What is Widia ransomware? Widia ransomware is another malicious application that is quite different from your typical ransomware. It opens a window on your desktop telling you that your files have been encrypted with the strongest encryption and unique key when the truth is it does not encrypt your files at all. The ransomware locks your computer so you won’t be able to access it at all and you can’t check if your files are really encrypted or not. This new cyber infection follows the trend of lock screen viruses. Moreover, this ransomware does not allow you to access programs or use your computer normally. It’s one of the reasons why you should remove this ransomware as soon as you can.
Below is the lock screen of the Widia ransomware together with the ransom note:

“Your documents, photos, databases and other important files have been encrypted with the strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.”
You might think that paying the ransom would be the easiest way out but that’s where you’re wrong. Paying the ransom won’t guarantee you a solution at all. Thie ransomware won’t be removed automatically once you pay the ransom and there is no assurance if it will be removed at all once you give the demanded money to the cyber criminals. And you will be exposing private information such as your credit card details if you give them what they want. This can put your security at risk. That’s why you should never even think about paying the ransom. Besides the fact that your files are not really encrypted, you can find the solution in unlocking your computer through this article.
Even though the Widia ransomware does not really encrypt files, it is still your typical computer infection and not to be treated lightly since it still sneaks into your computer and has the ability to make it inaccessible to you. After it places the black lock screen on your computer, the Widia ransomware has been discovered to make undesirable changes on your computer’s settings too. It can disable your Windows Task Manager and ends processes like explorer.exe, regedit.exe and taskmgr.exe which belong to important system utilities. The modifications made will make it even harder to get rid of it. Still, you should try your best to remove it from your computer.
There is not much information about the Widia ransomware because this ransomware is not spread out actively. But according to our researchers, the cyber criminals use illegal distribution methods like what they to spread most computer infections. This ransomware is distributed through free file sharing websites online. It is bundled together with other software making it hard to see it once you download the software that you want. So when you install a free bundled software you must pay attention on the installation process so that you can leave out any additional unwanted software. This ransomware is also distributed through spam emails with Widia as an attachment. Usually, these spam emails are disguised as an email from a legit sender. It might even use your bank’s name or other big companies. So if you don’t know the sender and it has questionable or suspicious attachments, erase that email immediately.
This infection must be removed immediately because you won’t be able to access your computer or use it as usual. You also have to remove it to prevent further damages from your computer. Below, we have provided complete instructions you should follow to unlock your computer and remove the Widia ransomware.
How to remove the Widia Ransomware:
Step 1. Reboot your computer into Safe Mode
Windows XP/Vista/7
1. Reboot your computer.
2. tap F8 when you see the BIOS screen.
3. Select Safe Mode from the Advanced Boot Options menu using the arrow keys on your keyboard.
4. Press Enter.
5. And then precede to remove the Widia ransomware.
Windows 8/8.1/10
1. Tap two buttons: the Windows key and C on your keyboard and click Settings (if you use Windows 8/8.1) or click on the Start button (if you use Windows 10).
2. Click Power.
3. Hold the Shift key and click Restart.
4. Click Troubleshoot.
5. Click Advanced options.
6. Click Startup Settings.
7. Click on the Restart button.
8. Tap F4.
9. Precede in removing the Widia ransomware when your PC starts in Safe Mode.
Step 2. Tap Win + E to open the Windows Explorer.
Step 3. Go to %WINDIR%.
Step 4. Delete the following files: wd0w.exe, oops.rr, oobelx.dt, and *widia.exe (*-random symbols).
Step 5. After that, close the Windows Explorer and then go to the Registry Editor by tapping Win + R. Type in regedit.exe in the dialog box and click OK. (Keep in mind that any changes made to your Registry can affect your computer, so if you are not sure if the file you are going to modify or delete is from the Widia Ransomware, it is best to create a backup copy by exporting the file to a different location).
Step 6. Open HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
Step 7. Modify the DisableTaskMgr value in these two registry keys. Right-click on the value and select modify then change its value data to 0.
Step 8. Modify the value data of the EnableLUA Value too which can be found in registry keys stated in step 6 and then change the Value data to 1.
Step 9. Go to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
Step 10. Look for the Value .*widia (*-random symbols). Right-click on it and select Delete
Step 11. Close the Registry Editor.
Step 12. Empty the Recycle Bin.
Step 13. Perform a full system scan using an excellent antivirus and anti malware program like SpyRemover Pro. This will help you get rid of any residues that the Widia Ransomware might have left out as well as prevent infections like that from getting into your computer again in the future.