How to remove WannaCry virus from your computer

WannaCry ransomware is a major ransomware attack that has hit thousands of computer systems across 100 countries. Follow these steps to remove the virus from your computer.

| Published: Monday, May 15, 2017, 12:55 [IST]

A few days back, the whole world experienced the wrath of a major ransomware attack called WannaCry. This is one of the largest ever cyber attacks that hit over 100 countries at the same time taking down thousands of computer systems.

How to remove WannaCry virus from your computer

There are different types of malware that can affect a computer and these include those that are meant to steal your information and those that just erase all the data on your computer. But ransomware is different. It is a kind of malware that prevents you from accessing your device and data stored on it until a specific amount is paid to the hacker or the creator of the same. Ransomware locks computers and encrypts the data stored on it and also prevents apps and software from running.

Understanding Ransomware Understanding Ransomware

Due to the WannaCry ransomware attack, critical infrastructure across the world including airports, police department, banks, telecom networks, and stock markets were affected. Everyone is asked to take necessary precautionary steps to stay safe from the crippling ransomware attack.

Stay safe from ransomware

First, you need to know how you can stay safe from ransomware. You can do it by following the below-mentioned steps.

Backup your data immediately
Update your system with the recent fix from Microsoft
Update the operating system
Clear the suspicious emails and websites
Use a firewall to prevent ransomware from entering your system
Do not open emails with suspicious attachments
Don't pay the hackers

How to remove WannaCry virus from your computer?

Here are a few steps that you need to follow to remove the Wanna Cry ransomware from your system.
In order to troubleshoot the issue and remove the Wanna Cry ransomware from your computer, you need to enter the Safe Mode on your system.

Spot the process

The next step is to spot the process. To do this, you need open the Task Manager by pressing Ctrl + Shift + Esc and go to the processes tab. Here you need to find out for the shady entries from the list of processes. Remember that malicious processes will consume a large amount of CPU and RAM and miss out on the description. On spotting the process that contains the virus, you need to right click on the same and select Open File Location. Then, decent all the contents of the folder than opens. Head back to Task Manager and end the harmful process.

Also read: New ransomware attack hits 100 countries in one day

System Configuration Startup Programs

Go to the Windows search bar and type System Configuration in the Windows search bar and open the first result. Head on to the Startup tab and take a look at the list of startup programs. If there is any shady or unknown programs, uncheck those entries and click on OK.

Registry

The next step is to open the Run window (WinKey + R), type regedit and hit Enter. Once the Registry Editor opens, press Ctrl + F and type the name of the specific virus. Select Find Next and delete whatever is found with the virus name. The same has to be done with all the search results.

Deleting potential virus files

Open the Start Menu and type each of the following locations: %AppData% %LocalAppData% %ProgramData% %WinDir% %Temp% separately. Open these folders and sort their contents by the modified date. Now, you need to delete the most recent files and folders. Delete all the contents in the Temp folder.