Who would run a file named "Critical Windows Update.exe" Oh wait, my mom would. She would even run it if it was called "Free Really Good 100% Legit Windows Update Install now.exe"
Before you install Windows Updates, check the digital signature. If it says a big red X or "signature invalid" or has no "Digital Signature" Tab at all, don't run it.
I don't think so. After Windows 10 anniversary update, there were a lot of forum posts about non functional drivers, programs, etc. Common user starts googling how to fix these problems and some pages just leads you to malware websites, where creators are promising to fix all your problems by downloading this critical update and voilá. You got infected .exe file in your system.
additional tip: ALL current microsoft updates have KB numbers with 5 or 6 digits, so if any of you people out there see a file with less digits, be VERY cautious!
there was a fake update for my computer. but it was way more sophisticated. but I did notice one thing while it was updating. it said "please do not turn off your computer this could take a while :)" and the font was really thin, and there was a really weird smiley face. at the moment I was like, "nope" and shut off my computer. it was fine after that.
Avast decrypted my files after 2 scans and 5 Restarts ;D Atleast i have my files back (Not 100% Garanted to work) I downloaded avast after the fake update
The only files I really care about on my computer are my drawings and Minecraft worlds...which I put on an external hard drive (I only plug it in to back up the files). So if I got a terrible virus/ransomeware I'd just laugh and reinstall Windows.
I want someone to make a fake ransomware that would just block the computer for a moment with a message saying something like "your computer has been locked but it's nothing serious actually, this message is only to tell you that you must be safer in the web because some viruses aren't as polite as this one and they will actually do bad things, stay safe" I don't know if it would work, but maybe it could teach some people a few things
Great job as usual! My Comodo CIS lately detects any Windows 10 anniversary edition update/manifest file it doesn't know about as "uncategorized malware"; I right-click on file CIS scan is reporting, which takes to file, then open it with Notepad and save it as is, uploading the saved (easy to find!) version to VirusTotal; every time so far I see someone has recently uploaded but I re-analyze, CIS always only scan complaining, VT advising "probably safe". Cheers!
How to prevent this from happening to you: ALWAYS use Windows Update (which is installed when you install windows). How you can access Windows Update is by typing "update" into the cortana/start menu search bar thing.
4:08 That moment when you think everything is going according to your expectations, but suddenly something goes wrong "Oh it's not working. We are screwed!"
One thing to look out for in telling if it's real or not is grammar errors. Sometimes they're lazy at naming them and they just screw up on their grammar.
@@malwaretestingfan I know. I even know someone who if the mouse doesn't work, starts cursing and slamming the mouse to the desk and his laptop instead of the very complicated process of unplugging the mouse from the side of the laptop and plugging it back in.
I just got my computer back from Geek Squad because this virus completely encrypted my computer so that I couldn't even log onto it. Geek Squad even had a hard time with getting in. When all else failed, they had to basically remove the hard drive and use another computer to remove the virus.
I don't know how anyone would fall for it when Windows only updates if there is a scheduled restart or you manually restart/shut down when there is an update you need to install.
How to protect yourself from a fake Windows update updates do not come in a desktop file so you can pretty much tell it's a fake if it's on your desktop saying it's an update
I got this stupid shit on a virtual machine when looking for mario forever version 4.0 (played this tons back in highschool, specifically wanted this version) but thank god for virtual machines
despite the forums website being added to AV white list, at start up turning on the computer i clicked on events and saw the AV blocked forum the pc security message - bus with no option to allow or add. do you know anything about this leo ?
Do you have a tutorial on getting virtualbox working? It would be nice to have to open files that seem suspicious, but I can't get it to install windows 10 (it gets stuck on the windows logo, no circle, i'm waiting right now to see if it does anything, been frozen for the last 30 mins). A tutorial would be great.
I think I know why this ransomware is called fantom. In french, fantôme want to say Ghost. So, the developpers of this ransomware are probally french. And, idk if you noticed but there is Attention writed instead of Warning, so the theory is possible.
yes it safe, but you shouldn't create shared folders from your computer. It'll be better if you disable all types of connection form VM to your real machine.
I'd imagine a senile grandma just sitting in front of a computer going all like "Yes, honey download me some of that sweet free mp3 download now.exe" or going on the interwebs and clicking onto that sweet "download more ram/cpu clock efficiency" button
_Hello, Brian, please, could you kindly give me a sample for this old ransom software, as i didn't find any?_ *I want to see how it works on each of windows versions virtual machines, please, help me with it, thank you for your help*
Bro, could you help me to get the source code/sample of the Fantom?I want to test it on each windows virtual machines version and see what happens there...Thanks for your help, sorry, i am asking becsuse couldn't find this one anywhere
Basically this is something you’d only find online? Nothing to do with the updates you’d get from the “check for updates” section in Windows 10’s settings? Cause I’m not that stupid to download an updater for the OS knowing that just about all systems now do them in the settings section
That happened same to my mom's computer but I don't know if it's that virus cause when she updated it it made nothing functional. Then her desktop was black.
Wait. People get this from the Internet? An ad? A phishing email? Shouldn't that immediately tell anybody not to install it? Well, I've gotten thousands of crapware toolbars in my day.
Wouldn't you get a UAC notification before the file executes itself? Because there you can actually check whether it's really Microsoft(using the certificate) or not, isn't that so?
+The PC Security Channel Will you make a video explaining HOW these are made? I don't mean show code or anything, I mean explain how these are made to look like very innocent update or file and turn into something that encrypts all of your files, and how they are spread out so much.
So could you stop any ransom ware from encrypting your data if you quickly cut power, and live boot some Linux distribution, and then delete it while out of windows?
I love your videos. Thanks! I have a nas attached to my computer. Would something like this encrypt those files as well? If so what can I do to block that from happening. I don't care about my pc files but I obviously care about my nas files. I do have them backed up to aws as a last resort. Thanks again for your time and help.
It is possible unless you are using it in read only mode. If you are not writing to it often you can make some folders write protected, that way they won't be affected.
Who would run a file named "Critical Windows Update.exe"
Oh wait, my mom would.
She would even run it if it was called "Free Really Good 100% Legit Windows Update Install now.exe"
lol
your mom does not now what is a virus and what is not
No shit sherlock.
Roope Heikkinen Suomi?
TheKilledCreeper i keep seeing u in these kind of computer videos...
How To protect from Ransomware: DONT DOWNLOAD RANDOM SHIT!
Jett TheDoctor randomware :]
i actually almost never download anything
val val ransomware :/
Jett TheDoctor Randomware
Jett TheDoctor I guess you could call it...
RANDOMWARE!! See what I did there?
Before you install Windows Updates, check the digital signature. If it says a big red X or "signature invalid" or has no "Digital Signature" Tab at all, don't run it.
Is this thing still prevalent now
Pretty amazing how good this Ransomware's facade is, but surely the method of receiving the exe would be suspicious?
Yeah, cause you normally don't download updates yourself, but could confuse a lot of users.
Someone told me that AVG was a bad choice and I have AVG
***** I figured, it's actually pretty good
I don't think so. After Windows 10 anniversary update, there were a lot of forum posts about non functional drivers, programs, etc. Common user starts googling how to fix these problems and some pages just leads you to malware websites, where creators are promising to fix all your problems by downloading this critical update and voilá. You got infected .exe file in your system.
only to people who know. those who don't have encrypted files.
"decrypt you files"
this has no sense
Indian scammers
@@endermodz-nightcoremore593 Actually, I see that error on the French community
Phantom is spelled Fantôme so it may be a French malware
@@endermodz-nightcoremore593 lol, yeah.
Decrypt me, I'm the files.
additional tip: ALL current microsoft updates have KB numbers with 5 or 6 digits, so if any of you people out there see a file with less digits, be VERY cautious!
there was a fake update for my computer. but it was way more sophisticated. but I did notice one thing while it was updating. it said "please do not turn off your computer this could take a while :)" and the font was really thin, and there was a really weird smiley face. at the moment I was like, "nope" and shut off my computer. it was fine after that.
Wow nice gg
W momment
No it ahd to do sim else, maybe cryptomining or smth
Good job
I love these type of videos
They are important,cuz lots of users dont know simple things like this.Its great that someone educate them like TPSC.
Vukasin Gostovic i
have you ever heard of www.kwaltx.com or www.kwalty.com or www.kwaltz.com before?
why would you ever update your windows 10 with extra file ??!!
anyway thanks for warning !!
For example: there is a windows Creators Update (that I have installed), and you download it from the windows update settings.
Grandma bait
Wow that's kinda scary to think about..
why?
becuase you could lose access to your files, i.e locked
+REC560 That's nothing new.
remember, this is for a novice user, a novice user cant just go and trash a hdd
files=lifes,
R.I.P. Me
1954-2017
"Life is lost and
locked"
Avast decrypted my files after 2 scans and 5 Restarts ;D Atleast i have my files back (Not 100% Garanted to work) I downloaded avast after the fake update
Fantom is a Hungarian word.. And yes, it means Phantom.
I wonder who would run any windows update from such an EXE file. That's obviously not the way Windows usually installs its updates.
The only files I really care about on my computer are my drawings and Minecraft worlds...which I put on an external hard drive (I only plug it in to back up the files). So if I got a terrible virus/ransomeware I'd just laugh and reinstall Windows.
Holy Shit! Am I the only one who noticed this? 3:16, look at the date created. 9/11..
haha.
Where u can't see it
Upfff hard to find ok.
I want someone to make a fake ransomware that would just block the computer for a moment with a message saying something like "your computer has been locked but it's nothing serious actually, this message is only to tell you that you must be safer in the web because some viruses aren't as polite as this one and they will actually do bad things, stay safe"
I don't know if it would work, but maybe it could teach some people a few things
Great job as usual! My Comodo CIS lately detects any Windows 10 anniversary edition update/manifest file it doesn't know about as "uncategorized malware"; I right-click on file CIS scan is reporting, which takes to file, then open it with Notepad and save it as is, uploading the saved (easy to find!) version to VirusTotal; every time so far I see someone has recently uploaded but I re-analyze, CIS always only scan complaining, VT advising "probably safe". Cheers!
Thanks for sharing the info. :)
How to prevent this from happening to you: ALWAYS use Windows Update (which is installed when you install windows). How you can access Windows Update is by typing "update" into the cortana/start menu search bar thing.
Enable file history in Windows 8 and 10.Then you cant loose any data.I have done this 4 times for clients in the past.
Riaan Burger helpful to know that, so thank you so very much
Note: almost all legit updates in a file come in a .msu extension
Did anybody else notice the ransomware said 2% complete just before he restarted?
Wait a second... Microsoft allways automaticly updates system IT never drops a file!
Fantom was a name of a Vacuum brand in the 90s. They were later bought by Dyson.
4:08 That moment when you think everything is going according to your expectations, but suddenly something goes wrong "Oh it's not working. We are screwed!"
One thing to look out for in telling if it's real or not is grammar errors. Sometimes they're lazy at naming them and they just screw up on their grammar.
My mom believed an ad that said: "Your computer has a virus download free Microsoft assisted", he
She did what
Thanks for informing us! I really love that there are some that cares about the web users safety =D
"...you run it because..."
me: because that's how critical Windows updates are distributed, aren't they?
There is still people that run malware because they think the JScript icon is a document one, don't be surprised.
@@malwaretestingfan I know. I even know someone who if the mouse doesn't work, starts cursing and slamming the mouse to the desk and his laptop instead of the very complicated process of unplugging the mouse from the side of the laptop and plugging it back in.
why doesn't protogent detect it? my security is their motto
· JLCí It's a rogue antivirus.
@@lordambicross You seem to have a rogue sense of humour.
@@lordambicross i'm pretty sure it isn't rogue, but as an antivirus it is terrible
@@aaandag9688 lol i made that a year ago please r/wooosh me
Every time you click on ransomware file I got chill
Thats why I only use Windows Update or download everything from the normal Microsoft page
Hearing the PC Security Channel say: "ah, we're screwed." xD
If a person know about updates, they won't fall for it, because MS doesn't distribųte updates as exe files
Thanks for the motivation. I wasn't sure if I could do it, but I might try it eventually.
You know it's the best Ransomware when they can't spell _"Encryption"_ right 😂
Fantom is on another language
As an ESL teacher, I am probably more worried by the poor state of these malware authors' grammar than anything else.
I just got my computer back from Geek Squad because this virus completely encrypted my computer so that I couldn't even log onto it. Geek Squad even had a hard time with getting in. When all else failed, they had to basically remove the hard drive and use another computer to remove the virus.
3:06 One thing that would flag me down (even though I am a power user and would realize others) is the fact that it is missing an icon... XD
I really enjoy these videos. Very fun and educational :-)
BTW, fantôm is french for ghost so the developers where proberly french
I don't know how anyone would fall for it when Windows only updates if there is a scheduled restart or you manually restart/shut down when there is an update you need to install.
made it into an arp using the default soft envelope generator and a bunch or other weird stuff I didn’t even know existed. Called it pants
Great channel, man. I'm suscribed and I will share your channel! Keep uploading videos, please.
@The PC Security Channel [TPSC] Thx for the video
How to protect yourself from a fake Windows update updates do not come in a desktop file so you can pretty much tell it's a fake if it's on your desktop saying it's an update
I got this stupid shit on a virtual machine when looking for mario forever version 4.0 (played this tons back in highschool, specifically wanted this version)
but thank god for virtual machines
Quick question dose ransomware encrypt files that are in secondary hard drives and external or just files on hard drive with os on it
Watching this video on 1.25 speed is the best idea. Get some sleep and maybe a morning coffee/tea/apple.
when i watched this video, I am scared of updating now.
Don't worry since windows 10 patched it
despite the forums website being added to AV white list, at start up turning on the computer i clicked on events and saw the AV blocked forum the pc security message - bus with no option to allow or add. do you know anything about this leo ?
Please tell me, are you more using Microsoft Edge or Chrome/Firefox. What wold you recommend? Reply PLSSS
Hell yeah! Kaspersky detects everything! (I use kaspersky and I never get virus's)
Do you have a tutorial on getting virtualbox working? It would be nice to have to open files that seem suspicious, but I can't get it to install windows 10 (it gets stuck on the windows logo, no circle, i'm waiting right now to see if it does anything, been frozen for the last 30 mins). A tutorial would be great.
Can avast protect from it?ect
Yes see the virustotal result
How do you even end up with that "Critical Windows Update" file? Does it just appear on your desktop if you accidentally download certain trojans?
good. I might add that working with midi is much much easier in soft.
5:30 "This is fine." I never have any useful files around.
I think I know why this ransomware is called fantom. In french, fantôme want to say Ghost. So, the developpers of this ransomware are probally french. And, idk if you noticed but there is Attention writed instead of Warning, so the theory is possible.
Hello your highness. How many problems were there in 2016 when it came to malware, ransomware, et cetera?
respond please. Is it safe to test a ransomware in Virtual Box ?
yes it safe, but you shouldn't create shared folders from your computer. It'll be better if you disable all types of connection form VM to your real machine.
Make sure you're immune to EternalBlue.
I'd imagine a senile grandma just sitting in front of a computer going all like "Yes, honey download me some of that sweet free mp3 download now.exe" or going on the interwebs and clicking onto that sweet "download more ram/cpu clock efficiency" button
I know. The update screen is way too wide and small.
Is this why people despise Windows Updates, as they might, but not really, screw your machine?
just to let everyone know the jigsaw decryptor can also fix the issue
_Hello, Brian, please, could you kindly give me a sample for this old ransom software, as i didn't find any?_ *I want to see how it works on each of windows versions virtual machines, please, help me with it, thank you for your help*
Luv These type of vids.... Keep Up The Good Work
#MakeInternetSafeAgain
DanPlayz Sk Lol was it safe?
if you have really important files, back it up with a usb port
Bro, could you help me to get the source code/sample of the Fantom?I want to test it on each windows virtual machines version and see what happens there...Thanks for your help, sorry, i am asking becsuse couldn't find this one anywhere
Basically this is something you’d only find online? Nothing to do with the updates you’d get from the “check for updates” section in Windows 10’s settings? Cause I’m not that stupid to download an updater for the OS knowing that just about all systems now do them in the settings section
There is a decryption code go into cmd and del system 32 it makes ur files decrypted and makes ur pc a bit faster too
Where can I get your TPSC desktop wallpaper?
That happened same to my mom's computer but I don't know if it's that virus cause when she updated it it made nothing functional. Then her desktop was black.
Yep... that's is the virus
Wait. People get this from the Internet? An ad? A phishing email? Shouldn't that immediately tell anybody not to install it? Well, I've gotten thousands of crapware toolbars in my day.
what if I format the OS drive and reinstall windows again?
can it encrpt a alreay encrpted file.
most of my important files are encrpted so only I can read them after I decode them.
Hey. Could you please make a video of your security setup? Like what all programs you use on your main device.
Fantom isn't bad spelling, it's just how is it spelled in lot of different languages.
simply phenonal
how about Avast vs windows defender
avast will win
because windows defender is poor program
Wouldn't you get a UAC notification before the file executes itself?
Because there you can actually check whether it's really Microsoft(using the certificate) or not, isn't that so?
What is your source to all of these ransomwares? I tested the main ones out like petya and satana but wanted to try some new ones.. Let me know!
+The PC Security Channel Will you make a video explaining HOW these are made? I don't mean show code or anything, I mean explain how these are made to look like very innocent update or file and turn into something that encrypts all of your files, and how they are spread out so much.
Will antivirus start to block some of these things once it knows about them?
So could you stop any ransom ware from encrypting your data if you quickly cut power, and live boot some Linux distribution, and then delete it while out of windows?
Good that you did that on VMware
I love your videos. Thanks! I have a nas attached to my computer. Would something like this encrypt those files as well? If so what can I do to block that from happening. I don't care about my pc files but I obviously care about my nas files. I do have them backed up to aws as a last resort. Thanks again for your time and help.
It is possible unless you are using it in read only mode. If you are not writing to it often you can make some folders write protected, that way they won't be affected.
Is there a solution my grandma got this so how to fix?
Its CTRL+ALT+DEL to popup the security menu ...
I have a error when I try to update something about missing files or something but other than that my pc runs fine
That version though... 3.2.1.0. Imagine zero being the word go. xD
Eh.I only update through Windows update in the settings or from Microsoft's website.
I thought is was a daily computer.... whew!
why would you ever update your windows 10 with extra file ??!!
hey man i like your vids, but your voice is a bit monotone :/
hmm.
Radam53142 I have that icon as my steam icon! XD
Radam53142 danooct1is monotone too
only rogue amp has enthusiasm or OSFirsttimer
deal with it boi
If you have a file saying Critical windows update just restart your computer if there is not a update delete the file it is fake
is updating with windows assistant something something safe?
Hey i have been getting adds for TOTALAV. Can u do a test on it?
If this was the Windows Update
So.....where can I get that awesome desktop background?....too cool!!!