CryptoFortress is a ransomware that’s been available since February. Before that it was also known by the name CryptoLocker, although we don’t mean to say it’s the same as the original CryptoLocker from 2013. Microsoft identifies CryptoFortress under the name Teerac.A (Torrent Locker).
What does CryptoFortress do?
Once installed in your computer CryptoFortress will encrypt some of your files and will change their extension to .frtrss In every folder where the program encrypts files it will ad a new file called “READ IF YOU WANT YOUR FILES BACK.html” This file will have the steps they ask you to follow if you want to remove the encryption from your files. CryptoFortress asks for 1 Bitcoin to allow you to download a tool to remove this encryption.
Once you follow the links contanined in the reward file, you’ll be sent to CryptoFortress’ website where you will be told how to buy the needed tool. As is the case with many other ransomware, this site will force you to send a fixed amount of bitcoins to a particular address, afterwards you’ll be asked to send the transaction ID to validate the payment. After this process is finished you’ll be prompted to download a software to remove the encryption. This website also has a support and FAQ sections plus a section that will allow you to remove the encryption from two files for free. As usual we don’t recommend to pay them anything at all.
In theory CryptoFortress doesn’t erase any of WIndows backup files, these files could be used to get back some of your files. After having the infection deleted use these files to attempt to save back your files with the help of Shadow Explorer.
CryptoFortress asks for 1 Bitcoin to allow you to download a tool to remove this encryption.
How can I protect myself from CryptoFortress?
We recommend the use of HitmanPro.Alert because of its two step technology called CryptoGuard, and also because it will stop you from being the victim of another ransomware like CryptoFortress. This software’s technology will detect any ransomware like CryptoFortress, by analysing the file system behavior. At the slightest sign of suspicious behavior, it blocks the malware without the help of the user. On the plus side it’s a lot more difficult for the ransomware author, to change the full behavior of the program than to change the statics properties. What we mean by this is the location of the source code and structure. HitmanPro.Alert is completely fee.
Here’s an example of CryptoFortress being blocked by HitmanPro.Alert: