WinRarer Ransomware Virus (Removal Steps and Protection Updates)

The WinRarer ransomware is a new malware that is still under active investigation. Learn more about this threat and how to remove it in our guide.

WinRarer Ransomware Description

The WinRarer ransomware is a new malware threat that is still under active investigation by security researchers. At this time it is still unknown if the code is variant of a malware family or is a standalone development. The first samples were identfied in October 2016. The virus employs fairy standard behavior – it scans the local system for a list of target file name extensions and encrypts them with a strong cipher. The ransomware note is crafted in two formats – RECOVERYOURFILES.HTM and RecoverYourFiles.jpg. The contents reads the following:

Attention: YOUR FILES were LOCKED
What happened?
Your important files were LOCKED with Winrar so its now unusable and unreadable,
The only way to get your files back is to pay us.
Otherwise, your files will be useless
How can I get my files back?
The only way to restore them to a normal condition is to use our site to decrypt yor key to get the password follow the flowing steps to enter our site:
1. Download and install tor-browser:
http://www.torproject.org/projects/torbrowser.html.en
2. After a succesful installation, run the browser and wait for initialization.
3. Go to this site (paste it in the url address ): pgzhzhje5v7dzrcr.onion
4. Copy your id from the bottom of the page to paste in the site.
your id is: {VICTIM ID}
done

The virus also has an additional screen locking function. The bundled RecoverYourFiles.jpg is used to display the ransom note on the user’s screen. The contents reads the following:

WINRARER
YOUR FILES LOCKED
WITH WINRAR
WHAT HAPPENED ?
YOUR IMPORTANT FILES WERE LOCKED WITH WINRAR
SO ITS NOW UNUSABLE AND UNREADABLE.
THE ONLY WAY TO GET YOUR FILES BACK IS TO PAY US.
OTHERWISE, YOUR FILES WILL BE LOST.
HOW CAN I GET MY FILES BACK?
THE ONLY WAY TO RESTORE THEM TO A NORMAL CONDITION IS TO USE OUR SITE TO DECRYPT YOUR KEY TO THE GET THE PASSWORD
FOLLOW THE FLOWING STEPS TO ENTER OUR SITE:
1. DOWNLOAD AND INSTALL TOR-BROWSER:
HTTP://WWW.TORPROJECT.ORG
2. AFTER A SUCCESFUL INSTALLATION, RUN THE BROWSER AND WAIT FOR INITIALIZATION.
2. GO TO THIS SITE USING TOR BROWSER ONLY:
PGZHZHJE5VD7DZRCR.ONION
4. COPY YOUR ID FROM RECOVERYOURFILES.HTM FILE AND PASTE IT IN IN THE SITE
IF YOU ARE LOOKING FOR A JOB ENTER THE SITE AND GET YOUR OWN LOCKER

The affected files are placed in a YourFilesHere-OpenWithWinrar.ace file.

WinRarer Ransomware Distribution

The Winrarer ransomware is mainly distributed in spam email campaigns that contain links to the infected binaries or directly attached to the messages. Other infection methods include adware-infected software bundles, false legitimate apps and Trojan downloaders.

WinRarer Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete WinRarer completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely WinRarer Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter