How to Get Rid of CovidWorldCry Ransomware

Cybercriminals are coming up with new and more cunning ways of infiltrating other people’s devices to steal their data, information, or even money. They use malicious software that targets huge corporations, businesses, and individuals. A good example is the CovidWorldCry ransomware, which is somewhat the new kid on the block (discovered in late May 2020).

What is CovidWorldCry Ransomware?

This is a new COVID-19-themed virus that is also known as BigLock or CoronaLock. It locks the data and some system files stored on the infected machine, and asks for a ransom in the form of Bitcoin. The malware not only encrypts the data but also modifies the Windows boot stage, which is quite unusual for ransomware as most of them only encrypt user-related files.

The ransomware was released in two different versions, and it uses ChaCha + AES encryption algorithms to lock pictures, images, videos, files, databases, and other personal files on the host computer.

What Can CovidWorldCry Ransomware Do?

Once it has gotten into your computer, the ransomware does not start encrypting files right away. It first prepares the host for proper file locking by infecting all files stored on it. After successful infection, the virus then performs the following:

• Deletes Shadow Volume copies
• Manipulates the storage size attributed for Shadow Volume copies
• Initiates changes within the registry
• Terminates processes and starts new ones
• Drops many malicious files on the system

After the infection process, data stored in the device is locked, and users can no longer gain access to it. The encrypted files are renamed by appending the malware’s extension “.corona-lock.”

How Is the Data-Locking Virus Spread?

CovidWorldCry ransomware spreads via the Rig Exploit kit as the primary attack vector. If you notice double encryption, it means that your device was infected with CovidWorldCry ransomware alongside Djvu. Such secondary infections are difficult to get rid of.

Since CovidWorldCry ransomware is mostly distributed via exploit kits, users who have vulnerable software on their computers are at a higher risk of infection.

How to Remove CovidWorldCry Ransomware

The first thing you need to do is remove the ransomware using a reliable antivirus software.

All the locked data requires a particular key to unlock. If you can’t get that key to decipher the already encrypted data, what do you do? Don’t worry – we’ll show you how to get rid of CovidWorldCry ransomware safely using other methods without the key:

OPTION ONE: Using Safe Mode

Carry out the following procedure to remove CovidWorldCry ransomware using Safe Mode with Networking:

Step 1: Restart your computer in Safe Mode with Networking

Windows XP/Vista/7

1. Click “Start” then “Shut Down,” followed by “Restart..”
2. As the computer restarts, press F8 several times.
3. A “Windows Advanced Option” menu appears.
4. Choose “Safe Mode with Networking.”

Windows 8/10

1. Click on the “Power” button at the login screen.
2. Long-press the “Shift” key.
3. Press “Restart.”
4. Choose “Troubleshoot.”
5. Select “Advanced Options.”
6. Go to “Startup Options,” then “Restart.”
7. When the computer restarts into the “Startup Settings” screen.
8. Press F5 or click “Enable Safe Mode with Networking.”

Step 2: Remove the ransomware

1. Log into the infected account.
2. Start the browser.
3. Download and install a robust security tool.
4. Scan and remove malicious files.
5. CovidWorldCry ransomware removal is complete.

OPTION TWO: Using System Restore

Follow instructions below to remove CovidWorldCry ransomware using System Restore:

Step 1: Restart your computer in Safe Mode with Command Prompt

Windows XP/Vista/7

1. Click on the “Start” button, then select “Shut Down.”
2. Press “Restart.”
3. Choose “Ok.”
4. Press F8 multiple times.
5. An “Advanced Boot Options” window pops up.
6. Go to “Command Prompt.”

Windows 8/10

1. Press the “Power” button at the login screen.
2. Long-press on the “Shift” key.
3. Select “Restart.”
4. Go to “Troubleshoot.”
5. Choose “Advanced Options,” then “Startup Settings,” then “Restart.”
6. When the computer restarts, a “Startup Settings” window will show.
7. Select “Enable Safe Mode with Command Prompt.”

Step 2: Restore the system files and settings

1. In the Command Prompt window, enter “cd restore.”
2. Press the “Enter” key.
3. Type “rstrui.exe“
4. Press the “Enter” key again.
5. A new window will pop up. Click “Next.”
6. Select your restore point. It is ideal to choose a restore point before the CovidWorldCry ransomware attack.
7. Choose “Yes” to start the System Restore

Once you have completed this process, it’s still advisable that you scan your computer using a robust antivirus program.

Conclusion

Any kind of infection on your phone or PC can be devastating. Not only do you lose your data, but you also risk having your personal information being exposed. This means that you always have to ensure that your device is protected from infections at all times using a reputable antivirus program. These are also very useful when it comes to scanning and removing the CovidWorldCry ransomware as well as reversing the damage. You should also make sure that you maintain regular up-to-date backups to a remote server like the cloud. At the moment, no decryption tool is available.