Do you know what Zoldon Ransomware is?
Zoldon Ransomware might show a warning stating your private files were enciphered. It should also say you can get your data back if you pay a sum of Bitcoins worth 150-400 US dollars. However, our computer security specialists tested the malware’s sample and what they saw is none of the files on the test computer were encrypted. Meaning, the malicious application’s developers are probably hoping they will be able to trick less experienced users to pay money for decryption tools they do not need. Naturally, if you do not want to be scammed, we urge you to learn more about this threat by reading the rest of this report before making any rash decisions. Further, in the text, we will talk about the malware’s working manner and the warning it displays. What’s more, since we recommend erasing it, users who scroll below the main text will find a removal guide too.
Zoldon Ransomware might infect the system after the victim runs some untrustworthy file downloaded from the Internet. It could be anything: an email attachment received with Spam, an application installer downloaded from unreliable file-sharing websites, a fake update you got while clicking suspicious pop-ups or other suspicious messages/advertisements, and so on. One of the ways to stay away from similar threats is to be more careful when interacting with questionable content. Another way to guard the system against ransomware or other malicious applications is to keep a reputable antimalware tool. For it to be effective, you should always update your chosen tool whenever you can and keep it activated.
After infecting the computer, the malware is supposed to create a couple of files in the directories we will list in the removal guide. One of them or to be more accurate a specific Registry entry may allow Zoldon Ransomware restart with Windows. Thus, if you reboot the system, the threat’s warning will appear again. Since the malicious application does not encrypt any data, its ransom note might be displayed right away. The first sentences should say: “Alert: Your computer and Files are encrypted By Zoldon Virus. $150 within 24 hours. $400 after 24 hours.” The rest of the text explains how to make the payment and contact the cybercriminals who created Zoldon Ransomware to receive decryption tools. Besides, the threat could drop a text document named DesktopZoldon.txt in the %USERPROFILE% folder. Inside of there should be a short text mentioning the hackers’ email and Bitcoin wallet address.
Zoldon Ransomware screenshot
Scroll down for full removal instructions
Given, the malware only claims it encrypted user’s files, but does not do so in reality; we would not advise paying for decryption tools that most likely do not even exist. If you decide not to waste your money you should take a look at the removal guide available below to get rid of Zoldon Ransomware manually or install a reputable antimalware tool you like to delete it with automatic features.
Erase Zoldon Ransomware
- Click Ctrl+Alt+Delete simultaneously.
- Pick Task Manager.
- Take a look at the Processes tab.
- Locate a process belonging to this malicious program.
- Select this process and press the End Task button.
- Click Windows Key+E.
- Navigate to the suggested paths:
%TEMP%
%USERPROFILE%Desktop
%USERPROFILE%Downloads - Find a file that was launched when the system got infected, right-click the malicious file and select Delete.
- Look for a file named DesktopZoldon.txt in the %USERPROFILE% folder, right-click such documents and press Delete.
- Leave File Explorer.
- Press Windows Key+R.
- Insert Regedit and press Enter.
- Go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Locate a value name called Z0ldon, right-click it and select Delete.
- Then navigate to HKEY_CURRENT_USER\Software
- Find a key titled Z0ldon too, right-click it and press Delete.
- Close Registry Editor.
- Empty Recycle bin.
- Restart the computer.
In non-techie terms:
Zoldon Ransomware is a malicious threat created to scare users into paying a ransom. It says it encrypts user’s files, but as the research shows it is not capable of affecting user’s data in any way. As for threats about publishing user’s files that should be visible at the end of the warning, we believe the hackers are only saying they would do so to persuade users to pay. Therefore, we would not recommend paying them anything, especially when the malware does not damage any files. It seems to us the smartest thing to do would be to get rid of the malicious application as fast as possible. It may not encrypt any data, but it might still be dangerous to keep it on the computer. Users who want to eliminate it manually could try following the steps provided in our removal guide available a bit above this paragraph. The other way to make sure the malware is deleted is to scan the system with a reputable antimalware tool of your choice.