How to remove Wana Decryptor (WannaCry) and restore .WNCRY files

The video demonstrates how Wana Decryptor (Wana Decrypt0r) ransomware works and ways to remove virus. Wana Decryptor adds to the file .WNCRY extension. It adds WanaDecryptor.bmp file and changes desktop background. There is no decryption tool now, unfortunately, but you can try to use special programs like Recuva or Shadow Explorer. Source article: http://it-help.info/how-to/malwares/3316-how-to-remove-Wanna-decryptor-virus
Wana Decryptor removal overview
Removing ransomware will not affect encrypted files, but it is necessary to make before downloading new information to a PC and even more, download a backup. If you do not remove the virus, then all of the data that will appear on the PC will also be encrypted, and your problem will be even bigger.
Step 1. Fix vulnerability of the system
Start - Cmd - Right click o cmd.exe - Choose Start as Administrator
Write next command and press Enter Netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="Block_TCP-445"
Step 2. Boot the system in the safe mode
Step 3. Show all hidden files and folders
Step 4. Remove virus files
Step 5. Fix hosts files
Step 6. Scan system with antivirus
Step 7. Disable safe mode
Step 8. Download security update MS17-010 for Windows: technet.microsoft.com/en-us/library/security/ms17-010.aspx

Antivirus tools:
Dr. Web, Avast, Kaspersky, Spyhunter
SpyHunter download link: http://pcfixhelp.net/removal-tool
Decryptor (not 100% result):
Kaspersky ransomware decryptor https://noransom.kaspersky.com/
Programs that restore files:
Recuva, ShadowBlade
More information about files restoration: http://pcfixhelp.net/viruses/2833-how-to-restore-files

Видео How to remove Wana Decryptor (WannaCry) and restore .WNCRY files канала PC Fix Help