Remove Worry (WhatsWrongScared) Ransomware

---

Worry, also known as WhatsWrongScared, is a newly identified ransomware-type malware designed to encrypt files and extort money from its victims. This threat was discovered during an inspection of malware submissions on VirusTotal and follows the classic ransomware model — it locks users out of their files and demands payment for their release.

Upon infecting a system, Worry ransomware appends the “.WORRY” extension to encrypted files. For instance, a photo previously named 1.jpg would become 1.jpg.WORRY. Once encryption is complete, it creates a ransom note in a file titled “HELP_DECRYPT_YOUR_FILES.txt”. This note informs the victim about the encryption and demands $20 in Bitcoin to obtain a decryption key.

Worry (WhatsWrongScared) Ransomware Overview

This malware uses the RSA asymmetric encryption algorithm, which involves two keys — one for encryption and one for decryption. Without the private decryption key (held by the attackers), it is nearly impossible to recover files once encrypted.

Although the ransom demand ($20) is relatively low compared to many modern ransomware threats, paying the ransom is still not recommended. Cybercriminals often fail to provide working decryption tools, even after payment.

---

Threat Summary Table

Attribute	Details
Threat Name	Worry (WhatsWrongScared)
Threat Type	Ransomware, Crypto Virus, File Locker
Encrypted File Extension	.WORRY
Ransom Note File	HELP_DECRYPT_YOUR_FILES.txt
Ransom Amount	$20 in Bitcoin
Bitcoin Wallet	bc1q2rgae6kjysam5qsjr3gt6lx97cnrljgk0kmynx
Contact Email	whatswrongscareddd@gmail.com
Detection Names	Avast (Win32:RansomX-gen), Combo Cleaner (Generic.Ransom.Spora), Kaspersky (HEUR:Trojan-Ransom.MSIL.Encoder.gen), Microsoft (Ransom:MSIL/FileCoder.AB!MTB), ESET-NOD32 (A Variant Of MSIL/Filecoder.AK)
Symptoms	Inaccessible files, .WORRY extensions, ransom message displayed
Damage	Complete file encryption, potential for further malware infections
Distribution Methods	Malicious email attachments, torrent sites, fake updates, drive-by downloads
Danger Level	High – due to encryption strength and potential for added malware payloads

---

Text of the Ransom Note (“HELP_DECRYPT_YOUR_FILES.txt”)

Oops All Of your important files were encrypted Like document pictures videos etc..

Don't worry, you can return all your files!
All your files, documents, photos, databases and other important files are encrypted by a strong encryption.

How to recover files?
RSA is a asymmetric cryptographic algorithm, you need one key for encryption and one key for decryption so you need private key to recover your files. It’s not possible to recover your files without private key.
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.

What guarantees you have?
As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can decrypt your file

Please You must follow these steps carefully to decrypt your files:
Send $20 worth of bitcoin to wallet: bc1q2rgae6kjysam5qsjr3gt6lx97cnrljgk0kmynx
after payment, we will send you Decryptor software
contact email: whatswrongscareddd@gmail.com

Your personal ID: -

---

---

Worry (WhatsWrongScared) joins a growing list of ransomware strains like MRJOKERPALFINGER1984, CMLOCKER, and ESCANOR, all of which employ similar tactics: encrypt data and extort users. Each variant may vary in encryption methods and ransom size, but the result is the same — loss of data access and potential financial loss.

Victims are encouraged not to pay the ransom and instead focus on removing the ransomware from their systems using trusted antivirus software. However, decrypting files without the attackers’ key is currently not possible, and restoring from secure, offline backups remains the most effective recovery strategy.

---

Manual Ransomware Removal Guide

Warning: Manual removal is complex and risky. If not done correctly, it can lead to data loss or incomplete removal of ransomware. Only follow this method if you are an advanced user. If unsure, proceed with Method 2 (SpyHunter Removal Guide).

Step 1: Disconnect from the Internet

1. Unplug your Ethernet cable or disconnect Wi-Fi immediately to prevent further communication with the ransomware’s command and control (C2) servers.

Step 2: Boot into Safe Mode

For Windows Users:

1. For Windows 10, 11:
   • Press Windows + R, type msconfig, and hit Enter.
   • Go to the Boot tab.
   • Check Safe boot and select Network.
   • Click Apply and OK, then restart your PC.
2. For Windows 7, 8:
   • Restart your PC and press F8 repeatedly before Windows loads.
   • Select Safe Mode with Networking and press Enter.

For Mac Users:

1. Restart your Mac and immediately press and hold the Shift key.
2. Release the key once you see the Apple logo.
3. Your Mac will start in Safe Mode.

Step 3: Locate and Terminate Malicious Processes

For Windows Users:

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Look for suspicious processes (e.g., unknown names, high CPU usage, or random letters).
3. Right-click on the process and select End Task.

For Mac Users:

1. Open Activity Monitor (Finder > Applications > Utilities > Activity Monitor).
2. Look for unusual processes.
3. Select the process and click Force Quit.

Step 4: Delete Malicious Files

For Windows Users:

1. Press Windows + R, type %temp%, and hit Enter.
2. Delete all files in the Temp folder.
3. Navigate to:
   • C:\Users\[Your Username]\AppData\Roaming
   • C:\Users\[Your Username]\AppData\Local
   • C:\Windows\System32
4. Look for suspicious files related to the ransomware (random file names, recently modified) and delete them.

For Mac Users:

1. Open Finder and go to Go > Go to Folder.
2. Type ~/Library/Application Support and delete suspicious folders.
3. Navigate to ~/Library/LaunchAgents and remove unknown .plist files.

Step 5: Remove Ransomware from Registry or System Settings

For Windows Users:

Warning: Incorrect changes in the Registry Editor can damage your system. Proceed with caution.

1. Press Windows + R, type regedit, and hit Enter.
2. Navigate to:
   • HKEY_CURRENT_USER\Software
   • HKEY_LOCAL_MACHINE\Software
3. Look for unfamiliar folders with random characters or ransomware-related names.
4. Right-click and select Delete.

For Mac Users:

1. Go to System Preferences > Users & Groups.
2. Click on Login Items and remove any suspicious startup items.
3. Navigate to ~/Library/Preferences and remove malicious .plist files.

Step 6: Restore System Using System Restore (Windows) or Time Machine (Mac)

For Windows Users:

1. Press Windows + R, type rstrui, and hit Enter.
2. Click Next, choose a restore point before the infection, and follow the prompts to restore your system.

For Mac Users:

1. Restart your Mac and hold Command + R to enter macOS Utilities.
2. Select Restore from Time Machine Backup.
3. Choose a backup prior to the ransomware infection and restore your system.

Step 7: Use a Decryption Tool (If Available)

• Visit No More Ransom (www.nomoreransom.org) and check if a decryption tool is available for your ransomware variant.

Step 8: Recover Files Using Backup

• If you have backups on an external drive or cloud storage, restore your files.

---

Automatic Ransomware Removal Using SpyHunter

If manual removal seems too risky or complicated, using a reliable anti-malware tool like SpyHunter is the best alternative.

Step 1: Download SpyHunter

Download SpyHunter from the official link: Download SpyHunter

Or follow the official installation instructions here:
SpyHunter Download Instructions

Step 2: Install SpyHunter

1. Open the downloaded file (SpyHunter-Installer.exe).
2. Follow the on-screen prompts to install the program.
3. Once installed, launch SpyHunter.

Step 3: Perform a Full System Scan

1. Click on Start Scan Now.
2. SpyHunter will scan for ransomware and other malware.
3. Wait for the scan to complete.

Step 4: Remove Detected Threats

1. After the scan, SpyHunter will list all detected threats.
2. Click Fix Threats to remove the ransomware.

Step 5: Use SpyHunter’s Malware HelpDesk (If Needed)

If you are dealing with a stubborn ransomware variant, SpyHunter’s Malware HelpDesk provides custom fixes to remove advanced threats.

Step 6: Restore Your Files

If your files are encrypted:

• Try No More Ransom (www.nomoreransom.org) for decryption tools.
• Restore from cloud storage or external backups.

---

Preventing Future Ransomware Attacks

• Keep backups on an external hard drive or cloud storage.
• Use SpyHunter to detect threats before they infect your system.
• Enable Windows Defender or a trusted antivirus program.
• Avoid suspicious emails, attachments, and links.
• Update Windows, macOS & software regularly.