How to remove “Oops your files have been encrypted” ransomware virus

“Oops your files have been encrypted” is a threat that executes ransomware virus on the system

“Oops your files have been encrypted” virus is an alternative name given to an infamous cyber threat called WannaCry virus and other ransomware. This innocent string of words now brings a sense of fear to anyone who has been infected with WCrypt, Wana Crypt0r, WNCRY file extension virus or any other cryptovirus, or at least read one of the numerous articles written about such threats.^[1] The “Oops your files have been encrypted” phrase is the first thing that people see when infected with this vicious parasite. However, the biggest issue is the loss of data which is typically encrypted by ransomware. The latest news is showing that the threat has just been updated – at the moment it is attacking servers and domains. The virus is causing an HTML window appearing with the “Ooops, your website have been encrypted!” slogan as a greeting. In this note, hackers are claiming that to unlock encrypted website you need to contact them via spamrslt@inbox.ru.

The phrase “Oops your files have been encrypted” has been actively used by ransomware developers who started using it in their own malicious creations. For instance, the new Petya virus version, which is trying to repeat the success of WCry by employing the Eternal Blue exploit kit, is also showing the same message. 

“Oops your files have been encrypted” virus has been known worldwide since 2017, when it all started it has done a lot of things. The newest information about this ransom demanding threat is the ability to attack servers and leave their owners completely disabled. 

It is known that this new “Ooops, your website have been encrypted!” ransomware and the previous version spreads the payload via Server Message Block protocol. At the moment, it appears that various domains, sites, and servers have been hacked by this virus. When the payment wallet address (1EwzEjNVtFezGQS5L555r4szP86GJ4n5DR) is googled, the results show a list of sites that are locked by this ransomware.

The short message displayed by ransomware provides these details:

• The wallet address;
• The ransom amount of 0.08BTC;
• Contact email address (spamrslt@inbox.ru or spm.lifethuggest@hotmail.com)

Origins of the WannaCry virus

On May 12th, cybersecurity specialists globally have been summoned for an emergency – the ransomware under the name of WannaCry has paralyzed the activities of the National Health Center, hacked Deutsche Bahn transportation system and Hitachi company and multiple others.^[2]

Both, corporations and individual users, did not escape the menace of this malware. It was said to have affected approximately 200 000 devices in 150 countries. The success of this malware lies in the leaked information about EternalBlue vulnerability found in Windows OS based systems.

Users or companies which have been using older Windows version fell into the well-devised trap of the hackers. Personal files have been encoded and marked with .wncry or .wcry file extensions.

Luckily, the rampage of the malware was terminated by a security specialist Marcus Hutchins, who bought unregistered domain associated with the virus. Furthermore, further analysis revealed that the malware might be linked to a notorious group of hackers “Lazarus.” ^[3]

IT specialists are still convinced that it is too early to lay down arms as the threat may strike again. There have been already several subsequent versions^[4]. If you have been affected by this malware, remove “Oops your files have been encrypted” virus. FortectIntego or MalwarebytesMalwarebytes speeds up the process.

Unlike the majority of Windows OS-based ransomware viruses which spread via spam emails, this malware succeeded in wreaking chaos by exploiting EternalBlue exploit, technically known as CVE-2017-0144. It permits access to SMB (Server Message Block) protocol. Such an exploit has been developed by the US national Security Agency.

This cyber weapon has been kept in secret until the group of hackers known as Shadow Brokers stole it. Corresponding to it, Microsoft issued an update in March, but as the situation revealed a significant number of corporations and users did not apply the update.

Therefore, such mistake granted “Oops your files have been encrypted” malware freedom to wreak havoc. After it invades systems, further on, it behaves like an ordinary virus: encrypts files, launches its @Please_Read_Me@.txt guide with instructions, demands 300 USD in ransom and sets a 7-day period for users to pay. After the expiration, the files are said to be deleted.

Thanks to the malware researcher, the virus has been terminated. Unfortunately, further forecasts are not positive: recently previously emerged UIWIX virus has been gaining power in China.^[5] The hackers seem to have eliminated the flaw which let the termination of the virus.

UIWIX virus does not have a “kill switch” and targets outdated systems as well. Unfortunately, this data leak also inspired others hackers to join the ransomware market. Adylkuzz virus is known as another virus which exploited the same vulnerability and is expected to rise in the future^[6]. Thus, before we proceed to “Oops your files have been encrypted” removal section, get acquainted with its prevention options.

Malware prevention measures

This malware confirms that having professional anti-malware tools is not sufficient in battling crypto-malware threats. Therefore your participation is of high importance in the prevention of “Oops your files have been encrypted” infiltration. To stay at least a little safer, you should follow some basic rules:

• Install Windows OS updates right after they are issues.
• Keep system applications up-to-date.
• Avoid opening email attachments without confirming the identity of a sender, restrain from visiting websites which are crammed with ads do not get tempted to click on fishy links on similar domains.

It has been observed that early versions of WannaCry spread via spam messages, so these prevention tips are applicable. These tips will help you limit the risk of “Oops your files have been encrypted” hijack.

Ways to delete “Oops your files have been encrypted” virus

Despite how menacing this virus may be, remove “Oops your files have been encrypted” virus as soon as you notice its marks of activity on the computer. For the successful elimination, you may use malware removal tools such as FortectIntego or MalwarebytesMalwarebytes. Only when “Oops your files have been encrypted” removal is completed, you may start thinking about data recovery procedure. On the final note, we encourage you to remain rational and vigilant and avoid diverting to panic or inadequate precautions methods.