--- title: Fake Windows Update is Ransomware Masquerade description: Fake Windows Update is Ransomware Masquerade image: https://ontimetech.valeonetworks.com/hubfs/Blog%20Images/Imported_Blog_Media/ThinkstockPhotos-586948442-1.jpg --- [Skip to the main content.](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#main-content) [![OTT powerd by VN big](https://ontimetech.valeonetworks.com/hs-fs/hubfs/OTT%20powerd%20by%20VN%20big.png?width=500&height=175&name=OTT%20powerd%20by%20VN%20big.png "OTT powerd by VN big")](https://ontimetech.valeonetworks.com) [![OTT powerd by VN big](https://ontimetech.valeonetworks.com/hs-fs/hubfs/OTT%20powerd%20by%20VN%20big.png?width=500&height=175&name=OTT%20powerd%20by%20VN%20big.png "OTT powerd by VN big")](https://ontimetech.valeonetworks.com) - [Services](https://ontimetech.valeonetworks.com/our-services/) - [Managed It Services](https://ontimetech.valeonetworks.com/our-services/managed-it/) - [Cybersecurity](https://ontimetech.valeonetworks.com/our-services/cybersecurity/) - [Cloud Solutions](https://ontimetech.valeonetworks.com/our-services/cloud-solutions/) - [Compliance](https://ontimetech.valeonetworks.com/our-services/compliance/) - [Industries](https://ontimetech.valeonetworks.com/industries/) - [Resources](https://ontimetech.valeonetworks.com/resources/) - [Blog](https://ontimetech.valeonetworks.com/blog) - [About](https://ontimetech.valeonetworks.com/about/) - [Client Testimonials](https://ontimetech.valeonetworks.com/testimonials/) [415-294-5250](tel:4152945250) [Client Portal](https://portal.Valeonetworks.com) Toggle Menu Toggle Menu [415-294-5250](tel:4152945250) [Client Portal](https://portal.Valeonetworks.com) - [Services *Toggle Menu*](https://ontimetech.valeonetworks.com/our-services/) - [Managed It Services](https://ontimetech.valeonetworks.com/our-services/managed-it/) - [Cybersecurity](https://ontimetech.valeonetworks.com/our-services/cybersecurity/) - [Cloud Solutions](https://ontimetech.valeonetworks.com/our-services/cloud-solutions/) - [Compliance](https://ontimetech.valeonetworks.com/our-services/compliance/) - [Industries](https://ontimetech.valeonetworks.com/industries/) - [Resources *Toggle Menu*](https://ontimetech.valeonetworks.com/resources/) - [Blog](https://ontimetech.valeonetworks.com/blog) - [About *Toggle Menu*](https://ontimetech.valeonetworks.com/about/) - [Client Testimonials](https://ontimetech.valeonetworks.com/testimonials/) - Example Link - Example Link - Example Link [*Facebook*](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#0) [*Instagram*](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#0) [*LinkedIn*](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#0) [*Twitter*](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#0) [*Youtube*](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#0) [*Medium*](https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade#0) 2 min read # Fake Windows Update is Ransomware Masquerade [Lance Stone](https://ontimetech.valeonetworks.com/blog/author/ulisticadmin) : Sep 12, 2016, 3:07:57 PM [Managed IT Services](https://ontimetech.valeonetworks.com/blog/tag/managed-it-services) Although it’s not a very well-written program, and it hasn’t been transmitted in spam email blasts, the Troj/Fantom-B (as it’s pegged by ransomware-blocker Sophos) or [Fantom ransomware](http://news.thewindowsclub.com/fantom-ransomware-windows-update-85879/) does, nevertheless, masquerade as a Windows 10 “critical” update, and will mess up your files and demand money from unwitting email users when it successfully fools recipients. It’s an all-too-familiar ransomware scenario, which may work in email users’ favor. ![ransomware](https://ontimetech.valeonetworks.com/hs-fs/hubfs/Blog%20Images/Imported_Blog_Media/ThinkstockPhotos-586948442-1.jpg?width=506&height=341&name=ThinkstockPhotos-586948442-1.jpg) The bad news is that this latest ransomware scam program works effectively if it gets past your computer security, or you inadvertently click on it. The fact that Fantom is obviously written by illiterate cyber crooks won’t matter once it gets into your device’s system. It was, unfortunately, written at least well enough for that. It *can* encrypt your data files soon after being unwittingly downloaded, but it’s the “pay page” that really shows the room-temperature IQ-levels of the hackers that threw this one together. Is [Fantom](http://www.darkreading.com/attacks-breaches/new-fantom-ransomware-poses-as-windows-update/d/d-id/1326774) evidence that the world of ransomware and hacking is opening up to lower levels of cybercriminal opportunists? They were able to write the malware program in [C#](https://en.wikipedia.org/wiki/C_Sharp_%28programming_language%29), which shows the Fantom authors’ lack of knowledge about programming or cryptography. Be sure your [email spam filters](http://www.winbuzzer.com/2016/09/02/microsoft-shuttering-smartscreen-email-spam-filter-xcxwbn/) are leveled-up, though, because Fantom may be lurking behind the requisite fake invoices and requests for a quotation, which are two very common and effective email fronts for ransomware assaults. **How Fantom Works** [Masquerading as a Microsoft critical update to Windows](http://news.softpedia.com/news/fantom-ransomware-mimics-windows-update-screen-507668.shtml), it sends you a .exe file, which is the first red flag. You see, critical Windows updates will NEVER be sent to you via an email attachment – and especially not without a digital, proprietary Microsoft signature, as Fantom lacks. If Fantom gets up and running on your device, you will see a box with two new processes, listing: 1) Critical update (32-bit), and 2) WindowsFormsApplication5. The [critical update](https://verdictforu.com/2016/09/05/beware-fantom-ransomware-poses-as-a-critical-windows-update/) file is the one that does the file scrambling while the secondary and oddly-named WindowsFormsApplication5 file is set into motion by the first one and used merely as a decoy. While the second one distracts you, the “critical update” runs through your files and renames them with the extension “.fantom” (as fast as the malware can get through your database). You will then see a somewhat legitimate-looking animated full-sized window with white lettering on a blue background that says: Configuring critical Windows Updates 1% complete Do not turn off your computer. If you are a quick hand, you can hit Ctrl-Alt-Esc and access the task manager, and from there terminate both ransomware processes. Some aren’t so fast, or aren’t aware of its presentation, and as a result end up getting a significant amount of their files screwed-up by this [fake Windows update](http://www.dabcc.com/warning-new-ransomware-disguised-as-windows-update-screen/). **Backed-up Files Fight Ransomware** Remember that the best way to fight the current [ransomware](http://www.zdnet.com/article/the-cost-of-ransomware-attacks-1-billion-this-year/) scourge is to have your data files completely backed-up on an external or off-site (cloud) storage. Along with that, *never* pay the ransom demands, but instead call a [managed IT services](https://www.ontimetech.com/services/current-it-provider/) provider immediately to have them walk you through the ransomware elimination. Not having one in the first place to guide you on the finer points of beating ransomware is likely why you became a ransomware victim in the first place. **Get Trusted IT Pros on the Job** If you have questions about getting ransomware-fighting [cybersecurity](https://www.ontimetech.com/blog/cybersecurity-services/) for your company network set up, {company} is the leader in providing managed IT services in {city}. Contact one of us today at {phone} or send us an email at {email}, and we will be happy to answer all your questions. - [Tweet](https://twitter.com/share) #### ![BusinessOwnerGuidetoM&A-1](https://ontimetech.valeonetworks.com/hs-fs/hubfs/BusinessOwnerGuidetoM%26A-1.png?width=303&height=209&name=BusinessOwnerGuidetoM%26A-1.png) #### Download our eBook*THE ULTIMATE ROADMAP TO CMMC COMPLIANCE* by filling out the form below! [![What’s Up with Windows 10 S Computers?](https://ontimetech.valeonetworks.com/hubfs/Blog%20Images/Imported_Blog_Media/ThinkstockPhotos-200423202-001-1.jpg)](https://ontimetech.valeonetworks.com/blog/whats-up-with-windows-10-s-computers) #### [What’s Up with Windows 10 S Computers?](https://ontimetech.valeonetworks.com/blog/whats-up-with-windows-10-s-computers) [Lance Stone](https://ontimetech.valeonetworks.com/blog/author/ulisticadmin) : May 16, 2018, 7:16:42 AM Where Did They Go? [Managed IT Services](https://ontimetech.valeonetworks.com/blog/tag/managed-it-services) [Read More](https://ontimetech.valeonetworks.com/blog/whats-up-with-windows-10-s-computers) [![Top Modern Confidence Crimes to Watch Out For](https://ontimetech.valeonetworks.com/hubfs/Blog%20Images/Imported_Blog_Media/ThinkstockPhotos-507473994.jpg)](https://ontimetech.valeonetworks.com/blog/top-modern-confidence-crimes-to-watch-out-for) #### [Top Modern Confidence Crimes to Watch Out For](https://ontimetech.valeonetworks.com/blog/top-modern-confidence-crimes-to-watch-out-for) [Lance Stone](https://ontimetech.valeonetworks.com/blog/author/ulisticadmin) : Sep 14, 2016, 12:19:39 PM We are all aware these days of how cautious one must be when it comes to electronic communications of any kind. Con-artists, or confidence artists... [Managed IT Services](https://ontimetech.valeonetworks.com/blog/tag/managed-it-services) [Read More](https://ontimetech.valeonetworks.com/blog/top-modern-confidence-crimes-to-watch-out-for) [![The New Windows 10 Release and the Features It Will Be Dropping](https://ontimetech.valeonetworks.com/hubfs/Blog%20Images/Imported_Blog_Media/GettyImages-871052724-1.jpg)](https://ontimetech.valeonetworks.com/blog/the-new-windows-10-release-and-the-features-it-will-be-dropping) #### [The New Windows 10 Release and the Features It Will Be Dropping](https://ontimetech.valeonetworks.com/blog/the-new-windows-10-release-and-the-features-it-will-be-dropping) [Lance Stone](https://ontimetech.valeonetworks.com/blog/author/lance-stone) : Sep 27, 2018, 1:31:00 PM Microsoft makes it clear that with each fresh release of Windows 10 there will be new features added – and some features that will be dropped. Here... [Managed IT Services](https://ontimetech.valeonetworks.com/blog/tag/managed-it-services) [Read More](https://ontimetech.valeonetworks.com/blog/the-new-windows-10-release-and-the-features-it-will-be-dropping) ![OTT White logo](https://ontimetech.valeonetworks.com/hs-fs/hubfs/VN%20-%20Division%20Logos/OTT%20Logo/OTT%20White%20logo.png?width=524&height=140&name=OTT%20White%20logo.png)   ##### About About On Time Tech is an IT Support and Computer Services company serving California. We provide services to the areas in and around We know businesses like yours need technology support in order to run highly-effective organizations. Leverage pro-growth technology services for your company now. ##### Explore On Time Time Explore On Time Time - [Our Services](https://ontimetech.valeonetworks.com/our-services/) - [Industries](https://ontimetech.valeonetworks.com/industries/) - [Resources](https://ontimetech.valeonetworks.com/resources/) - [About](https://ontimetech.valeonetworks.com/about/) - [Contact](https://ontimetech.valeonetworks.com/contact/) ##### Contact Contact **San Francisco:** 1717 Fifth Ave San Rafael, CA 94901 [415-294-5250](tel:4152945250) Business Hours: M-F: 8AM-9PM - [Privacy Policy](https://ontimetech.valeonetworks.com/privacy-policy/) © 2026 On Time Tech [*Facebook*](https://www.facebook.com/ontimetechsf/)[*Twitter*](https://twitter.com/on_time_tech?lang=en)[*LinkedIn*](https://www.linkedin.com/company/ontimetech/)[*YouTube*](https://www.youtube.com/channel/UCubqs9PU_WWF-RFhfK9xNpw) [![Alura White logo](https://ontimetech.valeonetworks.com/hs-fs/hubfs/VN%20-%20Division%20Logos/Alura%20White%20logo.png?width=295&height=115&name=Alura%20White%20logo.png)](https://alura.valeonetworks.com/) [![Next.I.T._White-Logo](https://ontimetech.valeonetworks.com/hs-fs/hubfs/Next.I.T._White-Logo.png?width=328&height=136&name=Next.I.T._White-Logo.png)](https://next-it.net/) [![White-OTT-Logo-1-768x253](https://ontimetech.valeonetworks.com/hs-fs/hubfs/White-OTT-Logo-1-768x253.png?width=313&height=103&name=White-OTT-Logo-1-768x253.png)](https://www.ontimetech.com/) [![Valeo-Logo-White (1)](https://ontimetech.valeonetworks.com/hs-fs/hubfs/Valeo-Logo-White%20(1).png?width=288&height=123&name=Valeo-Logo-White%20(1).png)](https://valeonetworks.com/) *Return to Top* ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Lance Stone", "url" : "https://ontimetech.valeonetworks.com/blog/author/ulisticadmin" }, "dateModified" : "2024-01-10T16:36:51.787Z", "datePublished" : "2016-09-12T19:07:57.000Z", "headline" : "Fake Windows Update is Ransomware Masquerade", "image" : [ "https://ontimetech.valeonetworks.com/hubfs/Blog%20Images/Imported_Blog_Media/ThinkstockPhotos-586948442-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://ontimetech.valeonetworks.com/blog/fake-windows-update-is-ransomware-masquerade", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://ontimetech.valeonetworks.com/hubfs/OTT%20-%20Color%20Logo.png" }, "name" : "Valeo Networks" } } ```