Do you know what Bansomqare Wanna Ransomware is?
Bansomqare Wanna Ransomware is a ransomware infection that will mercilessly lock files on your computer if it infiltrates it. According to our researchers, it seems that it has been designed to lock both users’ personal files and system files. Since it encrypts a bunch of files belonging to the Windows OS after the successful entrance, there is a possibility that the Windows OS could not boot after the restart. Of course, the main goal of this ransomware infection is not to ruin users’ Windows, but, instead, it seeks to make users pay money in exchange for the decryption service. Some users find extremely important documents or other files completely locked after the Bansomqare Wanna Ransomware entrance and need them back badly, so they decide to send the money required. This is the worst victims can do, specialists say. If your important files have been locked too, you should not pay money for the developer of Bansomqare Wanna Ransomware because the chances are high that your files will not be unlocked and, on top of that, you will not get any decryption tool for unlocking them. Instead of making a payment, delete the ransomware infection from your computer fully as soon as possible.
If you see a bunch of your personal files having the .bitcoin extension appended, there is no doubt that Bansomqare Wanna Ransomware has already encrypted them. Encrypted documents, pictures, music, videos, and other files is not the only symptom showing that the entrance of Bansomqare Wanna Ransomware was successful. If this malicious application has already infiltrated your computer and locked files stored on it, you will also find a new .txt file – bitcoin2018.txt – in all those directories that contain encrypted files. The .txt file contains a short message consisting on the Bitcoin wallet address, an email address (MildredRLewis@teleworm.us), and a sentence demanding 100 USD in Bitcoin. Last but not least, you will also notice a window opened on your Desktop. The message located there is longer. Users are, first, explained why they can no longer access the majority of their personal files: “Many of your documents, photo, video, databases and other files are no longer accessible because he have been encrypted.” Then, they find out that they must pay 100 USD for the decryption service. Believe us, you do not need to pay money to get your files back. You could easily restore them from a backup (if you have it) after the full Bansomqare Wanna Ransomware removal. Also, our researchers have found a free decryptor that can remove the .bitcoin extension and thus unlock files affected by this ransomware infection. You could download it too and use it to unlock your data after removing this threat completely. Unfortunately, we cannot promise that its removal will be a piece of cake because it creates an entry in the Run registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). It allows it to continue working even after the system restart.
Bansomqare Wanna Ransomware screenshot
Scroll down for full removal instructions
It is not so easy to say how Bansomqare Wanna Ransomware has infiltrated the computer in your case, but we are sure that it was not protected enough, for example, your security tool could have already been outdated. According to our malware researchers, even though it is not a prevalent infection and, because of this, it is not easy to talk about its distribution, it is believed that it should be spread like similar threats, i.e. it is very likely that it also mainly travels inside spam emails as an attachment. On top of that, it might be available on dubious websites too, so users downloading free software from the web very often should not click the Download button located on websites they know nothing about.
You will need to remove the ransomware entry from the system registry and erase all suspicious recently downloaded files from the Downloads folder to erase it from the system fully. Unfortunately, your files will not be unlocked. To get them back, you will need to restore them from a backup or use free decryption software (it can be downloaded from the web).
How to remove Bansomqare Wanna Ransomware
- Open Explorer.
- Type %USERPROFILE%\Downloads in the URL bar and press Enter to open it.
- Delete all suspicious recently downloaded files.
- Remove bitcoin2018.txt from affected directories on your computer.
- Launch Run (press Win+R).
- Enter regedit in the command line and click OK.
- Go to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
- Locate the google Value, select it, and press Delete.
- Close Registry Editor and empty your Recycle bin.
In non-techie terms:
Bansomqare Wanna Ransomware is a nasty threat that will cause problems if it ever slithers onto your computer. To be more specific, it will mercilessly encrypt files and then will demand 100 USD from you. Never send a cent to malicious software developers because it is usually an ineffective solution to the problem. That is, crooks often do not unlock files/do not give the decryption tool after receiving the money sent to them by victims. The removal of the ransomware infection is what you should focus on instead.