Widia Ransomware

The Widia Ransomware is presented as an encryption ransomware Trojan. However, the Widia Ransomware is not an encryption ransomware Trojan but instead, it carries out a screen locker attack, scaring computer users into paying a ransom but it is incapable of encrypting the victims' files. However, updated versions of the Widia Ransomware could be engineering to follow through on their threats and corrupt victims' data in the attack possibly. The main purpose of the Widia Ransomware is to scare computer users into believing that their machines have been infected with an encryption ransomware Trojan designed to encrypt their files. The Widia Ransomware does this to demand a ransom payment from the victim, but merely scares victims and can be removed relatively easily.

How the Widia Ransomware may Attack a Computer

The Widia Ransomware infection is simple to understand: the Widia Ransomware blocks access to the computer by displaying a screen locker message, a large window that cannot be closed or bypassed. As part of its attack, the Widia Ransomware will block Windows components and programs that could be used to recover from these attacks, such as the Windows Task Manager or the Registry Editor. PC security researchers have linked the Widia Ransomware variants to corrupted files with the following names (with new variants being added to this list constantly):

• Wd0w.exe
• b60e87widia.exe
• client.exe
• oobelx.dt
• oops.rr

As soon as the Widia Ransomware is installed, it makes changes to the Windows Registry that allow the Widia Ransomware to run whenever the infected computer starts up automatically. Once the Widia Ransomware is running, it prevents the victim from accessing the Internet or using the infected computer effectively. One aspect of the Widia Ransomware that is fairly unique is that the Widia Ransomware includes various obfuscation measures that are designed to prevent PC security researchers from studying and counteracting the Widia Ransomware threat. The most common way in which the Widia Ransomware is distributed to victims is through the use of corrupted email attachments delivered using spam email messages.

The Widia Ransomware Infection and Its Threatening Message

Once the Widia Ransomware has entered the victim's computer, it will make various changes to the infected computer's settings, allowing the Widia Ransomware to prevent the victims from accessing their files normally. The Widia Ransomware's lock screen contains the following text:

'W I D I A
Your documents, photos, databases and other important files have been encrypted with the strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server, and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.
[COUNTDOWN OF 24 HOURS]
Credit card no:
[TEXT BOX]
CC Holder name:
[TEXT BOX]
Expiration date: Security:
[TEXT BOX] [TEXT BOX]'

It's possible that the Widia Ransomware is unfinished since it's clear that it did not include a ransom amount. One especially odd aspect of the Widia Ransomware is that it demands credit card data, where other ransomware Trojans may prefer anonymous payment methods such as the use of BitCoins. This indicates that the Widia Ransomware may be designed to gather credit card data from victims, which may used in credit card fraud and identity theft. However, malware researchers have noted another problem with a Widia Ransomware infection, which also may indicate that the Widia Ransomware is unfinished: the Widia Ransomware does not communicate with its Command and Control server (meaning that it does not relay the payment data to a third party in its current version. )

Dealing with the Widia Ransomware

Fortunately, the Widia Ransomware can be removed easily with the help of a security program that is fully up-to-date. The main obstacle in dealing with the Widia Ransomware is to regain access to the infected computer. Starting up the PC using Safe Mode or another alternate start-up method can help computer users bypass the Widia Ransomware lock screen.