ZeroCrypt Ransomware

ZeroCrypt Ransomware is an aggressive infection that goes after your personal files found on your personal computer. According to our research, this threat even targets the files in the folders located under %WINDIR%, which is uncommon. At this time, we do not have a full list of files that this threat can attack, but we are sure that it is primarily targeted at personal files, such as documents, photos, audio files, archives, videos, etc. When these files are encrypted – which is done using the complicated RSA-1024 encryption algorithm – they get the “.zn2016” extension added to their names, which makes it very easy to assess the damage. So, what should you do to decrypt your files? Is it even possible? We discuss this, as well as the removal of ZeroCrypt Ransomware, in this report.

The malicious ZeroCrypt Ransomware would not be able to encrypt your files without slithering into your operating system first. So, how did this happen? According to our analysis, it is most likely that you have unleashed this threat by opening a malicious launcher attached to a spam email. Corrupted spam emails are used by Cocoslim98@gmail.com Ransomware, Princess Locker Ransomware, and hundreds of other malicious ransomware threats. As soon as the infection is executed, it copies itself to a folder named “ZeroCrypt” under %LOCALAPPDATA%. According to our research, the name of the malicious .exe file is random, but it should not be difficult to identify it if it is placed in this folder. Besides that, the threat also creates a point of execution in HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The name of the value should be ZeroCrypt, and the value data should point to the malicious .exe file. The thing is that the ransomware is not hiding itself because its creators are not afraid of you deleting it.

As soon as the files are encrypted, ZeroCrypt Ransomware creates ZEROCRYPT_RECOVER_INFO.txt, a file that delivers the ransom note. The message informs that you cannot decrypt the files without having a decryption program or a “secret key,” which is not a lie. The creator of the ransomware protects this file in a remote server, and you have no way of gaining access to it, unless you pay a ransom. The ransom note informs that you can get the decryption key by sending 10 Bitcoins (7,349 USD) or the decryption program by sending 100 Bitcoins (73,490 USD) to 1KCqVgHEXMw8mhSuz1LWmPSNskARRivY57. The note also states that you need to email zerocrypt2016@gmail.com as soon as you make the transaction. Do you have that kind of money? If you do, do you think that your personal files are worth it? If by some crazy chance you are willing to pay the ransom, you need to understand that cyber criminals are not accountable. They could take your money without providing you with a decryption tool or key!

So, what happens if you delete ZeroCrypt Ransomware? The components of the infection will be gone, but your files will remain encrypted. The first thing you need to do is check your backups (e.g., external drives or online cloud storage) to check if you have backups of your most precious files. Obviously, you need to do that via a malware-free computer. If you have not backed up personal files, your best bet would be looking into legitimate file decryptors. Only in rare cases are these decryptors capable of decrypting the files affected by ransomware, but you should look into this anyway. Of course, if you do not find a solution, you might have to remove ZeroCrypt Ransomware along with the corrupted files.

As mentioned already, it is very easy to get rid of ZeroCrypt Ransomware. This malicious threat does not hide itself, and its elimination is pretty straightforward. Having said that, the ransomware is not the only thing you should focus on. You also need to realize that your operating system is extremely vulnerable, and it is obvious how easy it is for malicious threats to attack it. If you want to make sure that dangerous infections cannot slither in again, you have to think about protection. The good news is that you can get rid of existing threats and secure your operating system simultaneously. All you have to do is install a trusted anti-malware tool that will take care of all security problems automatically.

ZeroCrypt Ransomware Removal

1. Launch Explorer by tapping Win+E keys together.
2. Enter %LOCALAPPDATA% (enter %UserProfile%\Local Settings\Application Data\ if you are on Windows XP) into the address bar.
3. Right-click and Delete the folder named ZeroCrypt (it contains the malicious {unknown name}.exe file).
4. Launch RUN by tapping Win+R keys together.
5. Type regedit.exe into the dialog box and click OK to launch Registry Editor.
6. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
7. Right-click and Delete the value named ZeroCrypt (the value data should reveal the location of the malicious {unknown name}.exe file).