1 of 3
Danger level 7
Type: Trojans
Common infection symptoms:
  • Slow Computer
  • System crashes
  • Normal system programs crash immediatelly
  • Connects to the internet without permission
  • Installs itself without permissions
  • Can't be uninstalled via Control Panel

WantMoney Ransomware

If you see a window with WantMoney Ransomware at the top and a padlock in the middle informing that “All files have been encrypted!” and, on top of that, the majority of your files contain .{a unique string of letters}.Encrypted[B32588601@163.com].WantMoney, WantMoney Ransomware must be installed on your computer. It is considered that ransomware infections usually slither onto users’ computers illegally, but it seems that users themselves contribute to the entrance of malicious software to a great extent as well. You could have allowed WantMoney Ransomware to enter your system by simply opening a malicious attachment from a spam email or clicking on a malicious link once. Crypto-malware does not try to stay unnoticed on users’ computers. It starts working the second it infiltrates users’ computers. Are you reading this article because you have already found this infection on your computer too? If the answer to this question is “yes,” you should erase the ransomware infection from your system right away because it stays active after encrypting files on compromised machines. Most likely, its removal will not be very easy because it is one of those sophisticated threats that make a number of modifications on affected computers. This is the reason we suggest that you first read this article till the end before you go to delete WantMoney Ransomware as well.

Without a doubt, WantMoney Ransomware wants users’ money. To give them a reason to make a payment, this ransomware infection locks files (e.g. pictures, documents, music, etc.) it finds on computers it affects. Then, it sets a new picture with a ransom note as a Wallpaper, opens a window with the same ransom note, and creates a file _Want Money_.txt. Also, victims should hear music playing. No matter you check the window opened, the .txt file, or the new Wallpaper, you will find a ransom note both in Chinese and English there, which suggests that this infection might target Chinese and English-speaking users primarily. Needless to say, it might affect computers no matter where their owners live. All ransomware infections want users’ money, so we are sure WantMoney Ransomware will demand money from you either after locking files found on your computer. It should ask 0.1 Bitcoin (~ 1 898 USD at today’s price), but the size of the ransom might vary. Users also need to send an email with a unique ID and payment information after transferring the required money to B32588601@163.com. Even though cyber criminals behind this threat promise to send the decryptor to users immediately after receiving their money, do not be so sure that you could decrypt your files after making a payment. There are many cases when users get nothing from crooks, so we are strictly against sending money to malicious software developers. You cannot do much to unlock your files. You can only restore them from a backup for free. Of course, we do not know what will happen in the future – specialists working in the cyber security department might release free decryption software one day, so do not hurry to delete those encrypted files. It goes without saying that you cannot keep the ransomware infection active on your computer.

Research has clearly shown that WantMoney Ransomware not only encrypts files it finds on users’ computers, but it also makes it impossible to access Task Manager and Registry Editor. Without a doubt, it does that so that it would be considerably harder to delete it. Do not expect that you could disable this threat by simply rebooting your computer because it makes modifications in the system registry that allow it to continue working after the system restart.

You need to remove WantMoney Ransomware right away if you have encountered it. To be able to remove it, you need to boot into Safe Mode or Safe Mode with Networking (if you want to acquire an automated malware remover). You should use the manual removal instructions provided below this article if it is the first time you go to delete crypto-malware from your computer manually. Unfortunately, it is impossible to unlock files at the moment. You could not access them even if you erase the ransomware infection fully from your computer.

How to delete WantMoney Ransomware manually

Boot into Safe Mode or Safe Mode with Networking

Windows 7/XP/Vista

  1. Restart your computer.
  2. Start tapping F8 on your keyboard.
  3. When the Advanced Boot Options menu appears, select Safe Mode or Safe Mode with Networking using arrow keys.
  4. Press Enter.

Windows 8/8.1

  1. Press and hold the Shift key.
  2. Click Power and then click Restart.
  3. Click Troubleshoot.
  4. Click Advanced options.
  5. Click Startup Settings.
  6. Click the Restart button.
  7. Press F4 to enable Safe Mode or F5 to enable Safe Mode with Networking.

Windows 10

  1. Select the Start button and then choose Settings.
  2. Access Update & security.
  3. Click Recovery.
  4. Under Advanced startup, click Restart now.
  5. Click Troubleshoot.
  6. Select Advanced options.
  7. Click Startup Settings.
  8. Click Restart.
  9. Press F4 (Safe Mode) or F5 (Safe Mode with Networking).

Delete files

  1. Press Win+R.
  2. Type regedit.exe and click OK.
  3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run.
  4. Find the Want Money Value, check its Value data, and open the directory it points to.
  5. Delete the malicious executable file.
  6. Close Registry Editor and press Win+E.
  7. Delete Want Money.lnk from these directories:
  • %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
  • %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
  • %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
  • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
  • %ALLUSERSPROFILE%\Start Menu\Programs\Startup
  1. Open %USERPROFILE%\Desktop.
  2. Delete _Want Money_.bmp and _Want Money_.txt.
  3. Open %HOMEDRIVE%.
  4. Remove _Want Money_.bmp and _Want Money_.txt.
  5. Empty Recycle bin.

Delete entries from the system registry

  1. Launch Run (press Win+R).
  2. Type regedit and press Enter.
  3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run.
  4. Delete the Want Money Value.
  5. Remove the following entries one by one:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney15
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney17
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney18
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney19
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney20
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney21
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney22
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney23
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney24
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney25
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney26
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney27
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney28
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney29
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WantMoney30
Download Spyware Removal Tool to Remove* WantMoney Ransomware
  • Quick & tested solution for WantMoney Ransomware removal.
  • 100% Free Scan for Windows
disclaimer
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.