach the people around you to be cautious with suspicious emails.

How to remove Sysfrog

Sysfrog and whatever other malware came with it should be removed from the system before the files are restored. Otherwise, the malware might persist and cause problems in the future. Use a professional and trusted antivirus program, like Spyhunter.

After this, you must know your file recovery options. Maybe you have backups or copies of your important files. Read the guide below for a few more options.

Automatic Malware removal tools

How to recover Sysfrog Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Sysfrog Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Sysfrog Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Sysfrog Ransomware. You can check other tools here.  

Step 3. Restore Sysfrog Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Sysfrog Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Sysfrog Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.