Angus Ransomware (Zeropadypt variant)

The malicious Angus Ransomware (Zeropadypt variant) is a dangerous Windows infection that can successfully encrypt your most personal and most valued files. The infection does not encrypt .EXE files, which means that it does not touch the executables of applications. Nonetheless, it does not spare personal files that are located in the %USERPROFILE% and %APPDATA% directories and their subfolders. It even can encrypt files in %PROGRAMFILES(X86)%. That means that your photos, videos, music files, documents, archives, and other personal files can be corrupted. Although it would be unfair to say that the encrypted files are destroyed, they are as good as destroyed because decrypting them is not possible. At the time of research, a free tool that would successfully restore the corrupted files did not exist, and it was not possible to do it manually. This aids the devious cybercriminals behind the infection because they can be more successful at tricking people into paying for their decryption tool. Should you pay for it? We recommend that you focus on the removal of Angus Ransomware (Zeropadypt variant).

Angus Ransomware is likely to be spread with the help of spam emails. The attackers could also use messaging apps to expose vulnerable users to the installer of the infection. If you are tricked into letting this malware in, it encrypts files instantly. Then, a file named “HowToDecrypt.txt” is created in every folder that was affected by malware. This file belongs to malware, but it is safe for you to open it before removing it. The message inside informs that a “decryption tool” must be obtained if the victim wants to get their files restored. According to the included instructions, a unique ID code included in the message must be sent to Legion.developers72@gmail.com along with one 1MB file. The attackers promise to decrypt it for free, but even if they do that, you must not assume that all of your files would be decrypted if you paid a ransom requested by the attackers. That is what you would be requested to do if you decided to send an email to the attackers behind Angus Ransomware (Zeropadypt variant). We do not know how much the attackers want, but we know that they want you to pay the ransom in Bitcoin.

If you believe that your files would be decrypted as soon as you deleted Angus Ransomware (Zeropadypt variant), we have bad news for you. In fact, it is most likely that this malicious threat has already deleted itself from your operating system. That is what it is programmed to do after successful encryption. Many malicious file-encryptors have this feature, including HACK Ransomware or COPAN Ransomware. The thing is that the attackers behind this malware have no use for it once all files are encrypted. As long as the ransom note exists, they can reach their goal of extorting money from gullible victims. Unfortunately, even though the attackers promise to provide you with an effective decryptor if you pay the ransom, their promises cannot be trusted. Of course, if you understand the risk, and you still want to take it, no one will stop you. However, if you value your virtual privacy, at least create a new email account because once the attackers know your real email address, they could try to scam you again and again.

As we have mentioned already, it is likely that Angus Ransomware (Zeropadypt variant) deleted itself already. That being said, we cannot make any promises, and inspecting the operating system to check for malware is the smart thing to do. Employ a trusted malware scanner if you decide to take the manual removal route, or, better yet, employ an anti-malware program you trust. It is high time you secured your operating system because even if the tool does not find any traces of Angus Ransomware, there are plenty of other malicious infections that could attack you. Protecting your operating system is not the only thing you need to take care of. It is also important that you backup the remaining personal files. Perhaps your files were backed up in the past? If that is the case, you can easily replace the encrypted files. Since there are thousands of file-encryptors out there, we suggest creating backups outside the computer as insurance.

Angus Ransomware (Zeropadypt variant) Removal

1. Delete the ransom note file named HowToDecrypt.txt.
2. Tap keys Win+E on keyboard to launch Windows Explorer.
3. Enter the following paths into the field at the top to look for and Delete malicious files:
   • %USERPROFILE%\Desktop
   • %USERPROFILE%\Downloads
   • %TEMP%
4. Close Explorer and then Empty Recycle Bin.
5. Perform a full system scan using a trustworthy malware scanner.