How to remove Z61yt ransomware

Z61yt ransomware is a file-locking virus that holds personal files hostage until a ransom is paid

Z61yt ransomware is a malicious Windows program written in the Go programming language. The main goal of the attack is to ensure that all the files on the computer or its network are encrypted with strong RSA + AES encryption algorithms.^[1] Once this task is complete, all the files acquire a .z61yt extension, which is also accompanied by a random string.

Suchlike data can no longer be modified or used in any other way, essentially making the information on the locked files useless. It is noteworthy that they are not corrupted by locked by a unique encryption key, which is stored on the attackers' servers. Evidently, cybercriminals don't want to provide a decryptor for free, so victims are being forced to pay.

According to the ransom note 1uZ5_HOW_TO_DECRYPT.txt, users should contact the crooks via WhatsApp +1 (845)682-0537, which we do not recommend doing. Instead, follow the alternative solutions we provide below.

The Z61yt virus stems from a family known as Hive ransomware, which is predominantly known for attacking organizations, businesses, and other corporate entities. It does not exclude home users from getting infected with this malware, however.

Operates as doxware

The main goal of Z61yt ransomware authors is to extort money from their victims. Usually, file-locking malware that attacks home users makes file encryption its main focus – cybercrooks ensure that the encryption process is not bugged and that the ransom note (which is used for communication purposes) is always delivered upon infiltration.

However, ransomware that targets businesses and organizations works quite a bit differently, especially as of late. Corporate entities almost always have working backups prepared, which guarantees that, in a case of a disaster, hardware failure, or malware attack, all the relevant information is not lost. This is a huge disadvantage for ransomware operators, as most companies would not pay the ransom if they could restore files from backups instead.

Thus, a few years ago, malware developers came up with a new scheme, one that would increase the probability of money being paid regardless of whether backups are available or not. We are talking about double extortion, where the attackers would steal sensitive information from the company before deploying ransomware and later threaten to release corporate secrets for other malicious parties or everyone to access.

This type of extortion method is known as doxware^[2] and has been extremely prevalent due to its efficiency. Companies have to treat each such attack as a data breach and are inclined to pay for the attackers not to publish the sensitive information. Z61yt ransomware is a perfect example of this practice.

Why you shouldn't pay

The FBI and security researchers always advise against paying or even contacting cybercriminals.^[3] Crooks may never send the decryptor or deliver one that doesn't work (or even an infected tool that would install other malware on the device), which would end up with victims losing not only their files but also money. Likewise, paying cybercriminals only encourages them to develop their ransomware and infect more users/companies worldwide, as it proves that their illegal money-making scheme works as intended.

It is understandable though, why victims would decide to pay despite all this. Sensitive data disclosure can end very badly, and they're even have been establishment closures due to the devastating consequences of a ransomware attack. Nonetheless, the risks are great when paying, as hackers may target victims again later, knowing they are willing to pay.

Malware removal

Evidently, we recommend not paying the ransom and instead, dealing with a ransomware attack in a different, more secure way. The first task is to remove malware from the system and all the networked machines if such were present. In order to prevent malware from communicating with the attackers, the first step is to sever the internet and network connection:

• Type in Control Panel in Windows search and press Enter
• Go to Network and Internet
• Click Network and Sharing Center
• On the left, pick Change adapter settings
• Right-click on your connection (for example, Ethernet), and select Disable
• Confirm with Yes.

Once there are no longer connections, it is time to remove Z61yt ransomware from the system. While manual virus elimination is possible, it is not recommended – security software is the way to go. SpyHunterCombo Cleaner or MalwarebytesMalwarebytes can be used to automatically find and remove all the malicious components from the system. Besides, security software is your first line of defense when it comes to malware attacks, as the best thing to do is not to get infected in the first place.

After the infection is terminated, we recommend using the FortectIntego PC repair tool. Once affected by some type of malware, Windows system files might get corrupted, and security software would not be able to deal with that. As a result, after malware removal, users might experience system crashes, BSODs, errors, and other common technical issues. The repair tool can target damaged system files and replace them with brand new ones.

Data recovery

Fine encryption is a complicated matter, as a complex string is used to lock and unlock the data. This password is accessible only to crooks, and deciphering it without having access to it is almost impossible. Even supercomputers would struggle with calculating such a complex string. Thus, recovering data after a ransomware attack without having backups is rather difficult, if not impossible.

However, we recommend trying alternative methods that could be effective for some victims. Data recovery software might sometimes be useful if the encryption process was not performed optimally. Waiting some time might also be effective, as security researchers constantly work on delivering free decryptors for victims of ransomware. Note that you should make backups of your locked files if you do not have proper backups available before proceeding with the instructions below.