How to remove FakeCry ransomware virus

FakeCry sneaks together with NotPetya/Petya plague

FakeCry virus is defined as a file-encrypted virus which was unleashed together with ExPetr/Petna^[1] via corrupted M.E.Doc update network. Due to the massive scale of the malware, the virus was not spotted right away.

Interestingly, the malware pretends to be a WannaCry variation as it includes WNCRY strings in its source code. It turns out to be written in .NET programming language^[2].

Besides M.E.Doc servers, the perpetrators seem to use another technique – waterhole strategy. In short, cyber criminals plague often the websites, often visited by targeted victims, with malware. Such virtual infections also serve for espionage purposes.

Even though the malware does not happen to be a genuine WannaCry virus, its distribution technique and the fact it was delivered together with Petna/Petya attack alarm the virtual community. If you were struck by the former threat, you were most likely to experience the annoying effects of the latter malware as well. Remove FakeCry with the assistance of FortectIntego or MalwarebytesMalwarebytes.

Mission success: FakeCry accompanies Petna virus

Perhaps due to several questionable and even amusing features of the malware and the destructive outcome of the main virtual threat, online media did not grant enough attention to FakeCry malware.
Even though the threat contains references to WannaCry with such elements in “made in China,” it was not considered as a huge threat. However, such assumption might be misleading.

The malware attack is comprised of two stages. Firstly, wc.exe runs on the device and extracts its content – ed.exe. It serves as the main executive of the malware. It is set to encrypt files with the RSA-2048. Additionally, the malware is set to delete shadow volume copies. FakeCry malware also targets a wide range of file formats.

Unlike other malware, the virus drops DEMO_EXTENSIONS folder. It indicates image file extensions which can be decrypted for free. Naturally, the malware happens to be still under development. After the encryption, the malware presents the same ransom note as Wana Decrypt0r 2.0.

Some of the Ukrainian victims^[3] have paid the ransom, but one of the perpetrators’ bitcoin address was terminated. It is not advised to pay the ransom. Instead, proceed to FakeCry removal.

Distribution peculiarities

The malware spreads via M.E.Doc update network. However, since now cyber security forces have finally revealed its transmission methods, you can prevent FakeCry hijack. If this advice is too little too late, then proceed to the elimination guidelines.

Besides, both, ExPetr and FakeCry, also employs waterhole technique. Thus, it means that even if you are cautious enough, there is still a high risk to get entangled by the malware if you visit a specific infected website. In that case, check whether an anti-virus, malware elimination tool and your firewall are functioning properly.

Eliminate FakeCry threat

You can get rid of it from Windows OS with the assistance of a virus-fighting utility. Taking into account that it is delivered together with Petya, or may spread individually in the future, you might encounter certain FakeCry removal issues.

In that case, restart the device into Safe Mode and launch an anti-spyware elimination tool. Then, you should be able to remove FakeCry virus. Let us warn you not to download any decryption tool offered by the criminals. Since the malware is still under development, data recovery process may not go smoothly. Besides, Ukrainians, Russsian users^[4] should be vigilant as well.