How to remove WannaPeace ransomware

WannaPeace ransomware asks to pay a ransom in exchange for a decryption tool

WannaPeace is known as a file-encrypting virus, which targets to encrypt data on the Portuguese-speaking users’ computers. Hackers use AES ciphers to corrupt files in C://testes directory and demand to pay 0.08 Bitcoin for recovery. According to the experts, the executable file of the ransomware is named RzW.exe and has started spreading at the end of November 2017.

Once it is on the system, WannaPeace virus encodes information and appends _enc adjunct between the initial file-name and its extension. The modified documents look like — [file-name]_enc[.extension]. Afterward, the data becomes unaccessible and the victims are provided with ransom note which appears on the desktop.

WannaPeace developers created a ransom message which states the following:

@AnonymousBr – WannaPeace
Sorry, your files have been encrypted! Please accept us as Anonymous, and only Anonymous. We are an idea which cannot be contained, persecuted or imprisoned.

Thousands of people are now abandoned, injured, hungry and suffering. All as victims of war, which is not even theirs! Unfortunately, only words will not change the position of these people.

We do NOT want your files to be damaged. We just want a small financial contribution. Remember, by making a donation you will not only recover your files, but help restore the dignity of these victims as well.

It is clear that the criminals try to swindle money on the pretext of helping the victims of war. Note that there is no information whether the collected ransoms will be used for the good cause. Likewise, we do not recommend trusting the crooks. Instead, you should remove WannaPeace from your computer and try alternative recovery methods. FortectIntego will help you to do it safely and avoid further damage.

Additionally, understand the risks that might come from trying to eliminate the crypto-malware by yourself. After the infiltration, hackers might install other high-risk computer infections or open backdoors for spyware. Besides, the malicious programs ofter imitate legitimate computer processes and deleting them will harm your system. Therefore, you shouldn't perform WannaPeace removal without any assistance.

Ransomware disguises under Adobe Reader XI

While the malware tries to encrypt your data, it opens an Adobe Reader XI window to imitate a legitimate process. Likewise, experts from Avirus.hu^[1] believe that WannaPeace exploits unprotected RDP configuration and spreads via fake software installers or malicious spam emails.

You should be aware that criminals put malicious files on compromised websites and advertise them via banners, pop-ups or in-texts^[2]. You can encounter them on your frequently visited pages or other sites which are legitimate. Note that the pushed ads might look genuine or even mimic well-known brands.

Typically, they claim that you need to install software update, system optimization program, etc. If you are tricked to download the fake update or software, you end up manually infiltrating ransomware. Likewise, you should never click on any types of ads and avoid visiting suspicious websites.

Another method which might be possibly employed to distribute malicious programs is malspam campaigns^[3]. Cybercriminals send email letters with compromised attachments to trick inexperienced computer users into opening them. Infected emails might also disguise under famous companies or brands. Therefore, you should attentively monitor your online activity and never open messages from people you don't know.

Terminate WannaPeace virus with ease

We understand that the ransom note claims that the WannaPeace virus is designed for a good cause. However, by paying a ransom you motivate the criminals to continue their malicious activity and increase illegal profits. There are various charity funds to help the victims of war which are far more reliable. Therefore, we recommend you to choose one of them and make a donation instead of trusting the criminals.

You can remove WannaPeace with FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes and try to restore your damaged files with the help of alternative recovery tools. We kindly ask not to try to remove the malware by yourself of purchase suspicious decryptors online. Remember that there are numerous scammers who seek to swindle money from you by selling expensive and usually useless applications.

If you are not an experienced computer user, the smartest choice would be to download a security software to perform WannaPeace removal for you and follow the elimination guide below. Note that it will also additionally include legitimate recovery tools you can use to retrieve your most important files.