NYPD ransomware locks personal files, demands $490-$980 as a ransom
NYPD ransomware is a new version of STOP/DJVU virus family that encrypts data on the targeted computer. After the encryption, victims can no longer access their files that are marked with .nypd extension. Later, they receive _readme.txt file as a ransom note where criminals ask to contact them via firstname.lastname@example.org or email@example.com e-mail addresses. Note, that this is currently the most prominent ransomware family that already has over 230 versions. This ransomware variant is NOT the same virus that attacked New York Police Department Fingerprint Database in November 2019.
Most victims’ computers are infected via deceptive techniques when they accidentally install the ransomware themselves. The attackers have also created a disguise during the encryption process — people see a fake Windows update screen while the ransomware finishes encoding all information on the targeted system.
Usually, NYPD ransomware along with its previous versions (ZWER, KKLL, NLAH, ZIPE, PEZI) aim to append its extension to every file stored on the computer. It can range from videos, photos, audio memories, to exceptionally important work documents and other information. After successful encryption people cannot open or use the affected data in any way.
Those who think that this file-encrypting virus only aims to corrupt files for money extortion, it also drops an infamous password-stealing Trojan, named AZORULT. This malware is designed to copy passwords from all user’s accounts and transfer them to the cybercriminals. Later, they might be sold on the black market or used by the attackers right away for further attacks on other platforms.
_readme.txt note explains what happened
The developers of NYPD file virus explain the attack as well as its purpose on the ransom note. Victims are told that the encryption process generates merely one unique decryption key that cannot be recreated, thus, only the attackers have a hold of it. People are demanded to pay enormous money for the decryption tool in Bitcoins. Otherwise, the data remains inaccessible forever.
Cybercriminals give a 50% discount within the first 72 hours of infection. During that time victims are asked to transfer $490 to a specific Bitcoin account. After 72 hours, the price increases to $980. This tactic is used to scare innocent people and help criminals extort money quicker. However, there are no guarantees that you will receive the NYPD decryptor.
The ransomware attack (file folder encryption) and the contents of the ransom note (_readme.txt) are demonstrated in the animation below.
In fact, there are multiple Reddit themes where people complain about being tricked by cybercriminals — they agreed to pay the demanded amount of money but never got the valid decryption tool. Therefore, our experts do not recommend trusting the attackers and especially paying for them since there is a high chance that you will suffer from financial losses.
The best option is to remove NYPD ransomware virus straight away. We highly advise using a reputable antivirus to get rid of both, the file-encrypting malware and password-stealing Trojan at once. For that, pick a professional software and run a full system scan. For repairing virus damage, RESTORO is an excellent choice.
Note that you might be unable to start NYPD ransomware removal because this cyber threat is capable of blocking the access to security software and websites. You can learn how to circumvent this malicious code by reading the instructions at the end of this article. Make sure that you follow all the indicated steps in order to start a successful virus elimination.
|Other versions||ZWER, NLAH, ZIPE, PEZI|
|Extension||.nypd file extension|
|Amount of money demanded||From $490 to $980; 50% discount available in the first 72 hours of the infection|
|Contactsfirstname.lastname@example.org or email@example.com|
|Symptoms||Uses a fake Windows update screen as a disguise while encrypting data; Later, the files are no longer accessible for regular use; Also, installs an AZORULT Trojan to steal user’s passwords|
|Spread||Uses fake Adobe update pop-ups and peer-to-peer (P2P) networks for distribution|
|Decryption tools||Emsisoft STOP Decrypter currently does not support this version|
|Removal||Only a professional antivirus is robust enough to get rid of the ransomware. Do not forget to scan with RESTORO afterwards to remove virus damage on OS system.|
NYPD Ransomware Virus
Name: NYPD Ransomware
Description: NYPD ransomware is a malicious variant of STOP/DJVU virus. It encrypts files using military-grade cryptography combination and marks them with .nypd file extension. The aim of this virus is to extort the victim by forcing him pay for a returned right to access personal files. The criminals state that the decryption software and key costs $490 within the first 72 hours, then the ransom price rises to $980. The criminal's contact addresses provided in the ransom note are firstname.lastname@example.org and email@example.com.
Offer price: $490-$980
Operating System: Windows
Application Category: Ransomware
Author: STOP/DJVU developers
User Review( votes)
Stay away from suspicious and P2P websites to avoid ransomware
The most commonly used methods to distribute ransomware is to create deceptive update pop-ups or software downloads and trick people into installing the executable of the virus. For example, people who browse on suspicious websites can encounter a fake Adobe Flash Player update pop-up that asks to update software right away.
Unfortunately, this is merely a trick to lure people into clicking on the update button. As a result, this automatically triggers ransomware installation. Most people fall for this trick because the pop-up seems exceptionally similar to real update notifications.
Furthermore, many cybercriminals upload ransomware executables as well-known software on peer-to-peer (P2P) file-sharing websites. Users who search how to get paid software for free often download the deceptive upload and install ransomware on their computers accidentally. Therefore, it is essential to stay away from suspicious pages and P2P networks to avoid infections.
If you want to protect your computer from malware attacks, then you should stop browsing on unverified sites and get applications only from original websites or authorized distribution pages. Additionally, refrain from clicking on ads that appear while browsing and always have a professional antivirus running on your system.
Luckily, many security software have options to schedule regular scans in order to check the computer files for various types of malware. You can easily modify the settings according to your needs.
The safest way to get rid of NYPD ransomware virus
Since ransomware infections are the most dangerous ones for regular computer users, the safest way to remove NYPD virus is employing a robust antivirus.
The antivirus will identify files related to the malware as well as perform NYPD file-encrypting ransomware removal automatically. Additionally, RESTORO offers repair services that can fix virus damage caused to your computer. It will replace corrupted files and other components from a large database. That is the main reason why this software is our number one choice to deal with ransomware infections.
However, you will need to use the latest backup to recover the encrypted information on your computer. If you did not enable automatic backups before the attack we strongly suggest you to do so after eliminating the virus. You can find out more about alternative recovery methods in STOP/DJVU virus decryption article.
OUR GEEKS RECOMMEND
Our team recommends removing malware using a professional antivirus software and then using the following tool to repair virus damage to Windows system files:
REPAIR VIRUS DAMAGE TO YOUR COMPUTER
RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.
RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.
Read full review here.
NYPD ransomware virus Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove the virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it:
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove NYPD ransomware virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable malware removal program. In addition, we suggest trying a combination of INTEGO antivirus (removes malware and protects your PC in real-time) and RESTORO (repairs virus damage to Windows OS files).
REPAIR VIRUS DAMAGE
Scan your system for FREE to detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically. Includes Avira spyware/malware detection & removal engine.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10 users
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Scott Bolton is a senior content strategist in our Geek’s Advice team. He is exceptionally passionate about covering the latest information technology themes and inspire other team members to follow new innovations. Despite the fact that Scott is an old-timer among the Geeks, he still enjoys writing comprehensive articles about exciting cybersecurity news or quick tutorials.