How to remove WannaCry 3.0 ransomware virus

WannaCry 3.0 is the ransomware version emerging from a notorious malware family

WannaCry 3.0 functions as a third version of the notorious WannaCry^[1] malware. Almost a month has passed since the world was struck by malware on May 12th, 2017. It wreaked havoc globally: users who have been using outdated Windows versions have experienced the full assault of this menace.

Specifically, the malware exploited the EternalBlue vulnerability in SMB servers. With the assistance of the hacking tool, leaked by Shadow Brokers, who stole the original tool from the National Security Agency, the developers had devised a cyber menace.

The malware penetrated into the systems of hospitals, train stations, and other smart devices. Luckily, the malware did not retain the world as a hostage for long – an IT expert^[2] purchased an unregistered domain and activated a “kill switch.” Soon after the campaign was launched, its alternative versions have appeared: WNCRY, Wanna Crypt0r 2.0, Wanna Decrypt0r 2.0, etc.^[3] Recently, the third version was detected online. In this article, you will discover the options to remove WannaCry 3.0. 

After the original version has been finally terminated, IT experts joined forces to analyze the threat and come up with countermeasures. Further analysis revealed that some extracts of the source code contained similarities to the viruses created by the Lazarus group of hackers suspected to share the support of the North Korean government.

While the media quickly picked up the habit to put all the blame on the said government, other IT experts noted that the ransom note seemed to be translated rather than written by a native speaker. They voiced their opinions that the real culprit might have originated from China.^[4] While cybersecurity forces indulged in such speculations, the hackers worked on the third version. The latest edition – WannaCry 3.0 malware.

This time the developers made sure to fix any possible flaws. Certainly, they have deleted the main weakness of WannaCry – “kill switch.” It was developed for self-defense purposes. If executed on a virtual machine, in order not to reveal its true origin, the malware would activate a kill switch. However, it also happened to be a weakness that allowed the IT specialist to terminate the attack. Subsequent versions were said to have alternative “kill switch” buttons.

However, WannaCry 3.0 ransomware is not supposed to possess this peculiarity. On the other hand, there are higher detection chances. IT specialist Matthieu Suiche confirmed that the latest version of the threat had entered cyberspace. He spotted that the third installment connects to iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com domain. Such valuable discovery would undoubtfully contribute to the prevention of ransomware. Lastly, cybersecurity specialists question whether the same felons launched the third version.

WannaCry 3.0 infection prevention

Though the virus indeed caused global chaos, note that it was not invincible. It was able to inflict global havoc only because small and bigger businesses had been still using unpatched and outdated Windows versions. In response to continuous cyber assaults, Microsoft has already released updates. Install them right away.

In order to prevent WannaCry 3.0 hijack, you may also disable the SMB Windows feature^[5] via settings.

1. Click on the Windows button and type Windows features.
2. Select the entry Turn Windows features on or off.
3. Locate SMB 1.0/CIFS File Sharing support.
4. Remove the checkmark.
5. The system will ask you to reboot the device in order for the changes to take effect.

If you need this function working, you may allow it is running. However, note that crucial system apps and Windows operating systems should be updated. Additionally, check whether your virus prevention and malware elimination tools are fully functioning as well.

WannaCry 3.0 elimination options

If you suspect that the malware has already settled on the computer, make a rush to remove WannaCry 3.0 virus right away. In that case, you will need a fully functioning cybersecurity tool, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Below you will find guidelines that instruct how to reboot the system in Safe mode should you encounter any virus removal problems. Note that there has been a free WannaCry Decrypter released. You may give it a try battling the latest version.