What is Worry ransomware?
Worry is a recently discovered virus that belongs to the Phobos family of ransomware. There are many other ransomware viruses in this family, such as Faust and MNX. As these viruses share most of their code, they’re generally very similar to each other.
Worry behaves like your typical ransomware program; its purpose is to encrypt the files on the victim’s computer and then demand money for the decryption. It also renames the files using the following pattern:
Original filename + original extension + the victim's ID + the hacker's e-mail + .worry file extension.
Worry creates two ransom notes, “info.hta” and “info.txt”. The first one is displayed automatically, as a pop-up, and cannot be closed. The second one is a simple text file. The pop-up note is pretty long, but doesn’t contain much information. It mentions two e-mail addresses belonging to the hackers and that the price depends on how quickly the victim pays (which may or may not be a lie). The text note is more concise; read it on the image above.
Although the hackers want you to believe that paying them is the only option available, this is not true. Alternative ways to remove Worry ransomware and decrypt .worry files do exist; the guide below will describe some of them.