How to remove WininiCrypt ransomware virus

WininiCrypt – recently emerged ransomware virus

WininiCrypt is a file-encrypting virus that appends .[cho.dambler@yandex.com] file extension to the target files. Once all the data is locked with a sophisticated algorithm, malware delivers a ransom note in HOW_TO_BACK_FILES.html file.

Typically WininiCrypt virus spreads as an obfuscated file in the emails. As soon as a user opens it, malware enters the system. Then it creates a new process in the %WINDIR%\System32\cmd.exe directory and drops an executable file called sdelete.exe.

WininiCrypt ransomware might also modify proxy settings, queries sensitive IE security settings, install suspicious files, and alters or creates new Windows Registry entries. When it strengthens its presence, crypto-malware starts scanning the system looking for the targeted data for the encryption.

Apart from encrypting the files, the virus also deletes Shadow Volume Copies^[1] by executing the command:

vssadmin Delete Shadows /All /Quiet

Thus, it means that data recovery after ransomware attack might be nearly impossible without specific decryption tool. Undoubtedly, hackers offer to obtain it from them. However, paying the ransom and hoping that cyber criminals will keep their word is naive.

After ransomware attack, you should focus on your computer’s state and remove WininiCrypt together with its malicious components. Virus elimination won’t help to restore your files, but you will be able to use backups, extract valuable data from emails and use alternative recovery methods.

WininiCrypt removal is performed with professional malware removal software, such as FortectIntego. However, this crypto-virus might prevent from installing or running security program. For this reason, you may need to reboot your PC to the Safe Mode with Networking (instructions below).

Precautions to take against ransomware

We are talking about a brand new cyber threat that hasn’t started spreading actively. Therefore, you should take some precautions to avoid ransomware attack.

1. Do not open suspicious spam emails, and especially links or attachments included in them.^[2]
2. Do not download illegal programs, movies or other files.
3. Do not click on an aggressive or “too good to be true” ads.
4. Avoid visiting high-risk websites, such as gaming or adult-themed.
5. Create backups.
6. Install reputable antivirus.
7. Keep all your programs updated.

Termination guidelines of the WininiCrypt malware

Manual WininiCrypt removal is not recommended for home computer users. Ransomware is a complex cyber infection that must be eliminated properly. According to malware analysts from Bedynet,^[3] attempts to remove file-encrypting viruses usually end up with irreparable damage to the system.

Thus, we highly recommend choosing FortectIntego or SpyHunterCombo Cleaner for cleaning your computer. The instructions below will explain how to disable the virus and remove WininiCrypt automatically.