Severity scale:  
  (100/100)

Zoldon Crypter ransomware. How to remove? (Uninstall guide)

removal by Olivia Morelli - - | Type: Ransomware

Zoldon Crypter ransomware – a sophisticated file encrypting virus that also mines cyryptocurrency

Zoldon Crypter ransomware
Zoldon Crypter ransomware is a complex file encrypting virus that also drops Bitcoin Miner Pro V3.1.exe which mines crypto for hackers.

Zoldon ransomware is an advanced piece of malware that is capable of encrypting files and making them unusable, as well as injecting Bitcoin Miner Pro V3.1.exe that would secretly mine cryptocurrency on the infected machine. As soon as the payload is distributed, the malware encrypts all files using AES-256[1] cipher and displays ZOLDON Crypter V3.0 program that shows the ransom note. It urges users to contact cybercriminals via the zoldon-staff@mail.ru email after a payment of $150 in Bitcoin is transferred. Hackers also warn that the ransom size will be upped to $400 in 24 hours. Zoldon Crypter virus does not use any additional file extensions to encipher files.

SUMMARY
Name Zoldon Crypter
Type Ransomware/Trojan – cryptominer
Related files Bitcoin Miner Pro V3.1.exe, 
Ransom note ZOLDON Crypter V3.0
Cipher used AES-256
Extension None
Ransom size $150 in BTC ($400 in 24 hours)
Contact email zoldon-staff@mail.ru
Elimination Download and install Reimage or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

Zoldon Crypter ransomware can get into users' PCs via contaminated spam email attachments, from malicious JavaScripts[2] on compromised websites, as well as breakthrough via insecure RDP configuration. Therefore, certain precaution measures would profoundly decrease the chance of Zoldon virus infection.

Unlike viruses like Animus, FileEncrypted, Magniber, Zoldon ransomware does not add any extensions to the encrypted files. The ransom note DesktopZoldon.txt is also present but does not execute correctly due to the mistake in the code. Nevertheless, victims get all the information from the ZOLDON Crypter V3.0 application that is launched right after data encryption:

Alert: Your computer and Files are encrypted By Zoldon Virus
$150 within 24 hours. $400 after 24 hours

———–Write this information down———-
Email: zoldon-staff@mail.ru
———————————————————-
How to remove the virus?
After the payment send to Bitcoin Address,
send email to [zoldon-staff@mail.ru] containing Your Machine ID
Once payment is received, you will get the decryption password
and simple instructions to restore all your files and computer to normal instantly
Without the decryption password, you will not get them back.
If we do not reach the amount within 72 hours
We will punish all the contents of your device on the Internet
———————————————————-
IF YOU LOOSE THIS INFO, YOU WILL NOT BE ABLE TO CONTACT US

Although Zoldon virus authors try to scare users by declaring that their files will be lost within 24 hours, victims should not contact hackers and remove Zoldon ransomware trojan using reputable security software. We advise picking Reimage or Plumbytes Anti-MalwareMalwarebytes Malwarebytes.

Those who do contact criminals risk not only losing their file but also money. Security researchers[3] warn that malware authors often ignore victims and merely keep the money without giving the decryptor. Additionally, those who will successfully retrieve the decoder might be targeted by Zoldon Crypter developers again.

Although Zoldon ransomware is not decryptable yet, users should retrieve their files from a backup (such as external storage drives or remote server). Those who failed to prepare a backup before the virus struck can try using third-party applications to get their data. However, chances of such outcome are low, as Zoldon Crypter removes Shadow Volume copies.

While users may be devastated because of the encrypted personal files (malware targets databases, image files, pictures, videos, documents and similar), the virus also utilizes compromised machine's hardware to mine cryptocurrency for hackers. Such activity might result in high electricity bills, as well as lowered PC performance. For that reason, Zoldon Crypter ransomware removal should be performed as soon as possible.

Ransomware can affect anybody who is not careful enough online

While many people consider ransomware attacks something that they saw on the news, it is by far more accessible than one might think. Even users who avoid dodgy websites can be at risk. That is because malware has various distribution methods, and not everybody is aware of them. While there is no way to protect yourself 100%, but there are several precautions that can significantly reduce the chance of infection:

  • Do not open attachments of suspicious emails. Spam emails are one of the most prominent ransomware distribution techniques, merely because it is so effective and requires minimum effort from cybercriminals' side. Thus, beware that some phishing emails might look authentic, but hide malware payload inside.
  • Employ reputable security software. Those who neglect security measures and refuse to install anti-malware software are at the highest risk. Developers often update databases so that the newest viruses would be caught before infiltration.
  • Update your software promptly. Software vulnerabilities is another way for hackers to inject malware relatively easily. Security patches of popular software like Adobe or Flash are especially critical.
  • Stay aware from dubious sites. Visiting a compromised or a malicious website can result in malware infection (especially if PUP, such as adware is hiding inside the machine). Therefore, users should never click on suspicious ads and close down their browsers if they get redirected.
  • Use strong passwords. Never use the same password for multiple accounts, and make sure you change them often. Brute-force attacks are quite common when it comes to malware infiltration.

Delete Zoldon Crypter ransomware instead of contacting cybercrooks

If you were unlucky enough and contaminated your PC with Zoldon virus, you should not panic, as contacting cybercriminals is the worst idea. As we already mentioned, they can simply ignore you even after the payment is processed, making your lose not only your files but also money.

Therefore, you should hurry and remove Zoldon ransomware from your computer instead. However, do not try to perform the elimination manually, as the complex virus should only be removed by using professional security software. Of course, you can try to perform manual Zoldon Crypter removal if you are a trained IT professional.

Only after the Zoldon virus is removed, you can try to get your files back. You should use your backups if you had any. If not, your last hope is third-party software. You will find all the instructions below this article.

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove Zoldon Crypter virus, follow these steps:

Remove Zoldon Crypter using Safe Mode with Networking

To remove Zoldon virus safely, enter Safe Mode with Networking:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Zoldon Crypter

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Zoldon Crypter removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Zoldon Crypter using System Restore

You can also use System Restore to get rid of the virus:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Zoldon Crypter. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Zoldon Crypter removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Zoldon Crypter from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by Zoldon Crypter, you can use several methods to restore them:

Use Data Recovery Pro to get your files back

Data Recovery Pro is a tool that is perfect to restore corrupted or accidentally deleted files. However, security experts noticed that it can also help ransomware victims in some cases.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Zoldon Crypter ransomware;
  • Restore them.

Windows Previous Versions feature could successfully recover certain files

This is solution for victims who had System Restore feature enabled before the infection. However, the files can only be recovered one by one, so recovering a large amount of data might be impossible.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Try ShadowExplorer

ShadowExplorer will help you if the virus failed to eliminate Shadow Volume Copies.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

No decryptor is available yet

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Zoldon Crypter and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions

References