Wcry virus - How to remove

Wcry is the new name which will be associated with a ransomware virus. From the looks of this infection, its creators did not incorporate astonishing or grasping features that would be considered as major, but they selected to proceed with a rather routine strategy to disrupt people’s lives. Wcry virus is explained to provoke and threaten victims with AES-128 cipher for encryption. During the process of encoding, this algorithm generates two keys. One of them is public, responsible for decent encryption, and the other one should be ready to decrypt files and return them to the original state. However, the latter one is private and hackers are to take a good care of it in their secretive servers. Playing with this powerful card, hackers are eager to make demands for money and require for people to abide by these rules without any objections or hesitation. For the sake of turning this situation into even more stressful, hackers put a clock to it: victims are supposed to decide on their course of action in 5-6 days. If they decide to wait it out and see what happens then, they will come to realize that the price for decryption has been doubled. Instead of requiring 0.1 BTC as the ransom, hackers will require 0.2 BTC. Developers that managed to construct Wcry should not be paid for their criminal activity: instead of that, be sure to react to their vile nature rationally. An advised way to react is to contact reliable security researchers and find out their opinion on this issue.

The performance of Wcry virus

So, your files have been encrypted by Wcry crypto-virus. How was this result reached? What hoaxes and mischiefs did the ransomware had to initiate to triumph? Well, it had to conduct a series of actions that would later on be finished of with the display of the ransom note. Wcry virus achieves great results when it sets its mind on a goal, and first of all, it is concerned with distribution. If a malicious spam campaign exceeded or met expectations, then, ransomware can move on to the further procedures that have to implemented. One of them is the modification of Windows Registry Keys, revealing that Wcry virus will persistently reach for a position from which it could be automatically launched every time the infected operating system is loaded. Variant also contacts its C&C server to give information about the unfortunate victim.

As the latter modifications reach a culmination, ransomware is going to be occupied with a couple of major processes. Firstly, Wcry virus will have to thoroughly review the data you store in your hard drive and determine which files should be encrypted. Since the ransomware finds over 150 file types compatible, we are sure that it will be able to detect some matches to its profile. After the data is selected, Wcry virus can finally advance with encryption. AES-128 cipher is set to tamper with your files: as soon as the encoding is accomplished, you won’t be able to run them. Instead, Wcry virus will display a window with the necessary information, implying that the files that are appended with .wcry extension are to be returned to their owner if he/she humbly turns over the requested bitcoins.

Wcry virus ruins your files: what about decryption?

Currently, there is no officially released tool that would guarantee 100% file-recovery. This should not encourage you to pay the demanded ransom as there are other methods you can try to restore your data. One of them is to check whether Wcry virus destroys Shadow Volume Copies. If not, you might be able to use this detail to your advantage. Another possibility to consider is the fact that some universal tools could work and restore the encrypted files. If you have your files stored in backup storages, then this situation can be sorted out extremely quickly: all you have to do is download files from such a facility. For future reference, please remember to store your files in backup storages as they will come in handy in case of a ransomware infection.

Sources of Wcry virus

Surprisingly, personal email accounts are one of the places that ransomware viruses thrive. Malicious spam campaigns are initiated every day and millions of people receive such fake letters in their inboxes. Without realizing it, they might jeopardize their entire system simply by opening an email and downloading an evil executable. Always double check that the sender is reliable and the message does not feature any unlogical statements that clearly do not apply to you. NEVER download attachments if you are not 100% sure that the sender meant well with it. If you happen to invite a Microsoft Word document which requires you to activate macros in the document, you should not agree with these terms immediately. In fact, such file should not have been downloaded at all.

Spyhunter or Malwarebytes will treat your device with respect and reveal its status without any agendas. If you are infected with Wcry virus, it will show exactly that. Additional explanations about removal of this virus and decryption of files are discussed in the following section.

How to recover Wcry virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Wcry ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Wcry virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Wcry ransomware. You can check other tools here.  

Step 3. Restore Wcry virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Wcry ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Wcry virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.