Geek's Advice

NYPD ransomware locks personal files, demands $490-$980 as a ransom

NYPD ransomware is a new version of STOP/DJVU virus family that encrypts data on the targeted computer. After the encryption, victims can no longer access their files that are marked with .nypd extension. Later, they receive _readme.txt file as a ransom note where criminals ask to contact them via helpmanager@mail.ch or restoreadmin@firemail.cc e-mail addresses. Note, that this is currently the most prominent ransomware family that already has over 230 versions. This ransomware variant is NOT the same virus that attacked New York Police Department Fingerprint Database in November 2019.

Most victims’ computers are infected via deceptive techniques when they accidentally install the ransomware themselves. The attackers have also created a disguise during the encryption process — people see a fake Windows update screen while the ransomware finishes encoding all information on the targeted system.

Usually, NYPD ransomware along with its previous versions (ZWER, KKLL, NLAH, ZIPE, PEZI) aim to append its extension to every file stored on the computer. It can range from videos, photos, audio memories, to exceptionally important work documents and other information. After successful encryption people cannot open or use the affected data in any way.

Those who think that this file-encrypting virus only aims to corrupt files for money extortion, it also drops an infamous password-stealing Trojan, named AZORULT. This malware is designed to copy passwords from all user’s accounts and transfer them to the cybercriminals. Later, they might be sold on the black market or used by the attackers right away for further attacks on other platforms.

_readme.txt note explains what happened

The developers of NYPD file virus explain the attack as well as its purpose on the ransom note. Victims are told that the encryption process generates merely one unique decryption key that cannot be recreated, thus, only the attackers have a hold of it. People are demanded to pay enormous money for the decryption tool in Bitcoins. Otherwise, the data remains inaccessible forever.

Cybercriminals give a 50% discount within the first 72 hours of infection. During that time victims are asked to transfer $490 to a specific Bitcoin account. After 72 hours, the price increases to $980. This tactic is used to scare innocent people and help criminals extort money quicker. However, there are no guarantees that you will receive the NYPD decryptor.

The ransomware attack (file folder encryption) and the contents of the ransom note (_readme.txt) are demonstrated in the animation below.

In fact, there are multiple Reddit themes where people complain about being tricked by cybercriminals — they agreed to pay the demanded amount of money but never got the valid decryption tool. Therefore, our experts do not recommend trusting the attackers and especially paying for them since there is a high chance that you will suffer from financial losses.

The best option is to remove NYPD ransomware virus straight away. We highly advise using a reputable antivirus to get rid of both, the file-encrypting malware and password-stealing Trojan at once. For that, pick a professional software and run a full system scan. For repairing virus damage, RESTORO is an excellent choice.

Note that you might be unable to start NYPD ransomware removal because this cyber threat is capable of blocking the access to security software and websites. You can learn how to circumvent this malicious code by reading the instructions at the end of this article. Make sure that you follow all the indicated steps in order to start a successful virus elimination.

Summary

Name	NYPD ransomware
Category	File-encrypting virus
Family	STOP/DJVU
Variant	232nd
Other versions	ZWER, NLAH, ZIPE, PEZI
Extension	.nypd file extension
Ransom note	_readme.txt
Amount of money demanded	From $490 to $980; 50% discount available in the first 72 hours of the infection
Contacts	helpmanager@mail.ch or restoreadmin@firemail.cc
Symptoms	Uses a fake Windows update screen as a disguise while encrypting data; Later, the files are no longer accessible for regular use; Also, installs an AZORULT Trojan to steal user’s passwords
Spread	Uses fake Adobe update pop-ups and peer-to-peer (P2P) networks for distribution
Decryption tools	Emsisoft STOP Decrypter currently does not support this version
Removal	Only a professional antivirus is robust enough to get rid of the ransomware. Do not forget to scan with RESTORO afterwards to remove virus damage on OS system.

Stay away from suspicious and P2P websites to avoid ransomware

The most commonly used methods to distribute ransomware is to create deceptive update pop-ups or software downloads and trick people into installing the executable of the virus. For example, people who browse on suspicious websites can encounter a fake Adobe Flash Player update pop-up that asks to update software right away.

Unfortunately, this is merely a trick to lure people into clicking on the update button. As a result, this automatically triggers ransomware installation. Most people fall for this trick because the pop-up seems exceptionally similar to real update notifications.

Furthermore, many cybercriminals upload ransomware executables as well-known software on peer-to-peer (P2P) file-sharing websites. Users who search how to get paid software for free often download the deceptive upload and install ransomware on their computers accidentally. Therefore, it is essential to stay away from suspicious pages and P2P networks to avoid infections.

If you want to protect your computer from malware attacks, then you should stop browsing on unverified sites and get applications only from original websites or authorized distribution pages. Additionally, refrain from clicking on ads that appear while browsing and always have a professional antivirus running on your system.

Luckily, many security software have options to schedule regular scans in order to check the computer files for various types of malware. You can easily modify the settings according to your needs.

The safest way to get rid of NYPD ransomware virus

Since ransomware infections are the most dangerous ones for regular computer users, the safest way to remove NYPD virus is employing a robust antivirus.

The antivirus will identify files related to the malware as well as perform NYPD file-encrypting ransomware removal automatically. Additionally, RESTORO offers repair services that can fix virus damage caused to your computer. It will replace corrupted files and other components from a large database. That is the main reason why this software is our number one choice to deal with ransomware infections.

However, you will need to use the latest backup to recover the encrypted information on your computer. If you did not enable automatic backups before the attack we strongly suggest you to do so after eliminating the virus. You can find out more about alternative recovery methods in STOP/DJVU virus decryption article.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.