.Encrypted (Fake Windows Updater) Virus (Restore Files)


This material has been created to help you remove the Fake Windows Updater ransomware also known as FakeWU virus and restore .encrypted files by it.

AES-256 encryption algorithm with an ECB encryption mode has been reported to be used by the FakeWU ransomware virus, also known as Fake Windows Updated. Developed by FathurFreakz, this ransomware virus is based on Visual Studio 2010. It aims to render the important files on the computers it infects no longer able to be opened and with the .encrypted file extension appended to them. In case you have been infected by this ransomware, reccomendations are not to pay any ransom to the cyber-criminals and read this article carefully.

Image Source: id-ransomware.blogspot.bg

Threat Summary

Name

Fake Windows Updater

TypeRansomware
Short DescriptionThe malware encrypts users files using the AES-256 encryption cipher, making direct decryption possible only via a unique symmetric decryption key available to the cyber-criminals.
SymptomsThe user may witness ransom notes and “instructions” screen, asking to pay a ransom. Changed file names and the file-extension .encrypted has been used.
Distribution MethodVia an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner.
Detection Tool See If Your System Has Been Affected by Fake Windows Updater

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss Fake Windows Updater.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Fake Windows Updater Virus – Distribution

The Fake Windows Updater ransomware infection may be spread via different techniques. The virus may use third-party installers via fraudulent web pages that display to the user a message which asks to update the computer. Hence, users may download the file, named WindowsUpdater.exe which is not an actual updater, but rather a loader or dropper of the malicious files of this ransomware virus. Usually such distribution websites are all over the web, but they may be displayed as pop-ups onto a computer, in case there is an ad-supported application that is potentially unwanted, in other words adware or a browser hijacker app installed.

Fake Windows Updater Ransomware

The activity of the Fake Windows Updater virus is comprised of multiple different activities, the first of which is to drop the malicious files on the infected machine. The primary files associated with Fake Windows Updater ransomware are the following:

  • WindowsUpdater.exe
  • Translation-Report.docx.exe

To drop the files, the virus may also establish connection with the following hosts:

  • hxxps://ganedata.co.uk/ransomware/ransomware.php
  • hxxps://ganedata.co.uk/Transaction-Report.docx.exe

After already establishing connection to the hosts, the ransomware virus may begin to delete the shadow volume copies of the infected computer. This is achievable in the background by inputting the following commands via a script:

→ process call create “cmd.exe /c
vssadmin.exe delete shadows /all /quiet
bcdedit.exe /set {default} recoveryenabled no
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

In addition to tampering with Windows shadow copies, the Fake Windows Updater ransomware may also heavily interfere with the Windows Registry Editor, more specifically with sub-keys that modify certain settings such as run files on system boot or change wallpaper:

→ HKEY_CURRENT_USER\Control Panel\Desktop\
HKEY_USERS\.DEFAULT\Control Panel\Desktop\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

In addition to this, other activity may be to display a pop-up that Is named FILE SECURITY PROTECTED after encrypting the files.

Fake Windows Updater Ransomware – Encryption

The encryption process of files encoded by Fake Windows Updater Ransomware is conducted via the strongest AES (Advanced Encryption Algorithm) with a 256-bit strength. The cipher is applied onto the encrypted files in blocks with a generated key. For the encryption process of this virus, the following types of files are targeted by it:

→ .#vc, .$ac, ._vc, .00c, .07g, .07i, .08i, .09i, .09t, .10t, .11t, .123, .13t, .1pa, .1pe, .2011, .2012, .2013, .2014, .2015, .2016, .2017, .210, .3dm, .3ds, .3g2, .3gp, .3me, .3pe, .500, .7z, .aac, .aaf, .ab4, .ac2, .acc, .accd, .ach, .aci, .acm, .acr, .aep, .aepx, .aes, .aet, .afm, .ai, .aif, .amj, .as, .as3, .asc, .asf, .asm, .asp, .asx, .ati, .avi, .back, .bak, .bat, .bay, .bc8, .bc9, .bd2, .bd3, .bgt, .bk2, .bkf, .bmp, .bpf, .bpw, .brd, .brw, .btif, .bz2, .c, .cal, .cat, .cb, .cd, .cdf, .cdr, .cdt, .cdx, .cf8, .cf9, .cfdi, .cfp, .cgm, .cgn, .ch, .chg, .cht, .clas, .clk, .cmd, .cmx, .cnt, .cntk, .coa, .cpp, .cpt, .cpw, .cpx, .crt, .cs, .csl, .csr, .css, .csv, .cur, .cus, .d07, .dac, .dat, .db, .dbf, .dch, .dcr, .ddd, .dds, .defx, .der, .des, .dgc, .dif, .dip, .djv, .djvu, .dng, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .drw, .ds4, .dsb, .dsf, .dtau, .dtd, .dtl, .dwg, .dxf, .dxi, .ebc, .ebd, .ebq, .ec8, .efs, .efsl, .efx, .emd, .eml, .emp, .ens, .ent, .epa, .epb, .eps, .eqb, .ert, .esk, .ess, .esv, .etq, .ets, .exp, .fa1, .fa2, .fca, .fcpa, .fcpr, .fcr, .fef, .ffd, .fim, .fla, .flac, .flv, .fmv, .fon, .fpx, .frm, .fx0, .fx1, .fxr, .fxw, .fyc, .gdb, .gem, .gfi, .gif, .gnc, .gpc, .gpg, .gsb, .gto, .gz, .h, .h10, .h11, .h12, .hbk, .hif, .hpp, .hsr, .html, .hts, .hwp, .i2b, .iban, .ibd, .ico, .idml, .iff, .iif, .img, .imp, .indb, .indd, .indl, .indt, .ini, .int, .intu, .inv, .inx, .ipe, .ipg, .itf, .jar, .java, .jng, .jp2, .jpeg, .jpg, .js, .jsd, .jsda, .jsp, .kb7, .kd3, .kdc, .key, .kmo, .kmy, .lay, .lay6, .lcd, .ldc, .ldf, .ldr, .let, .lgb, .lhr, .lid, .lin, .lld, .lmr, .log, .lua, .lz, .m, .m10, .m11, .m12, .m14, .m15, .m16, .m3u, .m3u8, .m4a, .m4u, .m4v, .mac, .max, .mbsb, .md, .mda, .mdb, .mdf, .mef, .mem, .met, .meta, .mhtm, .mid, .mkv, .ml2, .ml9, .mlb, .mlc, .mmb, .mml, .mmw, .mn1, .mn2, .mn3, .mn4, .mn5, .mn6, .mn7, .mn8, .mn9, .mne, .mnp, .mny, .mone, .mov, .mp2, .mp3, .mp4, .mpa, .mpe, .mpeg, .mpg, .mql, .mrq, .ms11, .msg, .mwi, .mws, .mx0, .myd, .mye, .myi, .myox, .n43, .nap, .nd, .nef, .nl2, .nni, .npc, .nv, .nv2, .oab, .obi, .odb, .odc, .odg, .odm, .odp, .ods, .odt, .oet, .ofc, .ofx, .old, .omf, .op, .orf, .ost, .otg, .otp, .ots, .ott, .p08, .p12, .p7b, .p7c, .paq, .pas, .pat, .pcd, .pcif, .pct, .pcx, .pd6, .pdb, .pdd, .pdf, .pem, .per, .pfb, .pfd, .pfx, .pg, .php, .pic, .pl, .plb, .pls, .plt, .pma, .pmd, .png, .pns, .por, .pot, .potm, .potx, .pp4, .pp5, .ppam, .ppf, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptx, .pr0, .pr1, .pr2, .pr3, .pr4, .pr5, .prel, .prf, .prn, .prpr, .ps, .psd, .psp, .pst, .ptb, .ptdb, .ptk, .ptx, .pvc, .pxa, .py, .q00, .q01, .q06, .q07, .q08, .q09, .q43, .q98, .qb1, .qb20, .qba, .qbb, .qbi, .qbk, .qbm, .qbmb, .qbmd, .qbo, .qbp, .qbr, .qbw, .qbx, .qby, .qbz, .qch, .qcow, .qdf, .qdfx, .qdt, .qel, .qem, .qfi, .qfx, .qif, .qix, .qme, .qml, .qmt, .qmtf, .qnx, .qob, .qpb, .qpd, .qpg, .qph, .qpi, .qsd, .qsm, .qss, .qst, .qtx, .quic, .quo, .qw5, .qwc, .qwmo, .qxf, .r3d, .ra, .raf, .rar, .raw, .rb, .rcs, .rda, .rdy, .reb, .rec, .resx, .rif, .rm, .rpf, .rsspptm, .rtf, .rtp, .rw2, .rwl, .rz, .s12, .s7z, .saf, .saj, .say, .sba, .sbc, .sbd, .sbf, .scd, .sch, .sct, .sdf, .sdy, .seam, .ses, .set, .shw, .sic, .skg, .sldm, .sldx, .slk, .slp, .sql, .sqli, .sr2, .srf, .ssg, .stc, .std, .sti, .stm, .str, .stw, .svg, .swf, .sxc, .sxd, .sxi, .sxm, .sxw, .t00, .t01, .t02, .t03, .t04, .t05, .t06, .t07, .t08, .t09, .t10, .t11, .t12, .t13, .t14, .t15, .t99, .ta1, .ta2, .ta4, .ta5, .ta6, .ta8, .ta9, .tar, .tax, .tax0, .tax1, .tax2, .tb2, .tbk, .tbp, .tdr, .text, .tfx, .tga, .tgz, .tif, .tiff, .tkr, .tlg, .tom, .tpl, .trm, .trn, .tt10, .tt11, .tt12, .tt13, .tt14, .tt15, .tt20, .ttf, .txf, .txt, .u08, .u10, .u11, .u12, .uop, .uot, .v30, .vb, .vbpf, .vbs, .vcf, .vdf, .vdi, .vmb, .vmdk, .vmx, .vnd, .vob, .vsd, .vyp, .vyr, .wac, .wav, .wb2, .wi, .wk1, .wk3, .wk4, .wks, .wma, .wmf, .wmv, .wpd, .wpg, .wps, .x3f, .xaa, .xcf, .xeq, .xhtm, .xla, .xlam, .xlc, .xlk, .xll, .xlm, .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xpm, .xqx, .yuv, .zdb, .ziparc, .zipx, .zix, .zka

After encryption the files are appended the encrypted file extension and appear like the image below displays:

This mode of encryption is named ECB (Electronic Codebook) mode. It aims to replace blocks of data from the legitimate files with data from the cipher and a unique decryption key is generated for each infected computer:

Source: Wikipedia

The key may then be sent to the cyber-criminals and then a ransom note is dropped to make the victim aware an extortion is taking place. The note has the following content:

YOUR FILES HAS BEEN ENCRYPTED
Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer.
Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key.
Now you have the last chance to decrypt your files.
1. Buy Bitcoin (https://en.bitcoin.it/wiki/Buying_bitcoins)
2. Send amount of 0.02 BTC to address: 3BsyRz2scfvXcWRaycPoizEH5hAbDmWcpNE
3. Transaction will take about 15-30 minutes to confirm.
4. When transaction is confirmed, send email to us at [email protected]
5. Write subject of your mail with :
‘Restore my files ***’
6. Write content of your mail with :
‘Bitcoin payment : (YOUR BITCOIN TRANSACTION ID)
Computer Identifier : {UNIQUE ID}
7. We will contact you back with your private key.

Delete Fake Windows Updater Virus and Restore .encrypted FIles

In case your computer was infected by the .encrypted file virus, reccomendations are to firstly backup your computer and then follow the removal and file recovery instructions below. In case manual removal is difficult for you, experts recommend using an advanced anti-malware tool to automatically delete the virus and protect your PC in the future. Regarding file recovery, it is not advisable to pay the ransom and instead we recommend to focus on alternative methods to decrypt your files, like the ones we have mentioned in step “2. Restore files encrypted by Fake Windows Updater” below.

Manually delete Fake Windows Updater from your computer

Note! Substantial notification about the Fake Windows Updater threat: Manual removal of Fake Windows Updater requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Fake Windows Updater files and objects
2.Find malicious files created by Fake Windows Updater on your PC

Automatically remove Fake Windows Updater by downloading an advanced anti-malware program

1. Remove Fake Windows Updater with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Fake Windows Updater
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.