How to remove Fake WindowsUpdater ransomware virus

What should you know about Fake WindowsUpdater virus?

FakeWU ransomware or, more specifically, Fake WindowsUpdater virus is a crypto-ransomware ^[1] which seems to be created by an Indonesian-based malware developer known by a screen name FathurFreakz. This extravagant individual openly boasting about his cyber attacks on social media, and FakeWU appears to be his latest creation. Though the distribution of this virus is currently rather low, the malware sure has the potential of expanding to broader waters. One of the factors that may determine its success it the choice of advanced encryption standard AES-256 ^[2] when rendering victim’s files unreadable. Most of the successful ransomware projects were based on this particular encryption and allowed the extortionists to accumulate a considerable profit. Of course, we can only hope that this scenario will not reoccur in the case of Fake WindowsUpdater ransomware and the virus will be decrypted or die down some time in the near future. In the meanwhile, the best advice we can give to the infected users is to banish the virus from their computers as soon as possible and refuse paying the demanded ransom money for the encrypted files. Of course, this is not the best option when it comes to getting back your files, but it is even worse for the hacker. Do not hesitate and remove Fake WindowsUpdater with trusted antivirus software, say FortectIntego to be able to proceed with data recovery.

FakeWU virus is a deceptive malware; it sneaks into the computers inside an obfuscated email attachment labeled as Transaction-Report.docx which features a hidden .exe extension at the end. This means that this document is not actually a .docx file but rather an executable which establishes the connection with hxxps://ganedata.co.uk/ransomware/ransomware.php and hxxps://ganedata.co.uk/Transaction-Report.docx.exe servers to download and activate the virus on the target computer. After it is done, the newly downloaded WindowsUpdater.exe takes over and starts scanning the computer for over 660 types of files and encrypts them additionally appending .encrypted extensions. Finally, the malware is programmed to open a pop-up window called “FILE SECURITY PROTECTED” which features the ransom note and instructions for data recovery. Below, you can see the transcribed content of this message:

YOUR FILES HAS BEEN ENCRYPTED
Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer.
Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key.
Now you have the last chance to decrypt your files.
1. Buy Bitcoin (https://en.bitcoin.it/wiki/Buying_bitcoins)
2. Send amount of 0.02 BTC to address: 3BsyRz2scfvXcWRaycPoizEH5hAbDmWcpNE
3. Transaction will take about 15-30 minutes to confirm.
4. When transaction is confirmed, send email to us at ransomwareinc@yopmail.com
5. Write subject of your mail with :
‘Restore my files ***’
6. Write content of your mail with :
‘Bitcoin payment : (YOUR BITCOIN TRANSACTION ID)
Computer Identifier : *** ‘
7. We will contact you back with your private key.
button [RESTORE]

While 0.02 BTC ^[3] may not seem like that large of a sum to pay for the recovery of your files, you should remember that the money that lands in the hands of a hacker may later be used to generate even more malicious content that would continue to terrorize the online community. So, Fake WindowsUpdater removal is the best discouragement that is upon your power. If you need some help regarding the virus elimination, check out the recommendations at the end of this article or consult our experts directly in the Ask Us section of this site.

Means of ransomware infiltration

Either your device gets infected with Fake WindowsUpdater or some other malware, it signals serious security problems. Ransomware typically attack computers that contain outdated or illegal software ^[4], which are not protected with any security utilities, and which users are careless or clueless when it comes to browsing the web. Sure, paying attention to the mentioned aspects and fixing them to satisfy all security standards may diminish the risk of getting infected with the Fake WindowsUpdater, but it will not abolish it completely. Your best bet in protecting your data is keeping data backups ^[5]. These extra copies of your files will allow a quick data recovery in case of ransomware attack or some other emergency.

What are my options regarding Fake WindowsUpdater removal?

If you want to remove Fake WindowsUpdater virus with the least damage to your computer you have to act quick and employ sophisticated tools. But keep in mind that ransomware are complicated viruses which means they might prevent security programs from eliminating them by obfuscating files and simply blocking system scans. In such a case, you will have to take additional measures and decontaminate the program manually. Nevertheless, Fake WindowsUpdater removal does not end there, and you must run the automatic scan of your again to banish it for good.