Zeropadypt NextGen ransomware: what it is and how to remove it

From our report of Aug 2019 · not reviewed since

Zeropadypt NextGen ransomware is file locking malware that mostly infects users via the insecure 3389 RDP port

Zeropadypt NextGen is the second variant of the Zeropadypt ransomware and first started attacking users in early August 2019.

Unlike its predecessor which used to replace all the data of the file to zeros, this version actually encrypts data using the RSA encryption algorithm and appends either .lazurus or .limbo extension. From that point in time, victims are not capable of using pictures, documents, videos, databases, and other personal files.

Zeropadypt NextGen ransomware usually infects users with the help of poorly protected RDP connections that use the default port (3389). Crooks often scan the internet in the hopes of finding such connections and then brute force their way into the host computer, installing the malware manually.

Once inside, Zeropadypt NextGen ransomware performs various changes to the Windows OS and only then encrypts data. Additionally, it also drops a ransom note into each of the infected folders - Read-Me-Now.txt, which essentially explains the situation. Hackers claim that users need to pay for the decryption tool in order to recover data, and then contact them via the legion.developers72@gmail.com, BackFileHelp@protonmail.com, dcyptfils@protonmail.ch, letitbedecryptedzi@gmail.com, or RECOVERUNKNOWN@protonmail.com.

As a general rule, ransomware uses several methods to prevent users from recovering data after the encryption process is complete on their computers. Zeropadypt NextGen virus is no different, as it deletes Shadow Volume copies via the PowerShell commands.

Additionally, it loads several modules, opens/deletes/writes multiple files, connects to a remote server, and modifies Windows registry. All these alternations to the system ensure the malware is loaded at all times. In some cases, Zeropadypt NextGen ransomware removal might also be complicated, as security software might get disabled.

As soon as Zeropadypt NextGen ransomware completes the infection process and encrypts files, it drops the following ransom note:

Cybercriminals say that they offer free test decryption and also hurry to scare victims into paying sooner, as the required amount for the decryptor will be doubled within 48 hours of the Zeropadypt NextGen infection.

However, you should be warned the there is no way to check if the criminals will actually send you a working tool. Besides, paying hackers will only encourage them to improve their ransomware and release new, more advanced versions.

Therefore, rather do not engage in any discussions with cybercriminals and instead perform a full Zeropadypt NextGen ransomware removal. While getting rid of the infection manually is possible, it is way too complicated of a procedure for regular users.

Thus, if you got infected with the .lazurus or .limbo file virus, you should download and install anti-malware software that would detect all the malicious components of the malware and eliminate them - we suggest using , or , although other reputable tools might work just as well.

While it is true you need the private RSA key that hackers have to unlock your data, several other methods can be used for the purpose - they might be sometimes successful (such as Windows Previous Versions feature or third-party recovery software).

From our report of Aug 2019 · not reviewed since

Ways to avoid ransomware virus infections

In most of the cases, ransomware authors are sophisticated hackers who know their business.

They employ many different malware distribution methods, including exploits, spam emails, fake updates, software cracks, malicious or hacked sites, etc. Nevertheless, there is an indication that some bad actors prefer entering victims' machines manually with the help of insecure Remote Desktop Protocol connections.

They simply scan the internet for computers that are connected via the default 3389 port, and the launch an automated program which would apply most easily-guessed passwords to brute-force the way in. Once inside, hackers then implant the malicious payload manually.

Infections via the RDP connections became more prevalent by malicious actors, as they can, escalate privileges, increase malware prevalence, upload additional payloads, etc. Therefore, it is extremely important to adequately protect your connection when using Remote Desktop, i.e.:

Additionally, be generally careful when dealing with online content like spam email attachments/hyperlinks or downloading free software (do not download pirated programs or cracks!). Finally, employ reputable security software, update your operating system regularly, and backup your files.

• enable only internal network connections;
• use firewall;
• do not use the default port;
• disable RDP when not using it;
• use strong passwords;
• use a VPN.

From our report of Aug 2019 · not reviewed since

Delete Zeropadypt NextGen ransomware from your machine using reputable security tools

As we already mentioned, manual Zeropadypt NextGen ransomware removal is possible but is not recommended to regular users, as the malware changes alter various parts of the operating system, and reverting these changes would be truly complicated.

Instead, employ reputable anti-malware software, such as , , or another tool, and perform a full system scan. Depending on the version of Zeropadypt NextGen ransomware virus you are infected, it can be recognized by AV vendors as follows:

If the functionality of the malware prevents its termination by using anti-malware software, you can always access Safe Mode with Networking and remove Zeropadypt NextGen ransomware from there. For the file retrieval process, please refer to the recovery section below.

[GI=method-1]If Zeropadypt NextGen ransomware is tampering with your anti-virus software, you should enter Safe Mode with Networking as explained below:

[GI=method-2]You can also apply System restore to terminate the infection:

Make use of it by downloading and running a full scan in order to see if at least some data is recoverable:

Windows Previous Versions feature may be of use

This method is available if you had System Restore previously enabled:

In some cases, ShadowExplorer might save all your files

If you were lucky and Zeropadypt NextGen ransomware failed to remove Shadow Volume Copies, ShadowExplorer should be able to recover all your data.

No decryption tool is currently available

• TR/AD.OuroborosRansom.olerf
• Win32:Malware-gen
• Trojan:Win32/Occamy.C
• Ransom.Ouroboros
• Win/malicious_confidence_100% (W)
• Malware/Win32.Generic.C3372377, etc.