FUCKaNDrUN Ransomware

No one ever wants to have the likes of FUCKaNDrUN Ransomware on their computers, but malware doesn’t care about what you want. Malware employs various distribution measures, and some of them even trick users into downloading and installing such infections themselves. Although it is not that problematic to remove FUCKaNDrUN Ransomware from the infected system on your own, we have to remember that recovering the encrypted files could be quite challenging. Therefore, we have to do everything in our power to stop these dangerous threats from slithering into our systems.

Our research shows that FUCKaNDrUN Ransomware belongs to the Hidden Tear Ransomware group. This group encompasses tons of similar infections that are all based on the same open-source code. It means that the main framework for this ransomware is available for public (you need to know how to get to it, though), and once someone gets a hold of this code, they can modify it based on what they need from a ransomware infection. Consequently, this results in a plethora of semi-unique ransomware programs that all work in a similar fashion, but they have nothing in common. Thus, we can say that FUCKaNDrUN Ransomware is related to PTP Ransomware, Facebook Ransomware, Poop Ransomware, and many others. However, if the previously released infections had decryption keys, they won’t work on FUCKaNDrUN Ransomware.

How does this infection manage to enter our systems? Well, ransomware developers are really good at using spam email for malware distribution. Spam emails often come with urgent messages that tell you to open the received files at once. If you weren’t expecting an email from unfamiliar senders (who does?), you should definitely check whether the file is safe or not. The best way to deal with a spam email is to remove it. If by any chance, you think that the file might be important, you can download it and SCAN it with a security tool of your choice before opening it.

However, you have clearly forgotten to scan the file you downloaded, and now you have FUCKaNDrUN Ransomware on board. When this program enters target systems, it launches the file encryption, and adds the “.FUCKaNDrUN” extension to every single affected file. This ransomware affects the most common types of files, so it is very likely that your audio, video, document files, and other important data will be encrypted. Not to mention that FUCKaNDrUN Ransomware encrypts all folders in the %USERPROFILE% directory, which is where most of the users keep their files.

Once the encryption is complete, this infection drops a ransom note on your desktop, and here’s what the note says:

If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. All you need to do is submit the payment and purchase the decryption key.

Further on, FUCKaNDrUN Ransomware asks you to pay $300 in Bitcoin for the decryption key and then transfer the payment to the given Bitcoint wallet address. Needless to say, you should never transfer the payment because this way you would only help these criminals achieve their goals. Also, we have found that the control and command center for this infection is not online anymore. Thus, it is possible that the criminals can no longer check every single infection. In other words, there might be no way to get a decryption key even if you do pay the ransom, so that’s not the course of action you should take.

You must remove FUCKaNDrUN Ransomware today, and the best way to do that is to employ a powerful antispyware application that will help you delete everything once and for all. If you have copies of your files saved someplace else, you can easily delete the encrypted files and transfer the healthy ones back into your system. On the other hand, it might also be that your files are lost forever. If that happens, do not panic. Just consider this a lesson, and protect your system from similar intruders in the future.

How to Delete FUCKaNDrUN Ransomware

1. Remove the READ_IT.txt file from Desktop.
2. Open the Downloads folder and delete the most recent files.
3. Press Win+R and enter %TEMP%. Press OK.
4. Delete the most recent files from the directory.
5. Use SpyHunter to run a full system scan.