FBLocker Virus – Remove and Restore .facebook Files

FBLocker Virus – Remove and Restore .facebook Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

The FBLocker virus is a new malware that does not originate from any of the known malware families. The collected samples so far are test versions and we expect to see forthcoming attacks with it. The virus engine encrypts target user data with the .facebook extension, read our removal guide for further information on deleting active infections.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionThe ransomware encrypts sensitive information on your computer system with the .facebook extensions and demands a ransom to be paid to allegedly recover them.
SymptomsThe ransomware will encrypt your files with a strong encryption algorithm.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by FBLocker


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss FBLocker.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

FBLocker Virus – Distribution Ways

FBLocker virus is an example of a malware that uses the typical virus delivery tactics. At this point there is no information about the preferred method because of the small size of the attacks. As such we assume that the most popular methods are going to be used.

An example attack can facilitate email messages that make use of social engineering tactics in order to manipulate the victims into interacting with the threat. Usually the preferred way for the hackers behind the FBLocker virus is to create messages that use text and graphics from well-known sites and services and attempt to scam the targets into opening a dangerous file. From its name we can assume that the probable victim would be Facebook. Usually the virus files are either attached or hyperlinked in the body contents of the emails. They are also among the most common methods for delivering virus-infested payloads. Two of the most often used types are the following:

  • Software Installers — The criminals bundle the dangerous code in application installers of popular applications: productivity suites, creative utilities, system optimization solutions or computer games. This is done by taking the legitimate files from the official download site and modifying them with the dangerous code. They are then uploaded to various hacker-controlled sites, P2P networks and other distribution channels.
  • Documents — The same mechanism can be used with documents of different types: rich text documents, spreadsheets or presentations. The embedded scripts launch a notification prompt that asks the victims to enable the built-in scripts. If this is done the virus will be downloaded from a remote server and the infection follows.

The hackers behind the FBLocker virus can also employ browser hijackers that represent malware browser extensions. They are often made compatible with the most popular web browsers: Mozilla Firefox, Google Chrome, Internet Explorer, Microsoft Edge, Safari and Opera. The hackers use elaborate descriptions and fake user reviews and developer credentials in order to advertise it on the relevant software plugin repositories.

Using various web scripts the threat can be delivered to legitimate and popular sites as well. This is done using all manners of banners, pop-ups and redirects.

FBLocker Virus – In-Depth Analysis

The FBlocker appears to be an original creation of the hacker or criminal collective behind the threat. The initial security analysis does not reveal any correlation with any of the famous malware families.

The virus files taken the name svchost and MicrosoftWindowsOperating System in order to mask their appearance from the users. Following the security examination it appears that it is still under development. We expect to see further updates in the forthcoming attacks.

So far the engine does not seem to execute an initial infiltration step. In future versions it may launch a data harvesting module that is programmed to gather their personal information. The type of data that is being harvested can reveal the identity of the victims by hijacking their name, address, telephone number, interests, location, passwords and account credentials. In connection with this the harvested data can be fed to a stealth protection mechanism. It uses the acquired information in order to scan for applications that can interrupt the correct execution of the virus. This includes all manners of anti-virus software, virtual machine hosts or debug/sandbox environments. In certain cases the malware may be instructed into deleting itself to avoid detection if it is not able to bypass this step.

After this is done the next step may be the institution of various system changes. Depending on the exact configuration this can lead to Windows Registry entries modification. When done against the operating system and user-installed applications strings the victims may be unable to start certain functions and will experience performance issues. The Windows registry is also used to lead to a persistent state of execution which starts the FBLocker virus every time the computer is booted. The system changes induced by the threat can also lead to the removal of Shadow Volume Copies which makes it very difficult to recover the data without the use of specialized software, refer to our guide below.

Considering that the FBLocker virus may be updated in the future we suspect that the next versions might include a malware server connection. It can be used to harvest the gathered information, drop additional threats threats and also lead to a Trojan like infection. This means that the FBLocker virus can be used to spy on the victims and take over control of the affected machines at any given time.

FBLocker Virus – Encryption Process

The ransomware component is launched once all preliminary components have finished execution. It uses a custom cipher in order to affect the target data which is chosen based on a built-in list of target file types. An example list includes the following targets:

  • Archives
  • Documents
  • Backups
  • Databases
  • Images
  • Videos
  • Music

As a result of the encryption engine all victim files are renamed with the .facebook extension. A sample ransom note (that can have many names and extensions) reads the following:

What Happened to My Computer?
Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Do not waste your time looking for a way to recover your files. Nobody can recover your files.
Can I Recover My Files?
No. My name is Mark Zuckerberg and I have encrypted your files without saving any encryption keys. I appreciate you executing my program because you have allowed me to ruin more lives.
“A squirrel dying in front of your house may be more relevant to your interests right now than people dying in Africa.”

Remove FBLocker Virus and Restore .FBLocker Files

If your computer system got infected with the FBLocker ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.


Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts - Website

Follow Me:
TwitterGoogle Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share