How to remove WannaCryOnClick ransomware virus

Another WannaCry copycat emerges – WannaCryOnClick virus

WannaCryOnClick virus is a Turkish file-encrypting virus that mimics the infamous WannaCry ransomware virus^[1]. Once installed, it corrupts all data on victim’s PC (including pictures, documents, videos, archives) and displays a message called “Local” on the screen. The virus asks $7000 in Bitcoin^[2] from each victim. The virus sends messages to WannaCryOnClick developers as soon as the victim clicks on “Decrypt” or “Check payment” buttons.

Apparently, users should not pay such an enormous ransom to cyber criminals, especially because this virus is developed by nonprofessionals. The ransom-demanding program contains two buttons – “Check Payment” and “Decrypt”. Once the victim clicks on one or another button, the virus automatically sends an email message to developers containing a message which button was clicked. The virus uses muhasebe@komposan.com email as the sender and nazm.fatma@yandex.com as the recipient.

However, it seems that WannaCryOnClick virus was developed as a test version to see the possible outcome. It seems that frauds wanted to see how many computers were compromised by the virus by receiving a message each time a victim clicked on a button.

It goes without saying that you should not pay the ransom to them because they can hardly do that – there is no way to contact the criminals, and there is no way for you to obtain the decryption key (even if you pay the ransom).

To restore encrypted data, you should use data backup or try data recovery solutions we described in the “Data Recovery” section. Remember that only data backup can restore the majority of crippled files because simple data recovery tools cannot crack the encryption lock that easily. In fact, ransomware developers are the only ones who know what the encryption and decryption keys are.

Remove WannaCryOnClick ransomware using professional malware removal tools such as FortectIntego or MalwarebytesMalwarebytes. You may need to reboot your PC in Safe Mode with Networking to eliminate the virus successfully. In some cases, the malware attempts to block security programs from removing them, so you have to prepare your computer for WannaCryOnClick removal. You can find an in-depth tutorial on how to do it down below. In case you are a Turkish-speaking PC user, visit Virusler.info.tk^[3] site.

Fake WannaCry copies mostly distributed via email spam

WannaCryOnClick is not the first bogus copy of the WannaCry ransomware. There is a FakeCry and WannaLocker (Android version) available. Viruses meant for Windows computers typically travel via malicious spam – it is the easiest and cheapest malware distribution technique that is, indeed, the most efficient one as well. Clearly, the virus doesn't use the Windows SMB vulnerability since it is not as advanced. To prevent such viruses from corrupting your files, you need to:

1. Stay away from emails sent by strangers. You must carefully inspect the sender’s email address, too, because scammers also tend to impersonate employees of well-known organizations and companies.
2. Install an anti-spyware or anti-malware software and use a security program with a real-time protection feature to keep malicious programs at bay.
3. Create a data backup – it will come in handy in the worst ransomware attack scenario.
4. Enable automatic software updates to prevent attackers from exploiting security vulnerabilities in them.

Remove WannaCryOnClick and choose preferable data recovery method

Before you attempt to decrypt your files, remove WannaCryOnClick virus first. The virus can be eliminated with a decent anti-malware product. Do not settle for untrustworthy malware scanners and use only expert-verified tools. You can find a list of them below the article.

We strongly suggest you follow WannaCryOnClick removal instructions provided below and restart your PC in a Safe Mode with Networking. As we mentioned before, this helps to disable the virus temporarily.