Security specialists uncovered a new version of Wana Decrypt0r 2.0 ransomware virus which is derived from the WannaCry ransomware. It encrypts user data and marks it with the .WNCRY extension. Wana Decrypt0r 2.0 is also known as WannaCrypt0r 2.0. You can remove Wana Decrypt0r 2.0 ransomware virus via:
Manual Removal Guide
Recover Encrypted Files
Skip all steps and download anti-malware tool that will safely scan and clean your PC.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
The Wana Decrypt0r 2.0 Ransomware Virus Impact on an Infected PC
The dangerous Wana Decrypt0r 2.0 virus is a strain of the WannaCry family. Its samples are being delivered in different infection campaigns. It is an advanced crypto virus that seeks to process user data and induce various damage to the infected computers.
When the Wana Decrypt0r 2.0 virus is installed on the victim host it starts to execute its buit-in commands. The first one is to create a persistent environment. The malware engine of the Wana Decrypt0r 2.0 virus modifies the Windows autorun and registry settings. The ransomware monitors the user and installed applications for any changes that can affect the virus. Such measures prevent the victims from manually removing the threat themselves. Effectively Wana Decrypt0r removal can be done only by using a quality anti-spyware solution.
Similar Viruses: CryptoDevil ransomware virus
It also reports the virus to the criminal operators and their C&C servers. After this is complete, Wana Decrypt0r 2.0 virus starts to encrypt user data based on a predefined file type extensions list. We suspect that it remains relatively unchanged from its parent- the WannaCry ransomware virus. The following extensions are processed:
123, .3dm, .3ds, .3g2, .3gp, .602, .7z, .aes, .ai, .ARC, .asc, .asf, .asp, .avi, .backup, .bak, .bmp, .brd, .c, .cgm, .class,
.cpp, .crt, .cs, .csr, .csv, .db, .dbf, .dch, .dif, .dip, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .edb, .eml, .fla, .flv,
.frm, .gif, .gpg, .gz, .hwp, .ibd, .jar, .java, .jpeg, .jpg, .js, .jsp, .key, .lay, .lay6, .ldf, .m3u, .m4u, .max, .mdb, .mdf, .mid, .mkv,
.mml, .mov, .mp3, .mp4, .mpeg, .mpg, .msg, .myd, .myi, .n, .nef, .odb, .odg, .odp, .ods, .odt, .ost, .otg, .otp, .ots, .ott, .p12, .PAQ,
.pas, .pdf, .pem, .php, .pl, .png, .pot, .potm, .potx, .ppam, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .psd, .pst, .rar, .raw, .rb, .rtf,
.sch, .sh, .sin, .slk, .sql, .sqlite3, .sqlitedb, .stc, .std, .stw, .suo, .swf, .sxc, .sxd, .sxm, .sxw, .tar, .tarbz2, .tbk, .tgz, .tif,
.tiff, .txt, .uop, .uot, .vb, .vdi, .vmdk, .vmx, .vob, .vsd, .vsdx, .wav, .wb2, .wk1, .wks, .wma, .wmv, .xlc, .xlm, .xls, .xlsb, .xlsm,
.xlsx, .xlt, .xltm, .xltx, .xlw, .zip
All affected data is renamed with the .WNCRY file extension. The ransomware note is displayed with a lockscreen which prevents ordinary user interaction until it is completely removed. It reads the following message:
Ooops, your files have been encrypted!
What Happened to My Computer?
Your important files are encrypted.
Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption engine.Can I Recover My Files?
Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time. You can decrypt some of your for free. Try now by clicking. But if you want to decrypt all your files, you need to pay. You only have 3 days to submit the payment. After that the price will be doubled. Also, if you don’t pay in 7 days, you won’t be able to recover your files forever. We will have free events for users who are so poor that they couldn’t pay in 6 months. How Do I Pay?
Payment is accepted in Bitcoin only. For more information click
. Please check the current price of Bitcoin and buy some bitcoins. For more information click . And send the correct amount to the address specified in this window.
After your payment click. Best time to check: 9:00am – 11:00am GMT.
This version includes a secondary ransomware note. If the lockscreen is obstructed or removed then a secondary backup note is displayed. It reads the following message:
Ooops, your important files are encrypted.
If you see this text, but don’t see the “Wana Decrypt0r” window,
then your antivirus removed the decrypt software or you deleted
it from your computer.If you need your files you have to run the decrypt software.
Please find an application file named “@[email protected]” in
any folder or restore from the antivirus quarantine.Run and follow the instructions!
The computer hackers behind the Wana Decrypt0r 2.0 ransomware virus use some popular social engineering tricks to make the victims pay the specified fee. The criminals specify a sum in US Dollars in order not to confuse the users. They still need to send the amount in the Bitcoin digital currency. Instructions and support are provided. Several time limits are introduced – if the victims do not pay the sum in several hours then the sum is doubled. The hackers also specify a final limit. If until then the money is still not sent then private key are deleted from the remote servers. To win the victims trust the criminals also provide a trial decryption.
Depending on the hacker configuration the Wana Decrypt0r 2.0 ransomware virus samples can also delete the found shadow volume copies. This renders data recovery possible only via professional grade software. It is possible that future iterations can include additional features.
We suspect that updates of the Wana Decrypt0r 2.0 ransomware virus can cause further damage to the system. The virus engine can modify essential Microsoft Windows settings that can disable functionality or make certain applications and services stop working altogether. In the majority of cases complex malware such as the Wana Decrypt0r 2.0 ransomware virus also lead to significant performance issues. Threats like this one can also be used to deliver additional viruses to the infected hosts.
Evolved versions of the Wana Decrypt0r 2.0 ransomware virus can be used to harvest sensitive information from the infected machines. The hackers can opt to take full control of the computers or spy on the users’ activities which include live video surveillance, keystroke recording and other types of malicious activities.
To calculate the time of the infection the virus engine uses several data extracted from the machine during the first phase of infection. As always the hackers have supplied detailed information about how the victims can obtain the digital currency and pay the fee to them.
Wana Decrypt0r 2.0 Ransomware Virus Distribution Methods
The Wana Decrypt0r 2.0 ransomware virus has been identified in an ongoing attack campaign around the world. At the moment we cannot judge what are the primary spread methods associated with the threat. However, we assume that the Wana Decrypt0r 2.0 ransomware virus is going to spread via the most popular strategies.
Email spam campaigns are one of the primary carriers of prior versions of the virus family. They employ social engineering tricks that attempt to make the targets infect themselves with the malware. This is done by downloading and running the dangerous executable files that are either directly attached to the messages or linked in the body content.
The use of infected documents has become popular in the last few months. Computer hackers bundle the Wana Decrypt0r 2.0 ransomware virus with software installers of famous applications, games, utilities and patches. The resulting files are then spread posing as the official packages.
Usually, such instances are uploaded to various hacker-controlled download sites and portals. They may appear as the official domains, the victims can spot that they are fake by taking a closer look at their addresses. Usually, only a single letter or digit reveals the difference. P2P networks like BitTorrent are other options for spreading the Wana Decrypt0r 2.0 ransomware virus. The trackers and other sites that deal in such software are usually used for distributing malware and pirated content.
Browser hijackers are also considered an option for spreading malware strains associated with the Wana Decrypt0r 2.0 ransomware virus. They are particularly dangerous for the individual users as they modify important settings and endanger their privacy. One of the major behavior patterns that they follow is the modification of the default homepage, search engine, and new tabs page. In addition locally hosted user information can be uploaded at will including: cookies, history, form data, account credentials, settings, and bookmarks. It also places a hacker-controlled site as the default homepage, search engine, and new tabs page.
Direct hacker intrusions are another possible source of Wana Decrypt0r 2.0 ransomware virus infections. Computer criminals can use automated vulnerability testing frameworks to look out for outdated software versions. This is the reason why security specialist advises users to always update to the latest available versions.
Remove Wana Decrypt0r 2.0 Ransomware Virus and Restore .WNCRY Encrypted Files
As mentioned earlier, you can remove Wana Decrypt0r 2.0 virus by following the manual instructions below.
WARNING! Manual removal of Wana Decrypt0r 2.0 virus requires being familiar with system files and registries. Removing important data accidentally can lead to permanent system damage. If you don’t feel comfortable with manual instructions, download a powerful anti-malware tool that will scan your system for malware and clean it safely for you.
SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
Wana Decrypt0r 2.0 Virus – Manual Removal Steps
Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently. The steps bellow are applicable to all Windows versions.
1. Hit the WIN Key + R
2. A Run window will appear. In it, write msconfig and then press Enter
3. A Configuration box shall appear. In it Choose the tab named Boot
4. Mark Safe Boot option and then go to Network under it to tick it too
5. Apply -> OK
Show Hidden Files
Some ransomware threats are designed to hide their malicious files in the Windows so all files stored on the system should be visible.
1. Open My Computer/This PC
2. Windows 7
- – Click on Organize button
– Select Folder and search options
– Select the View tab
– Go under Hidden files and folders and mark Show hidden files and folders option
3. Windows 8/ 10
- – Open View tab
– Mark Hidden items option
4. Click Apply and then OK button
Enter Windows Task Manager and Stop Malicious Processes
1. Hit the following key combination: CTRL+SHIFT+ESC
2. Get over to Processes
3. When you find suspicious process right click on it and select Open File Location
4. Go back to Task Manager and end the malicious process. Right click on it again and choose End Process
5. Next, you should go folder where the malicious file is located and delete it
Repair Windows Registry
1. Again type simultaneously the WIN Key + R key combination
2. In the box, write regedit and hit Enter
3. Type the CTRL+ F and then write the malicious name in the search type field to locate the malicious executable
4. In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys
Click for more information about Windows Registry and further repair help
Recover .WNCRY Files
WARNING! All files and objects associated with Wana Decrypt0r 2.0 ransomware should be removed from the infected PC before any data recovery attempts. Otherwise the virus may encrypt restored files. Furthermore, a backup of all encrypted files stored on external media is highly recommendable.
DOWNLOAD Wana Decrypt0r 2.0 Removal ToolSpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter
1. Use present backups
2. Use professional data recovery software
Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.
3. Using System Restore Point
- – Hit WIN Key
– Select “Open System Restore” and follow the steps
4. Restore your personal files using File History
- – Hit WIN Key
– Type restore your files in the search box
– Select Restore your files with File History
– Choose a folder or type the name of the file in the search bar
– Hit the “Restore” button
