Zayka Ransomware - How to remove

Zayka Ransomware is just a new member of CryptoMix ransomware family. It is a new version of original CryptoMix infection, that can go by the name of Zayka Ransomware or NOOB ransomware. Even though names are different and extensions they add to the end of locked files are either .ZAYKA or .NOOB, they both use the same e-mail address for ransom payments at [email protected] thus we assume that those two viruses come from the same family and is obviously related.

This infection operates the same as most of other ransomware viruses – first of all it will inspect your computer, looking for a files that can be locked. Once inspection is over, it will add .ZAYKA extension to most of the files stored on your computer. It is called encryption – once it’s done, you no longer can open or use those files.

After encryption process if over, you will notice a new text file on your desktop called “_HELP_INSTRUCTION.TXT”. It is so-called ransom note that will provide you with full details how to pay the ransom and retrieve locked files. Original text from the file:

[HAT HAPPENED]
Your important files produced on this computer have been encrypted due a security problem
If you want to restore them, write us to the e-mail: [email protected]
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

[FREE DECRYPTION AS GUARANTEE]
Before paying you can send to us up to 3 files for free decryption.
Please note that files must NOT contain valuable information
and their total size must be less than 1Mb

[HOW TO OBTAIN BITCOINS]
The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller
by payment method and price
https://localbitcoins.com/buy_bitcoins

[ATTENTION]
Do not rename encrypted files
Do not try to decrypt your data using third party software, it may cause permanent data loss
If you not write on e-mail in 36 hours – your key has been deleted and you cant decrypt your file

As you can see, crooks behind this infection is trying to get you scared and force to pay the ransom as they say that you must contact them within 36 hours, otherwise the key that could unlock your files would be deleted permanently. However, don’t do that – there is no guarantees that you will get your files even after paying the ransom. We have reported multiple occasions when cyber criminals just vanished after the payment of ransom and users were left without both – their money and files. Besides that, by paying the ransom you would support cyber criminals so they can continue their work and produce more viruses.

Where did it came from and what should I do?

Usually trojans travel as an attachment to emails. 9 times out of 10 those emails fall into the spam category on your inbox, thus the best solution in order to prevent ransomware and other viruses is simply to avoid emails from that category. More important – never open any attachments to those spam emails. Usually they contain malicious code inside which is executed as soon as you open it. We also recommend to set regular backups of your system – it’s one of the few efficient methods to keep your computer save. You can use dedicated software or default back-up features on your OS. It is also important to save those back-up files on external storage or cloud because if you keep them on your hard drive, they can be encrypted by the ransomware as well.

How to recover Zayka Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before NOOB ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Zayka Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to NOOB ransomware. You can check other tools here.  

Step 3. Restore Zayka Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually NOOB ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Zayka Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.

Manual removal