Terminating FUCKMEDADDY Ransomware (Crypto-Malware/Ransomware)

What is FUCKMEDADDY ransomware? And how does it execute its attack?

FUCKMEDADDY ransomware is a new variant of the infamous Jigsaw ransomware. This new variant was recently discovered in the second week of January 2018 and seems to be aimed at Polish-speaking users. It is known to use the name “DUPA” ransomware when it loads its ransom note. Once it is able to enter a targeted system, it will look for certain file extensions to encrypt. According to researchers, it may be files with the following extensions:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip.
FUCKMEDADDY ransomware is designed to encrypt files using a custom AES 256 encryption algorithm. Right after it finishes the encryption, it will append the .FUCKMEDADDY extension on every encrypted file. It then opens a program window named “FUCKMEDADDY” which shows an image of a nude woman pouring water on herself, it also contains the following ransom message:
“OOPS! YOUR FILES ARE ENCRYPTED BY DUPA RANSOMWARE !!!
Your documents, photos, videos etc … And after 72 hours, all your files will be removed permanently !!! But you do not have to worry about it it will happen only when you fuck up. Every hour I remove one randomly selected file and delete it permanently !!! I can not recover such a file even after payment !!! For the first 24 hours you will lose only a few files but the next day a few hundred, the third day there will be several thousand, etc … If you turn off the computer or try to shut me down it restarts automatically and I delete 1000 files permanently for trying to fuck with me!!! Remember that even the best anti-virus is unable to recover encrypted files! If you have any questions, please contact us via e-mail [email protected] !!! Payment for decrypting files is only possible in BITCOINS !!! If you do not know how to buy bitcoins, visit www.4coin.pl !!!
Now make a choice !!! pay and recover your files, or say goodbye to them”
FUCKMEDADDY ransomware deletes the shadow volume copies of the encrypted files to make sure that its victims won’t be able to use the System Recovery feature in Windows to recover their encrypted files. This does not mean that you should go ahead and pay the ransom though. Remember that paying the ransom does not really guarantee anything so you might end up losing money for nothing. All you can do for now is to terminate FUCKMEDADDY ransomware from your PC before it can do further damage. Once its removal is completed, you use whatever backup copies you have of your affected files until a free decryptor is released by security experts.
How does FUCKMEDADDY ransomware spread its malicious payload?
At the time of writing, FUCKMEDADDY ransomware is not being actively distributed yet. But according to researchers, it could spread through malicious spam email campaigns so you have to be careful when opening any email especially if it’s spam. Such email messages often pretend that they are from well-known companies and even make it look like it’s an urgent email to lure you in opening the email and downloading the malware-laden attachment. If you see this kind of email, you have to delete it right away.
Use the removal instructions provided below to terminate FUCKMEDADDY ransomware from your PC.
Step1. Open the Task Manager simply by tapping Ctrl + Shift + Esc keys on your keyboard.
Step2. Under the Task Manager, go to the Processes tab and look for any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to FUCKMEDADDY ransomware.

Step3. After that, close the Task Manager.
Step4. Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step5. Under the list of installed programs, look for FUCKMEDADDY ransomware or anything similar and then uninstall it.

Step6. Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step7. Navigate to the following locations below and look for FUCKMEDADDY ransomware’s malicious components such as Setup.exe, EncryptedFileList.txt, NotTextTest.nottxt, TxtTest.txt and TxtTest.txt.beep as well as other suspicious files and then delete all of them.

%TEMP%
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step8. Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step9. Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step10. Navigate to the following path:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE
HKCU\SOFTWARE\WOW6432Node

Step11. Delete the registry keys and sub-keys created by FUCKMEDADDY ransomware.
Step12. Close the Registry Editor and empty your Recycle Bin.
It is important to make sure that nothing is left behind and that FUCKMEDADDY ransomware is completely removed using the following antivirus program. To use it, refer to the instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.