The message in the _readme.txt note explains that all of victim’s files, including pictures, music, documents, videos and archives were encrypted with the “strongest” encryption algorithm and a unique key. After being encrypted, these files can no longer be opened, viewed or modified. This can be devastating for the computer not only because personal memories become corrupted, but also months or years of work or study materials. The cybercriminals then provide a solution – pay a ransom or the data will be lost forever. To open a channel of communication, the ransom note includes two email addresses that belong to cybercriminals – support@sysmail.ch and supportsys@airmail.cc. The ransom note also explains how the pricing of the decryption tool works. If the victim contacts the attackers within 3 days (72 hours), the price of it will be reduced by 50% to $490, and if the victim hesitates to write for the cybercriminals any longer, the price will be set to $980. In both scenarios, the criminals will only accept the payment made via cryptocurrency, as such transactions helps to keep them anonymous (meaning that law enforcement agencies such as FBI won’t be able to trace down the attackers). The _readme.txt note also suggests that victims can send one encrypted file (one that doesn’t contain any valuable information) via email for test decryption. This way, they want to encourage the victims to pay up. However, according to cybersecurity experts and the official FBI guidelines regarding ransomware attacks, you should NOT PAY THE RANSOM. Not only it doesn’t guarantee data recovery, but it also helps to fund further criminals’ operations. Moreover, paying a ransom might be forbidden in the area you live in; on top of that, keep in mind that STOP/DJVU variants like this virus tend to drag information-stealing malware such as AZORULT or VIDAR Trojan into the system. These are capable of stealing various banking information, browser-saved login credentials, in-app passwords, browsing history, cryptocurrency wallets and more. With their hands on such sensitive data, the attackers can continue to blackmail you further. All things considered, we strongly recommend you to remove WDLO ransomware virus from your computer as soon as you can. The best way to do it is running an up-to-date antivirus or anti-malware solution after booting your PC in Safe Mode with Networking (as explained in the tutorial below the article). If you’re hesitant which antivirus to use, you can rely on one recommended by our team – INTEGO Antivirus. In addition, you may find it useful to download RESTORO and scan your PC with it. The full version of this software can repair virus damage on Windows OS files successfully.

Ransomware Summary

REPAIR VIRUS DAMAGE

Most common ransomware distribution strategies

The most common way that STOP/DJVU ransomware variants such as WDLO virus are distributed is via pirated software versions. Cybercriminals promote these via torrents or rogue websites offering 100% free full software versions allegedly including software cracks and keygens. Illegally distributed software versions work as a bait for potential victims, however, often times the download itself doesn’t include anything related to the advertised program at all. Instead, the setup file pushed to the victim activates the ransomware which encrypts all of victim’s files stored on the computer system. Our research shows that the majority of STOP/DJVU ransomware victims were infected with the said malware after downloading pirated versions of these popular programs:

KMSPico (illegal Windows activation tool).Fifa 20;Microsoft Visio Pro;Tenorshare 4ukey;AutoCad;Opera browser;Cubase;Virtual DJ Pro;Microsoft Visio Pro;Corel Draw;Adobe Illustrator;League of Legends;VMware Workstation;Internet Download Manager;Adobe Photoshop;Various PC games and AV software.

In order to avoid getting infected, we strongly recommend that you avoid looking for pirated software versions made available via P2P networks and rogue sites online. Instead, you should visit the official software developer’s website and purchase a legitimate license key from there. After all, licenses for secure products always cost less than insane ransoms cybercriminals demand, not even to mention additional expenses resulting from private data loss. Finally, victims of STOP/DJVU ransomware variants should know that there are many scammers willing to take advantage of users who are already in less than unenviable situation. Watch out for deceptive websites offering data decryption tools as the downloads they offer might be filled with additional ransomware and other threats. Moreover, stay away from scammers suggesting they can recommend a “hacker” who can decrypt your files and promising they have recovered their files successfully. Such scammers might ask you for money and disappear. At the moment, the only tools that can be helpful in decrypting and repairing STOP/DJVU-affected files are from DiskTuna and Emsisoft as explained in this comprehensive guide on our site.

How this ransomware operates

If you’d like to learn mode about WDLO ransomware virus modus operandi, we believe this section will provide you with some answers. The ransomware begins the attack with its main executable which is named with 4 random characters. For example, it might be named as 1H7N.exe or 8B9M.exe. The malware also downloads two helper processes, usually named as build.exe or build2.exe, although we’ve seen samples using build3.exe in the wild as well. Some STOP/DJVU variants also drag a fake Windows update prompt under a name of winupdate.exe to trick the computer user into thinking the sudden system slowdown was caused by legitimate OS updating procedure. Before the virus begins attack on the files, it first attempts to find out infected computer’s physical location. For this matter, it connects to https[:]//api.2ip.ua/geo.json and downloads a file called geo.json. This file contains details such as computer’s IP address, country, city, zip code, timezone, longitude and latitude. Some examples of geo.json files we have collected during research are provided below. After finding out victim’s PC location, the virus compares it with its list of countries to avoid attacking. Security researchers have discovered that STOP/DJVU malware ceases its operations in case the compromised PC is situated in one of the following countries: Ukraine, Russian Federation, Syria, Armenia, Kyrgyzstan, Tajikistan, Kazachstan, Belarus, or Uzbekistan. It is unknown why, but cybersecurity experts suggest that it could be a clue that the ransomware operators are from one of the listed countries. However, if the ransomware detects that the infected computer’s country doesn’t match one from its exception list, it proceeds to the next stage. The virus creates a file called information.txt which contains details about the PC hardware, installed programs, and active processes. The virus also takes a screenshot of the desktop and sends these files to its Command&Control server. Shown below is an example of Information.txt file. Next, the ransomware attempts to establish a connection with its C&C server to obtain a unique encryption key for the victim. If it succeeds, the victim’s files will be affected with so-called “online encryption” which is impossible to reverse without a unique decryption key. In cases where the ransomware fails to obtain a key from its server (for example, because of poor Internet connection or if the server is temporarily down) it switches to using a hardcoded offline key for autonomous encryption. This is often referred to as “offline encryption” and is widely known to provide the victim with chances to decrypt files in the future. The way this works is that all victims affected by “offline encryption” are subject to the same decryption key, so if someone pays the ransom, receives the key and shares it with cybersecurity researchers, all victims affected by offline encryption can decrypt .wdlo files for free. However, finding the key in such way takes a long time, so victims should remain patient. One way or another, the malware saves encryption key along with victim’s ID into bowsakkdestx.txt file and the ID separately to PersonalID.txt file. Now, the assigned ID can reveal which encryption type was used. Go to C:\SystemID\PersonalID.txt and check the last two digits of the string located there. If these are t1, it indicates offline key encryption. In all other cases, online key was used. You can see examples of both files down below. After deciding which encryption type to use, the ransomware begins encrypting all files using Salsa20 and RSA-2048-bit key. During this procedure, each modified file will be marked with additional .wdlo extension to make affected data distinguishable. You can see how an affected data folder looks like below. In addition, the ransomware drops ransom-demanding notes called _readme.txt. Finally, the ransomware modifies Windows HOSTS file to block a set of Internet websites offering various helpful information for ransomware victims. Attempts to visit one of the blacklisted domains will result in DNS_PROBE_FINISHED_NXDOMAIN or similar error code in web browser.

Remove WDLO Ransomware Virus and Decrypt Your Files

If you have fallen victim to a file-encrypting malware attack as described above, you should not hesitate any longer and take action to remove WDLO ransomware virus along with other computer threats. We always recommend our visitors to keep their computers protected with an anti-malware or antivirus solution at all times, but in case you do not have it yet, we strongly recommend INTEGO Antivirus. Make sure you run it after booting your PC in Safe Mode with Networking as explained in the instructions provided below. Booting in this mode helps to deactivate malicious processes that might attempt to interfere with malware removal tool. In addition, we also suggest that you download RESTORO for best results. This tool is really useful when repairing Windows OS files affected by malware. If you’ve done with WDLO ransomware virus removal, you might want to take these additional tips into consideration:

Document the ransomware attack incident to a local law enforcement agency.Use data backup drives to recover the majority of encrypted files.Learn possible ways STOP/DJVU-encrypted files could be repaired or decrypted.Change all passwords used on the infected computer.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove WDLO Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove WDLO Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt WDLO files

Fix and open large WDLO files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. WDLO Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt WDLO files, follow the given tutorial.

Meanings of decryptor’s messages

The WDLO decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your WDLO extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of WDLO Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.