Terminating WORK Ransomware (Crypto-Malware/Ransomware)

What is WORK ransomware? And how does it perform its attack on the infected system?

WORK ransomware is new variant of the CryptoMix ransomware family which appends the.WORK extension to the encrypted files and changes the contact emails used by the ransomware. While the encryption method in this new variant remains the same, there are some minor but noticeable changes – the ransom note is still named as _HELP_INSTRUCTION.TXT, however, it now uses the [email protected], [email protected], [email protected], [email protected] and [email protected] email addresses that victims could contact for payment information. Another change it applies is the extension added on the encrypted files which is .WORK extension right after it encrypts them using the combination of AES CBC 256 and RSA 2048 ciphers. Right after the data encryption, it drops its ransom note in a file called _HELP_INSTRUCTION.TXT, bearing the following message:
“Attention! All Your data was encrypted!
For specific information, please send us an email with Your ID number:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
Please send email to all email addresses! We will help You as soon as possible!
IMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!
DECRYPT-ID-[id] number”
Cyber criminals behind WORK ransomware tries to scare its victims by claiming that the victims will lose all their files if they so much as try to use some public software for data recovery. Clearly, it’s only a means to scare users to get them to contact these crooks and pay the ransom. Doing so is definitely not recommended as you might end up losing your money but still no encryption key from the cyber criminals. As it uses a strong encryption algorithm, recovering the encrypted files is nearly impossible. However, security experts as of this writing are now trying to come up with a free decryptor for WORK ransomware’s victims. So in the meantime, use whatever backup copy you have of the encrypted files until they release a free decryptor.
How does WORK ransomware spread its malicious payload?
WORK ransomware, just like other variants of CryptoMix ransomware still uses spam emails in spreading its malicious payload. Such emails are often disguised as something important to get users to open the email and download its attachment but you should know better than doing that.
With the help of the following removal instructions, terminate WORK ransomware from your PC immediately.
Step1. Open the Task Manager simply by tapping Ctrl + Shift + Esc keys on your keyboard.
Step2. Under the Task Manager, go to the Processes tab and look for BC0EBCF2F2.exe and any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to WORK ransomware.

Step3. After that, close the Task Manager.
Step4. Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step5. Under the list of installed programs, look for WORK ransomware or anything similar and then uninstall it.

Step6. Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step7. Navigate to the following locations below and look for WORK ransomware’s malicious components such as BC0EBCF2F2.exe and _HELP_INSTRUCTION.txt as well as other suspicious files and then delete all of them.

%TEMP%
%ALLUSERSPROFILE%
%ALLUSERSPROFILE%\Application Data
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step8. Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step9. Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step10. Navigate to the following path:

HKEY_CURRENT_USER\Control Panel\Desktop\
HKEY_USERS\.DEFAULT\Control Panel\Desktop\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Step11. Delete the registry keys and sub-keys created by WORK ransomware.
Step12. Close the Registry Editor and empty your Recycle Bin.
It is important to make sure that nothing is left behind and that WORK ransomware is completely removed using the following antivirus program. To use it, refer to the instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.