Get Rid of the Fs0ci3ty Ransomware Infection

Fs0ci3ty is the latest computer malware that is inspired by a pop phenomenon, this time its Mr. Robot again. We have witnessed a previous attempt at a ransomware that shares the name of the threat FSociety which operates in a similar manner.

Fs0ci3ty Ransomware Description

This is a new ransomware variant that encrypts certain files on the victim computers upon infection and blackmails the users to pay a ransom fee to restore access to them. The criminals behind the malware have also imposed a time limit that further coerces the victims into paying the sum.

Fs0ci3ty Ransomware – Distribution

There are no specific distribution methods that are used by this ransomware. Fs0ci3ty is mainly distributed through the usual channels like spam emails with malicious attachments and links, messaging apps like Facebook Messenger and Viber and exploit kits. The ransomware operators usually use some kind of a social engineering tactic to trick the users into downloading and executing the infected binary file which is disguised as driver_update.exe, posing as a legitimate driver update for the operating system.

Fs0ci3ty Ransomware – More Details

The Fs0ci3ty ransomware uses the AES-256 cipher in CBC mode to encrypt the user files upon infection. The threat uses the standard procedure of encrypting the files using a decryption key which is removed from the computer when the process is complete.

The file extension [email protected] is added to each modified file. This signals the email address of the operators and the name of the ransomware. The email is hosted on the SIGAINT service which is used by privacy minded computer users and criminals as it protects the identity and location of its users.

The filenames of the encrypted files are saved in a discovered.txt file. The ransom note is crafted in Fs0ci3ty.html saved on the desktop of the infected computer. Its contents are the following:

Welcome to Fs0ci3ty

You Will need to make a Payment of 1.5 Bitcoins within the next 24 Hours, or Ransom goes to 1 BTC more daily Your File System has been encrypted using state of the art Technology

The rest of the instructions explain how Bitcoins can be bought and sent to the hackers. The victims are also extorted to supply their unique 16-byte identifier and contact the criminals via emails for further instructions about how to decrypt their files.

Fs0ci3ty Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Fs0ci3ty completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Fs0ci3ty Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter