Werd File Extension Virus - How to remove

Werd is a new Djvu ransomware virus that attacks Windows computers and locks user files, like photos, documents, spreadsheets, and just about everything. Werd is named so because the locked files have “.werd” appended to their name. Werd is dangerous and can result in the victim losing all the encrypted files.

Werd comes after Nols, Leto, and a long line of other Djvu ransomware. These infections spread in pirated files, cracks, keygens, activated software, infected files uploaded on fake websites, and in similar circumstances. Werd might also install a spyware trojan (Azorult) that can steal passwords and other private data and even download more malware. Make sure to remove that and secure your computer with good antivirus software, dutifully scan every downloaded file, update your OS and antivirus – most importantly, keep a backup of your files.

The Werd virus is characterized by the “.werd” file type of the locked files, as well as the “_readme.txt” ransom notes placed in multiple folders. In these notes, Werd’s authors (who aren’t identified besides their email addresses [email protected] and [email protected]) claim that they’ll decrypt (fix) the files for either $490 or $980, which is prohibitively expensive for most of their victims – students, children, etc. (it’s not usually rich people who resort to piracy).

Werd is a serious virus and needs to be removed as soon as possible before you can recover your files:

Type of threat	Ransomware Spyware trojan
Werd symptoms	Files have the “.werd” suffix in their names A fake Windows Update pop-up might show up during the encryption process “_readme.txt” files are created in many folders Some cybersecurity websites aren’t accessible from the infected computer
Remove the Werd infection	Fix the hosts file Download antivirus tools (like SpyHunter) Remove Werd and other malware Change passwords of online accounts
Restore the files locked by Werd	Restore from backup Try the free decryptor Recover the files using system restore, shadow volume copies, and/or data recovery

Can Werd files be recovered

If you didn’t keep copies of your files on some separate storage device, a backup, then Werd is a problem. There might be some ways to get your files back, or at least some of them, but there’s no guaranteed solution.

There exist a free decryptor for some Djvu infections and it can decrypt files for Masodas, Mogranos, and other older variants. But Werd is a newer example and the extortionists have changed how their ransomware works since then.

Werd and related ransomware viruses encrypt data in order to make it inaccessible. It’s like corrupting your files, it looks like their internal bits have been scrambled.  But it can be reversed with the correct decryption key. Werd’s each victim has one or multiple encryption keys (Werd runs multiple times on most computers), and each of those has a matching decryption key that’s kept on the criminals’ server. There’s no way to know it unless the extortionists release them voluntarily or law enforcement catches these people. This is why asymmetric cryptography is so useful – and so destructive when it’s misused for evil.

There’s an exception – if the Werd virus is forced to run while it can’t contact the server of its creators (like if your internet is gone) and is forced to use the offline key. If any of your files were encrypted by Werd running offline (and it might just be a portion of all your files), then there is hope that Emsisoft’s decryptor can decode them. Otherwise, you’ll probably need to use other ways to recover your data.

At the bottom of this article, there are some common methods for recovering lost data that might work, so make sure to check them out. Data recovery and shadow volume copies have helped a few Djvu victims before.

You might be curious about paying the ransom. If you have the money, should you do it? The answer is mostly no, but not just because it rewards criminal behavior (in fact, consider letting law enforcement in your country know about this attack). There’s also the fact that only just over half of ransomware victims who pay the ransom get their files back. Some people did successfully decrypt their files after paying Werd’s creators, others had their money stolen or were sent bogus decrypters, and there’s no way to get a refund. Then there’s the fact that their tool is very user-unfriendly, so any technical hiccup, like multiple ransomware attacks, multiple keys, etc. can corrupt your files even further if you’re not careful. So, it’s up to you, but remember that paying is no guarantee that you’ll get your files back.

How to remove Werd

Before recovering the files, it’s good to remove the Werd ransomware infection so that it can’t re-encrypt your data. This might be difficult as your antivirus program might have important files deleted and cybersecurity websites might be blocked from loading on your computer. The fix for that is below, and, with the help of a competent antivirus tool and safe mode, you can remove malware from your PC and proceed to recover your data.

Check what your antivirus program finds – if the password stealer was found, be sure, after your PC is clean, to change the passwords of your online accounts and enable 2-step verification wherever it’s possible. You probably don’t want to go through all of this just to have some accounts hacked and your credit cards stolen. Ultimately, this is about money and these criminals won’t miss an opportunity to steal some.

Important -- edit the hosts file to unblock security websites

TL DR : The hosts file is edited to block security sites Before the virus can be removed, it's necessary to fix the hosts file (the file which controls which addresses connect to which IPs). That is the reason the majority of security websites is inaccessible when infected with this particular parasite. This infection edits this file to stop certain websites, including anti-malware download sites, from being accessed from the infected computer, making browsers return the "This site can't be reached" error. Luckily, it's trivial to fix the file and remove the edits that were made to it.

Find and edit the hosts file

The hosts file can be found on C:/Windows/System32/Drivers/etc/hosts. If you don't see it, change the settings to see hidden files.

1. In the Start Menu, search for Control Panel.
2. In the Control Panel, find Appearance and Personalization.
3. Select Folder Options.
4. Open the View tab.
5. Open Advanced settings.
6. Select "Show hidden files...".
7. Select OK.

Open this file with administrator privileges.

1. Open the Start Menu and enter "notepad".
2. When Notepad shows up in the result, right-click on it.
3. In the menu, choose "Run as administrator"
4. File->Open and browse for the hosts file.

The hosts file should look like this: Delete additional lines that they connect various domain names to the wrong IP address. Save the file.

Download and run the antivirus program

After that, download antivirus programs and use them to remove the ransomware, the trojan, and other malware. Spyhunter (https://www.2-viruses.com/reviews/spyhunter/dwnld/).

Automatic Malware removal tools

How to recover Werd File Extension Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Werd File Extension Virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Werd File Extension Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Werd File Extension Virus. You can check other tools here.  

Step 3. Restore Werd File Extension Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Werd File Extension Virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Werd File Extension Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.