Here's a question that has never been asked before: Wasn't Win 10 Windows Update already a malware?

@@malwaretestingfan well, with the standard settings it is, but in general it's a well made OS (except OOBE)

Well Yup the windows build 1892 Whatever Latest build it is is a Malware

Windows 7 Ultimate g e t  p r o t o g e n t

@@AngryDavid808 yeah it gave me  ransomware

@@teodortodorov6974 Why would you want an antivirus, they're the biggest scams. You're paying for a virus.

@@mr_meme7651 I'm not doing this thing from enderman

Technically, yes. It modifies the system.

@@jbk0 "in general it's a well made OS"

I disagree, Windows 7 was a lot better - than they ruined it with Windows 8. Windows 10 is an improvement on Windows 8, but Microsoft have now practically hacked your computer, and you cannot do anything without error sounds and pop-ups ruining your life.

I don't have any malware in my Windows 10, ha!

@@John-qi7wq Yeah you do. <b>Windows Update.</b>

@@John-qi7wq Yeah you do. *Windows Update.*

@@boteiro1436 Oh, we are talking about Windows 10 Updaye

Yes i was going back to Windows 8.1!!! Problem: Windows Update driver update

@@LynKazoyuu The bug has been fixed long time ago

Windows 7 was the best.<br>We got cheated cuz of windows 10 and the bugs are hopeless.

Windows 7 was the best.
We got cheated cuz of windows 10 and the bugs are hopeless.

@New Jetray C. i don't use windows 7 because it's not supported on my main pc, i still prefer it on my old ones because i don't browse the internet a lot with old computers so i should be safe

Probably, but this doesn’t require administrative permissions

@@namesurname4666 Windows will never be updated now. Thanks Microsoft.

@@mr_meme7651so just everything is a virus now


The fact that viruses like this don't require administrator privileges is shocking

In reality, it still needs them to destroy file backups (Shadow Copies, and that's why CryAkl / Fantom runs a batch file as Administrator).

JSGuider yeah it's very stupid. They always run with at least the permissions of the user executing them, so it can basically do everything the user can do on it's own. And if you give admin rights, it can basically do everything. If you have Windows 10, just make sure Windows Defender is on and activate ransomware protection and other stuff. Or install a reliable antivirus.

@@malwaretestingfan But can't it inject the execution into an admin process


Meanwhile: Windows Update takes 2 minutes

ransomware:


0:42 In a real Windows 10 update:
the background color is taken from your theme color (like with the "Shutting down" screen)
the "Configuring critical updates" text is under the rotary indicator (there's no piece of text above it, unlike the fake one here)
"Do not turn off your computer" text is at the very bottom of the screen and it's actually "Do not turn off or restart your computer".

Yes, but it also depends on your OS version

@@randomtechforyou its different when upgrading from windows 7 to windows 10 on version 1507

@@lilauxy yes. Windows 10 alone has different types of update screens depending on os version.


Ransomware: disguises itself as a Win10 critical update<br>Me: nvm i'm using windows 7

Ransomware: disguises itself as a Win10 critical update
Me: nvm i'm using windows 7

Ransomware: TRIGGERED
Also ransomware: Deletes itself

Ransomware: *TRIGGERED*
Also ransomware: *Deletes itself*


i literally had a dream of my PC getting infected with a fake windows update before watching this video.

@@santelite5935 Welp, hope that dosen't happen.

I had two dreams of my laptop getting baaad malware before watching this.

Regular people's dreams: flying
This guy's dreams: pc is infected with fake windows update
M Y  D R E A M S : virus escapes computer and kills me irl
(incase you're wondering, that's actually a dream I've had)

Regular people's dreams: *flying*
This guy's dreams: *pc is infected with fake windows update*
M Y  D R E A M S : *virus escapes computer and kills me irl*
(incase you're wondering, that's actually a dream I've had)

I once had a dream where my pc got 000.exe and i watched this guys vid but just before i was gonna watch it the dream ended

@@lzmc9707 I had a dream where siri killed my parents and sister and was coming after me next it was in a horror movie style

@KitsuneKat My dreams: Half of my laptop's screen is eaten by acid-puking bugs, yet it somehow still works.

My dream was me on my Computer with a red screen saying your files are encrypted. It even had the same thing for my phone. It wasn't too long for the dream to stop. But that, was the most fuckin' scariest dream. and this is REAL.

I once had a dream my pc got infected with wannacry
then my phone LOL
THEN MY TV LOOOL
THEN MY FAMILY'S PHONES AND PCS

@@ricotherock2383 I also had a dream of my PC getting infected with Petya a few months ago,with the whole CHKDSK and flashing skull thing but the text was yellow on blue instead of white on red and I somehow managed to decrypt before waking up xd


When you realise that you forgot to disconnect the network in the VM.

And one of your Shared Folders is the Desktop.

In video there aren't any games in Start menu.


"Getting a decryption of your files is <b>SIMPLY task."</b>

"Getting a decryption of your files is *SIMPLY task."*


Windows should show these to teach the little kids and old people.

and morons who thinks "The moniter is the PC isn't it?"

@@MarekParek68 now thats some true words

@@MarekParek68 In This Case If It Were An IMac They Were Right

@@d4wnnnn if it were an Imac and they would own it they would be morons anyway  even if they would be right

@@MarekParek68 owning an iMac makes you a moron? What's the logic behind that?

Yamanaga2009 me is a kid heheh

But I can type

@@fuantei7283 "Normal PCs" that is such a broad statement, so an old 2000s budget desktop is better than a modern 2020 Mac?

sadly because Microsoft want to be like apple

you need a 8th gen CPU

I feel Sad about the kids who don`t have windows 11 because Microsoft Lets down a Family

some news say GTA 6 will come out in 2025 when Windows 10 will stop giving you updates

@@d4wnnnn bro is speaking deltarune queen


Me: watches videos about ransomwares

my computer starts lagging a bit

Me: ( 　ﾟ,_ゝﾟ)

Me: watches videos about ransomwares

*my computer starts lagging a bit*

Me: ( 　ﾟ,_ゝﾟ)


Nobody:
Enderman: runs a ransomware on his host

Nobody:
Enderman: *runs a ransomware on his host*

That's a VM completely looking like his host

He’s running the Ransomware on a virtual machine

@@LimeGroupYT don't need to be toxic you can't just say he is stupid because he mistakes something

@@honbra your dumb if you think it's you're

@@sillyaioli He didn't call OP stupid, he just said Enderman isn't sthpid. In this case, YOU are the stupid one.

@@RayChu55 lol stop being toxic hahahahahshahhshaha

@@sillyaioli he says enderman isn't stupid because he uses a VM

@@RayChu55 my god, your is used to specify something from someone else "Can I get YOUR phone a bit?" And you're is you are.

@@puhbu Don't feed the trolls, despite what they say.


2:14
| This ransomware is practically impossible to decrypt. They used the EDA2 open source engine with a randomly generated key, using AES-128 algorithm.
Quantum computers: ok

AES128 is still secure with quantum computers.  It's the RSA component of the encryption that can be easily decrypted with a quantum computer that has enough bits.


In process of making this malware: Alright, we need to make a fake ID code, what should it be?
Someone: smashes his head on keyboard
That first guy: That will do!

In process of making this malware: Alright, we need to make a fake ID code, what should it be?
Someone: *smashes his head on keyboard*
That first guy: That will do!


Noob: Man this takes forever<br>Enderman: I just made a big mistake

Noob: Man this takes forever
Enderman: I just made a big mistake


YouTube: Enderman uploaded new video 15 seconds ago<br>Also YouTube: Published 5 days ago

YouTube: Enderman uploaded new video 15 seconds ago
Also YouTube: Published 5 days ago


No one

Literaly no one

Not even a single soul

Enderman: Micro$oft


0:42 The colour of the background is wrong! The real colour is less dull. Also, the "configuring Critical windows updates" is in a very unusual location. So I'd probably notice it.


I like the music <br>Megasphere - Emphatic Outcry

I like the music
Megasphere - Emphatic Outcry


Windows is updating....
Me: sees YouTube notification come
Me: clicks on it
Youtube opens
Me: but windows is updating.. How can youtube open
Me: okay lets watch youtube while it's updating
Me: finds this video and watches it
2 secs later
1:59
Me: uhhhh is this a video or is this real?

Windows is updating....
Me: sees YouTube notification come
Me: clicks on it
*Youtube opens*
Me: but windows is updating.. How can youtube open
Me: okay lets watch youtube while it's updating
Me: finds this video and watches it
2 secs later
1:59
Me: *uhhhh is this a video or is this real?*


Hey Ender, how much GD did you play? Cuz' it's always (or mostly) GD related music, just like this one.

@@blixer-experimentsandmore3444 hello blixar, i have destroyed u 5 Times in till it's over

He just uses GD songs whats wrong with that


Windows update: 4 minutes

Ransomware: 2726462 minutes until the PC crashes


tbh, this just sounds like a regular Windows 10 update. Complete with breaking your computer and you have to pay somebody money to fix it.

Windows 10 updates DON'T break your system, unless you are using an insider build. NEVER USE AN INSIDER BUILD.


"...[W]e got this nice background with an even better English."<br>That's ironic, because that sentence has a grammatical error. Actually, it's "[...]background with even better English." :P

"...[W]e got this nice background with an even better English."
That's ironic, because that sentence has a grammatical error. Actually, it's "[...]background with even better English." :P

@@Zhaxxy Hmm, maybe it is. I don't know...<br>I never conidered that when I was writing the comment.

@@Zhaxxy Hmm, maybe it is. I don't know...
I never conidered that when I was writing the comment.


Lol. Mail service "Yandex Ru" (2:03) requires phone number, and it gives infromation to police on demand. Using it for ransom - really stupid idea :D

@Bean Bean it doesn't matter. What will criminal do? Pay to the entire Ministry of the Interior?


"Hey, Why isnt your PC updated?"<br>"I dont know, The Windows Update ransоmware"

"Hey, Why isnt your PC updated?"
"I dont know, The Windows Update ransоmware"


It was 3 am and his perfect English had my dying


that reminds me of a virus i got a couple days ago it sneakily infected all of my files i had to get a recovery usb and reinstall windows


ender server when

also ender using hard style music, cool


More Windows experiments??? Was subscribed for that mainly, but this is interesting malware nonetheless.


Well, that was quite a smart move to show Win Update screen, so that the victim most likely would not turn off the PC and interrupt file encryption process 😂 and OMG russian email and great spelling 😂 that’s quite funny


I SHOULD GET BACK INSIDE THE THOMAS FANBASE


at least he told you to make sure this doesnt happen again


Mine too. A new windows update came out a couple days ago

Lol Yesterday Microsoft relased a new Windows version and the next hour they noticed that there was a security problem in the system and they relased another update 😂

Sorry for my bad english

Same, i did read about another wormable vulnerability that Microsoft had to patch. I see that NotPetya gave Microsoft a lesson.

@@malwaretestingfan i'd say wannacry did a better job at "giving microsoft a lesson" but notpetya definitely taught them not to be so fuckin stupid

jokes on y'all i have windows update disabled from services LOLLL


the Windows 10 update screen is a screen saver program. so, all these malware creators are going through unnecessary effort when they just could write a specific string table and attach the code to the screensaver.


0:38: Microsoft never puts text above the loading symbol :/ Also, the blue is too dark :( That's how to tell


on a vm i downloaded the ransomware and managed to fix it<br>You have to boot as system user and give administrator cmd and also taskmanager back, Then you have to taskkill the ransomware, then use a online decrypter to decrypt it, IT WORKS

on a vm i downloaded the ransomware and managed to fix it
You have to boot as system user and give administrator cmd and also taskmanager back, Then you have to taskkill the ransomware, then use a online decrypter to decrypt it, IT WORKS


nice video enderman! on your website you cant download any software. also enderman.ch is for sale

@@luihum1287 I know i was saying enderman.ch is for sale and on malwat.ch you can't download stuff from the software section

@@luihum1287 I can't download from the site.

@@luihum1287 I've noticed after a while. Too bad, i've always wanted the Enderman OS's ISO.


me realizing yesterday my computer wanted to update


Malwarebytes scans my computer every day and destroys viruses


Btw, that background (before encryption!) Is cute! Where's it from? It reminds me of Marnie. (From pokemon sword)

That's Tohsaka Rin from Fate/Stay Night UBW

@@witodjeremiaszdon yeah, good luck finding that picture in stay night because It's from UBW's prologue episode

@@witodjeremiaszdon  And Fate Have so many MANY AND MANYYYYYYYYYYYYY Seasons... ´-´ and movies

@@hat.2106 I know, I`ve seen them all, but I not seen fate aproucha.


it is even more sad  because this ransonware was created in 2017 and it is still unremovable...


There are videos that state that the Ransomware software can be 'temporarily' removed using Windows' safe mode - 'This method can prevent encrypted data being deleted'


what if you click "no" on the shadow deletion, will shadow copies still exist from potentially before encryption

its quiet. It does it on its own, and clicks yes on its own. From the looks of the script however I may be wrong...

Yep, the problem is that the user will be easily lured into clicking that UAC.

@@UlzYT actully to execute that command you need to have admin privileges. As ransomware dont prompt for administrator privileges it cannot run this bat to delete shadow copy. If you click no, the bat will not do its thing. If ransom.exe asked first for admin privileges it could start bat in bg as a child process. But it will not be as deadly as without prompt at start

@@malwaretestingfan if they see the background saying they've been encrypted, they wont


Finally I have an excuse to not update my computer!


Good Job Endermanch Keep this up Your The greatest Youtuber


I swear he already covered this (or was it flytech)


It's the first time i see Enderman being unable to counter a ransomware


Big respect for this man for using his host for the unstoppable ransomware, a good waste of 100$+

He used a VM decorated like his Desktop.


this is old, tspc already did this, but it’s  nice to see your take on this


Enderman, you EVER will have my like in ALL your videos


What is you pull the plug on different viruses while it's preparing the payload? Could you save the pc that way? (Pull the plug as in unplugging the computer, but on your vm then whatever instantly shuts it down while letting you get it back up.)


AES is my kindergarten that shutdown a couple years ‘go

??<br>AES256 is the standard encryption used in HTTPS and pretty much everyone uses it because of how secure it is.

??
AES256 is the standard encryption used in HTTPS and pretty much everyone uses it because of how secure it is.


So... How do you remove this? Making the payment only? <br>I'm new sub btw, loving this channel.

So... How do you remove this? Making the payment only?
I'm new sub btw, loving this channel.

When it comes to ransomware, the last thing you should do is paying. It's most likely a scam.

@@tasouganenonihilai362 Correct. Many ransomwares have deceased e-mail addresses even.

When my dad got attacked my ransomware all he did was install a thing and only the apps were still encrypted

@@MESYETI it depends by encryption types, some of them are decryptable, some are not


This is as horrifying as coronavirus.

Wonder if Linux can get caught by ransomware.


You opened the Ramsomware on your real machine? Or it is a copy?


Imagine if window recommend this ransomware lol


Nobody:

Not even a single soul:

Ha! Did You Think I Was Gonna Do Those? Nope. They Suck.


I really like your desktop (could you please send me a link of the background in the beggining? :D)


How to delete Segoe UI from Windows 10, or replace it with another font?<br>To clarify: Standard uninstalling (by registry), and removing the file from the actual Fonts folder will uninstall the font in GDI processes, however the Windows 10 interface still uses Segoe UI. This is CREEPY! Have a solution?

How to delete Segoe UI from Windows 10, or replace it with another font?
To clarify: Standard uninstalling (by registry), and removing the file from the actual Fonts folder will uninstall the font in GDI processes, however the Windows 10 interface still uses Segoe UI. This is CREEPY! Have a solution?


"Updating Windows"
Later...
Windows Update: AlL YoUr FiLeS ArE EnCrYpTeD!!!

*"Updating Windows"*
Later...
Windows Update: AlL YoUr FiLeS ArE EnCrYpTeD!!!


lets assemble a team to remove this ransomware and decrypt it


0:37 Windows 10 Update Ransomware Starts


I just have one question.

Make your upgrades and close your security opens or karma's gonna come collect your debt to you didn't pay to Windows 10.

I just have one question.

*Make your upgrades and close your security opens or karma's gonna come collect your debt to you didn't pay to Windows 10.*


How do you do the background with the  time, date, and cpu and stuff?

I know this comment is 1 y/o but if u are still looking for it then it's rainmeter


Everybody gangsta till you see ENCRIPTED


i already got infected by that, i lost pratically all my files.


Youtuber talks about viruses: yes this is very dangerous and very harmful to your pc.<br>Also them: there's a link on the description so you can download it.

Youtuber talks about viruses: yes this is very dangerous and very harmful to your pc.
Also them: there's a link on the description so you can download it.


i know this is off topic but that song is one of my favourites<br>do you play geometry dash or something? tons of the songs you seem to be using are songs ive heard in gd

i know this is off topic but that song is one of my favourites
do you play geometry dash or something? tons of the songs you seem to be using are songs ive heard in gd


He is turkish, not russian. I've just found his ticket to mail support. Although, it was 3 years ago.


Much cooler if you call you're self Widows EnderMan


witch is better for you vmware or virtualbox??

vmware is paid and virtualbox is free so probably vmware but i use virtualbox because its FREE


you have anime wallpapers on your desktop, do you love them!?!??!


Also, how it deletes the Shadow Copies without Administrator rights? Is that batch file launched as Administrator separately?

The UAC for it pops up at 1:17. You could Deny it.


@@jocurigratispegoogle9963 oh, I saw no VM's control panel there so I assumed that


minecraft enderman getting killed by viruses


Quite an interesting solution for ransomware)


Fantom / CryAkl? It's some time i don't hear that name.

Black Hat u beat me to it i guess i also mentioned tspc did something about this too


me: watching this vid <br>also me: hacking a minecraft server

me: watching this vid
also me: hacking a minecraft server


Every one and their cat got this message.


When you are good at coding<br>But succ ingslish

When you are good at coding
But succ ingslish


Having 6 year old computer with 10 KB/s disk read-write 10 Mhz CPU<br>The ransomware is highly noticeable

Having 6 year old computer with 10 KB/s disk read-write 10 Mhz CPU
The ransomware is highly noticeable


Let's make a better version of such a virus! It did not encrypt files, but displayed indefinitely that an update was in progress


Bisector times the ratio of the mathematics unit squared perpendicular


Actually I am now making that same type of ransomware but many problems and bugs are like fucking glue...


How did he make that it doesn't need any elevation


WHY DO I ALWAYS HAVE TO MISS  IT?!?!!?!!??


Please try an experiment in which you try to defragment a SSD.

It will just destroy your SSD. Pointless


I would like to see how much it costs to restore the data. On my PC I have only games, I don't have anything I really care about. If everything gets encrypted I would just make a new windows installation and reinstall the games


0:38 s l o w     l o a d i n g       s c r e e n
0:38
0:38
0:38
0:38 WHY


Where did you get those widgets in the bottom left corner?


dear enderman, is there a possible way to change the exit button, minimize buttons, etc theme on win 10. i wanna make those buttons look like windows 8 version


So what if you say no to the administrative privileges prompt for the batch file?


u could just say no to the cmd when u saw the desktop lol


Hello, Enderman, how did you get these widgets on desktop?


Hey can I have your VM's task manager widget?


Which CPU do u use such that ur pc can survive and didn't crash cuz of cpu heat.


He just commit dead on his computer.  MAN WHATS YOUR PROBLEM?

Edit:  Oh, I thought that it was his main computer because  there was VMware Workstation along with the widgets.  Nevermind, nevermind..


do you have an idea how can i delete some files that cant be deleted ? i tried cmd with administrator with that c /d etc doesnt work and its says ACCES DENIED helpp

Well deleting those files would probably wreck your system as they are probably undeletable for a reason so you should probably leave them alone.


how to remove the ransomware? reinstall windows


"ALL DECRYPTION PASSWORDS, for what wasn't we receive reward, will destroy after week of moment of encryption." "That means > RESTORE YOU DATA POSSIBLE ONLY BUYING decryption passwords from us." Grammar A+!


How does it spread?

Does it use something like the MS17-010 exploit?


2:05 Important: Do not restore files without our help, this is useless, and can destroy you data permanently.

Me: Hmm, I tought restoring files is good... And also, why is this english so broken??


wait couldn’t you just press no and It wouldn’t continue to work?


His computer specifications are very much the specifications that you'd see in gaming computers.


what is that background <br>can i get a link for it or

what is that background
can i get a link for it or


i mean, windows 10 is already destroyed anyway hahaha..


Windows Setup you
Click here to balloon

Windows Explorer


How Are You Going To Remove The Fantom Wallpaper?


Full privileges this man didnt he need to make it as its deffult so we dont need to click the button


1:32 but its not better english
Wrong Spelled Name "Encripted!!!"

1:32 *but its not better english*
Wrong Spelled Name "Encripted!!!"


Question: why are you called enderman? Just curious not mocking or anything.


Which one is better for testing: VMWARE or VirtualBox?I mean testing malware.


How Does This Not Require Administrative Permissions


i no how to get your files back delete the files that is in the ransomware and then rename your files<br>to .txt not your file name .txt.fantom and reboot

i no how to get your files back delete the files that is in the ransomware and then rename your files
to .txt not your file name .txt.fantom and reboot


就我一个是从bilibili上来的？

就我一个是从bilibili上来的？


Question: should i update my computer at all now?!?!?


Andrew, if you don't mind, share the html and wallpaper plz?


It's host PC because VMvare workstation is in desktop? I use VMware Workstation 12


Сонга из гд в начале, признавайся?)

Сонга из гд в начале, признавайся?)

@@user-xn8lz1wn2p MegaSphere - Emphatic Outcry


Was Windows Update Less A Kind Of Malware Or At Least Complicated That He Made This Ransomeware Too??😤


This might is not a VM I use VMware 12 due my professor does not support Intel Vt X and it's old and can't handle Pro 14 and pro 15


i doubt that his english is writen by man (mine isn't perfect too but at least basics are understandable) its probalbly result of some translator....


1:59
This once happened to me, mostly. When all classmates judged me for bad English score. Although I didn't give a fvck, and now I've been practicing speaking and speech, though it is not my native language.
Maybe, would you like to be a grammar nazi for that russian?

It took me 3 years to learn English from videogames


You can tell it is a fake Windows update because it actually sounds reasonable 😂😂🤣🤣


Plz give me download link of your wallpaper


Send the virus to TPSC. He can find a way to decrypt the files.

He litreally made a video onit and said it's impossible to decrypt.


I know how to exit just press Windows Button + T to open taskbar it even force open even an app is using fullscreen if it work it FAKE UPDATE


Why did you run the virus on your host. You have to reinstall your Os now.

its not on the host. if it was youd see an recording program (OBS, fraps, etc) on the hotbar to show its open and,thus, being used. so a VM is being used


He's probably using a VM or some kind of sandbox where it is isolated

It will be a complete mess if you try this on a real machine :)


Rollos me on me in discord for malwares!!!!! For porsess hacker


thats why i disabled windows update i haven't updated for  9 monhts but i started thinking about turning it back on since the new trial verision was released for windows 10 pro users


I watch Enderman so much than Siam Alan because Siam is worse


666 лайков...

666 лайков...


Actually they did update the system...

By making it worse...


“Critical windows updates” That’s 200% fake because Microsoft never makes that kind of update screens.


The creator of the ransom is just an idiot. He don't know English lmao.


you know what
fuck you
Windows Downgrade


yo why tf do all of these russians have bad english


Just delete that ransomware from the command promp and you'l be ok


It should have been named get_fucked.exe


umm just add redl in brackets because people aren't understanding you.