PowerWare virus: what it is and how to remove it

Not before you have tried everything else. Identify the family from FILES_ENCRYPTED-READ_ME.HTML and one encrypted file, check No More Ransom for a free decryptor, and look for clean copies in OneDrive, backups and Previous Versions.

Paying funds further attacks, may be illegal if the group is sanctioned, and is no promise of a working key: many victims get partial or broken decryption. If you consider paying for business-critical data, involve the police and a professional incident responder first, and never pay through intermediaries who promise their own decryption.

You cannot open them by renaming or by choosing another program. The .tax2013 ending shows that PowerWare virus encrypted the content, and only the matching key can reverse it. Renaming a file back to .docx or .jpg changes nothing except the icon, and it can confuse a future decryptor, so leave the names as they are.

To get the content back, use a backup, an unencrypted copy elsewhere, or a decryptor listed on No More Ransom if one exists for PowerWare virus. Store the encrypted files on an external disk until then.

We last checked on 7 October 2026, and for PowerWare virus no free decryptor is known. We check No More Ransom, which collects free tools from police and security companies, and the decryptor pages of the major antivirus vendors. A working decryptor exists only when the encryption has a flaw or the keys were leaked or seized.

Ignore sites and videos that offer a "PowerWare virus decryptor" for download or for a fee: these are usually scams or malware. Real decryptors are free and come from known security companies or law enforcement. Keep the encrypted files in case a tool appears later.

Only if a decryptor already exists or the company pays the attackers for you. Some "ransomware recovery" services advertise that they can decrypt families with no known flaw; in practice they negotiate with the attackers and add their own fee. Others use the same free tools listed on No More Ransom.

Before you hire anyone, ask in writing how they will recover the files, whether they will contact the attackers and what happens if they fail. A legitimate service answers clearly. If a free decryptor exists for your family, you can run it yourself.

The way PowerWare virus spreads has not been documented yet, so look at your own recent activity. On home PCs, ransomware most often comes with cracked programs, game cheats, key generators and fake updates, or with an e-mail attachment that was opened. On business networks, attackers usually log in through Remote Desktop with a stolen or guessed password.

Think back to what was downloaded or installed in the days before files that end in .tax2013 and no longer open, and check the Downloads folder and Installed apps sorted by date. Keep anything suspicious for your report, but do not run it again.

We do not know yet. Nothing published so far shows data theft by PowerWare virus, but the only confirmed sign is files that end in .tax2013 and no longer open, which says nothing about what happened before. Many current ransomware attacks copy files or run a password stealer first, so it is wise to act as if they did.

From a clean device, change the passwords that were saved in the browsers on this PC, starting with e-mail and banking, sign out of all sessions and turn on two-step verification. Watch bank statements and account activity for the next few weeks.

Not necessarily. Ransomware names come from the file extension, the note or a word in the code, so unrelated families often end up with similar names, and one family can appear under several names. The difference matters: a decryptor or advice for one family does not fit another and can damage files.

Compare the ending added to your files and the exact name of the note with the summary table at the top of this guide, then upload the note and one encrypted file to ID Ransomware from a clean device. If the result names another family, follow the guide for that family instead.

You can try it on a copy, but for real ransomware it will not help. The .tax2013 extension is only a label; the file content has been scrambled with a key the attackers hold.

If a renamed copy opens normally, the malware only renamed files, which happens with some fake ransomware, and you can rename the rest back. If it does not open, leave the files as they are. Renaming encrypted files can confuse a decryptor later, so always work on copies.

Yes, the note itself is harmless text and deleting it does not affect your files. Keep at least one copy first, outside the infected PC. FILES_ENCRYPTED-READ_ME.HTML contains your personal ID and the attackers' contact details, which identification services use to tell which family encrypted your files, and which a decryptor may need later.

Police reports also ask for it. Once you have saved a copy, you can remove the notes from every folder after the ransomware program has been removed and your files are restored or backed up.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For PowerWare virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.