How to remove 4rw5w ransomware virus

4rw5w ransomware asks for bitcoins in exchange for a decryption tool

4rw5w virus is a crypto-ransomware^[1] that was first seen in the first half of 2017. Using a combination of AES and DES encryption algorithms, the malware locks all personal data located on the host machine and prevents victims from accessing it. The modified (not corrupted!) files are all appended with the .4rwcry4w extension and also lose their original icons.

After this process, ransomware delivers a ransom note in the form of a pop-up window titled 4rw5wDecryptor, which explains users the situation and asks to pay $30USD worth of Bitcoin to the provided wallet. Do not pay these novice attackers, as they did not manage to reach success. Instead, you can check for tips below to find effective ways to restore your files to their original form.

It looks like malware creators’ attempt to jump on the WannaCry's bandwagon in hopes of receiving similar success as this infamous parasite did a few years back. As evident, the copycat malware came nowhere near what the latter has achieved.

Fortunately, this malware is still at a very low distribution stage, so there is really no need to panic. At least for now. Nevertheless, if this malware does invade your computer somehow, it is unlikely that you will avoid the destructive consequences it brings.

If the system infiltration goes successfully, the virus will then start looking for 22 types of file extensions, including:

.avi, .dll, .DOC, .DOCX, .DOT, .dotm, .exe, .jpg, .lnk, .mp3, .mp4, .NEF, .ODT, .PDF,. pif, .png, _en.png, .rar, .txt, .url, .wav and .zip.

To keep these files safe from decryption, extortionists have programmed the virus to encrypt the AES encryption key with the DES algorithm ^[2]. Such double encryption is virtually impossible to crack; thus, the ransomware victims either have to pay the criminals or use alternative methods for data recovery.

. Unfortunately, these might not always be successful. Despite this, we strongly recommend you do not contact cybercriminals, as they might not fulfill their promises even after you pay them.

4rw4w.exe and 4rw5wDecryptor.exe are the main files associated with this virus, so make sure you delete them from your computer. Applying FortectIntego or similar virus detection software for the elimination is a smart choice if you want to get rid of the malware quicker.

.4rwcry4w extension virus is not only as widespread as WannaCry, but it also seems to be quite different in its design. Lockscreen that displays the ransom note is very basic and does not feature additional details such as a timer that counts down the time until data destruction. It only features the language selection option, a fill-in box with a decrypt button next to it, and a brief message that goes like this:

WARNING
we have encrypted your files with 4rw5w crypt virus !
Your important files : photos, videos, documents, etc, were encrypt with our 4rw5w crypt virus.
The only way to get your files back is to pay us 30$ in Bitcoins. Otherwise, your files will be lost.
Caution: Removing of 4rw5w crypt virus will not restore access to your encrypted files.
[+] What happened To my files?
Understanding the issue
[+] How can i Get my files back?
The only way Is To pay For the decryption key !
[+] What should i Do Next?
Buy the decryption Key for 30$ worth in Bitcoins !
Bitcoin Adress to buy the decryption key : [Bitcoin address]

The typos and grammar mistakes suggest that the criminals behind this virus are not really taking this program seriously. Perhaps it’s just a test drive to see if the ransomware works before starting more widespread distribution. Either way, you should not follow the instructions in this note and head straight to the virus removal instead.

The obscure ways of ransomware distribution

Malware investigators have not come across a specific source of malware distribution yet. This is probably because the program’s prevalence, in general, is very low. What we can presume, though, is that the extortionists may be distributing the malware themselves and not relying on major botnets such as Necurs to disseminate it like the majority of ransomware viruses.

This makes it almost impossible to determine where and how this virus may hit. Nevertheless, we know that typically, ransomware is distributed via email spam, so it would be smart to pay more attention to what emails you are receiving and especially what attachments you are downloading. Besides, to be completely sure your data is safe, you should create backups of your files and keep them safe.

Eliminate ransomware and then try alternative data recovery options

It goes without saying that ransomware is not the type of malware you can mess around with. This means that you should not even try to remove the virus from your computer manually. You should only rely on professional anti-malware software to carry out this task.

Security tools can be used to protect your device from malware, potentially unwanted programs, and viruses. So, make sure you invest in a powerful utility with strong real-time protection.

Once you eliminate all the malicious files, you should also check the data recovery techniques we provide below. Keep in mind that you should transfer the encrypted files over to another medium before restoring them.