WRUI virus encrypts your files. It adds a .wrui extension to them. Then you cannot open files. The ransom note demands $490 to $980 to get a decrypt key. Wrui belongs to the STOP/DJVU ransomware family. It uses an RSA encryption algorithm.
This locks files. Then it appends the .wrui extension. Users cannot access infected data without the decrypt tool and key. Attackers offer this for a ransom in Bitcoin. Wrui encrypts only 150KB of each file. So you may open big files like videos or music without decryption.
You can try renaming .wrui files to their original extension. For example, rename yourjpg.wrui to yourjpg.jpg. This may work for some files. Emsisoft’s decryptor works only for some STOP variants using offline keys.
Wrui is distributed by spam, bundles, porn and torrents. Even if you pay, it can blackmail you again. But file recovery tools may restore files. Act quickly before more encryption.
When first infected, Wrui scans for files like images, videos, Word docs and PDFs. Then it encrypts and restricts access, demanding Bitcoin to decrypt. Try file recovery tools to get files back. Act quickly before more encryption.
Windows Recovery Environment