How to remove Worry ransomware

Worry ransomware encrypts users' personal files and asks for payment to decrypt them

Worry ransomware is malicious software that encrypts users' personal files and renders them inaccessible, potentially leading to permanent data loss if the affected individuals do not have backups. It is a variant of Phobos ransomware and can infiltrate a system, adding the .worry extension to the affected files and changing their icons to white pages, making it impossible to open or view them.

If a file was previously named picture.jpg, after encryption, it would look like this – picture.jpg.worry. This type of virus uses complex encryption algorithms to lock the users' files, such as photos, videos, and documents. After the encryption process is finished, the ransomware generates two ransom notes on the machine.

The ransom note

Worry Ransomware drops info.hta file on the victims' computers:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail d0ntw0rry@cyberfear.com
Write this ID in the title of your message –
In case of no answer in 24 hours write us to this e-mail:rahmud1954@cock.email
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Users can also find a shorter ransom note named “info.txt”:

!!!All of your files are encrypted!!!
To decrypt them send e-mail to this address: d0ntw0rry@cyberfear.com.
If we don't answer in 24h., send e-mail to this address: rahmud1954@cock.email

Cybercriminals often attempt to coerce victims into paying for a decryption key^[1] to unlock their files, typically requesting payment in cryptocurrencies to maintain anonymity. They may even offer to decrypt a small number of files for free as a way to appear trustworthy.

However, it is highly risky to pay the ransom, as many previous victims have reported not receiving a response or a solution after paying. While it can be difficult to decrypt the data without the help of cybercriminals, there are third-party solutions that may be effective in some cases. Below, we provide instructions on how to use these options.

Distribution methods

There are several ways that threat actors may try to spread malicious programs, including ransomware. One common method is through the use of unregulated websites and file-sharing platforms, where individuals may unknowingly download “cracked” software^[2] that contains malicious files.

Email is another common method of distribution, with cybercriminals using social engineering tactics to create convincing emails that appear to be from well-known companies and include infected attachments or links. To protect yourself, it is important to be cautious when opening email attachments from unknown senders.

You should also keep your operating system and software up to date by installing security patches as they become available. This can help prevent the exploitation of vulnerabilities that hackers may use to deliver their malicious programs.

Use professional security tools to eliminate ransomware

If your machine has been affected by ransomware, it is important to disconnect it from the local network as soon as possible. For home users, this can be done by simply unplugging the ethernet cable. In a corporate setting, this may be more complex, but there are instructions available at the bottom of this post.

It is important to prioritize removing the malicious program over attempting to recover your data, as this can lead to permanent data loss and the re-encryption of your files. If you do not have experience with removing malicious programs, it is best to use anti-malware tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to scan your system and remove the related files and entries automatically.

In some cases, malware may prevent you from using antivirus in normal mode, so you may need to access Safe Mode and perform a full system scan from there.

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on the Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find the Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Fix system errors

Malware infections, including ransomware, can cause significant performance, stability, and usability issues that may require a complete Windows reinstall to resolve. These types of infections can alter the Windows registry database, damage essential bootup, and other system files, and delete or corrupt DLL files.

Antivirus software is not able to repair damaged system files, which is why FortectIntego was developed. This maintenance tool is able to fix many of the issues caused by malware infections, including blue screen errors,^[3] freezes, registry errors, and damaged DLLs, potentially allowing you to avoid the need for a Windows reinstall.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

File recovery software

Many people think that they can fix their files with anti-malware tools, but that is not what they are designed for. All the security tools can do is detect suspicious processes in your system and eliminate malicious files. The truth is, that the files can be restored only with a decryption key or software that only the cybercriminals have.

If you did not back up your data previously, you possibly lost your files forever. You can try using data recovery software, but third-party programs cannot always decrypt the files. We suggest at least trying this method. Before proceeding, you have to copy the corrupted files and place them in a USB flash drive or another storage. And remember – only do this if you have already removed the Worry ransomware.

Before you begin, several pointers are essential while dealing with this situation:

• Since the encrypted data on your computer might permanently be damaged by security or data recovery software, you should first make backups of it – use a USB flash drive or another storage.
• Only attempt to recover your files using this method after you perform a scan with anti-malware software.

Install data recovery software

1. Download Data Recovery Pro.
2. Double-click the installer to launch it.
3. Follow on-screen instructions to install the software.
4. As soon as you press Finish, you can use the app.
5. Select Everything or pick individual folders where you want the files to be recovered from.
6. Press Next.
7. At the bottom, enable Deep scan and pick which Disks you want to be scanned.
8. Press Scan and wait till it is complete.
9. You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
10. Press Recover to retrieve your files.