XZNSHIRKICRY Virus Ransomware (.LOCKED Files)

The Xznshirkicry virus belongs under the ransomware type of infection. Ransomware of such sort encrypts all user’s data on the PC (photos, text files, excel sheets, audio files, videos, etc) and adds its extra extension to every file, creating the read_me.txt text files in each folder which contains the encrypted files.

What is Xznshirkicry virus?

The renaming will be done by this scheme: .locked[contact-email]idxxxxx. As a part of the encryption, a file entitled, for example, “report.docx” will be renamed to “report.docx.locked[payransom1@gmailcom]id17666”.

In every directory with the encoded files, a read_me.txt file will appear. It is a ransom money memo. It contains information on the ways of contacting the racketeers and some other information. The ransom note most probably contains instructions on how to buy the decryption tool from the racketeers. You can get this decoding tool after contacting [email protected] via email. That is the scheme of the crime.

Xznshirkicry Summary:

The read_me.txt file accompanying the Xznshirkicry ransomware provides the following dispiriting information:

Внимание!
Ваша ОС заражена вирусом XznShirkiCry, а все ваши файлы были зашифрованы.
Для того чтобы расшифровать ваши файлы, необходимо заплатить выкуп 5$ на BitCoin-кошелек. После этого написать на нашу электронную почту.
BitCoin-кошелек:17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV
Электронная почта:[email protected]
Важно! Зашифрованы файлы:
Не удалять
Не изменять расширение файлов
В случаи если вы удалите наш вирус или ваш антивирус его удалит, то расшифровка станет невозможна!!!
Ваш ID:17666. Данный ID понадобится для расшифровки.
English:
Attention!

Your OS is infected with the XznShirkiCry virus, and all your files have been encrypted.

To decrypt your files, you need to pay a $5 ransom to a BitCoin wallet.
After that, write to our email address.

BitCoin Wallet:17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV

e-mail:[email protected]
 
Important! Encrypted files:

Do not delete

Do not change the file extension

If you delete our virus or your antivirus deletes it, then decryption will be impossible!!!

Your ID:17666. You will need this ID for decryption.

In the picture below, you can see what a directory with files encrypted by the Xznshirkicry looks like. Each filename has the “.locked” extension added to it.

How did my machine catch Xznshirkicry ransomware?

There is a huge number of possible ways of ransomware injection.

Nowadays, there are three most exploited methods for tamperers to have ransomware working in your system. These are email spam, Trojan injection, and peer-to-peer networks.

• If you access your mailbox and see emails that look like familiar notifications from utility services companies, delivery agencies like FedEx, web-access providers, and whatnot, but whose sender is strange to you, be wary of opening those letters. They are very likely to have a malware file enclosed in them. So it is even riskier to open any attachments that come with emails like these.
• Another option for ransom hunters is a Trojan virus scheme. A Trojan is an object that infiltrates your computer pretending to be something else. Imagine, you download an installer for some program you want or an update for some service. However, what is unpacked turns out to be a harmful program that corrupts your data. Since the update package can have any title and any icon, you’d better be sure that you can trust the source of the files you’re downloading. The optimal thing is to use the software developers’ official websites.
• As for the peer file transfer protocols like BitTorrent or eMule, the danger is that they are even more trust-based than the rest of the Internet. You can never guess what you download until you get it. We suggest that you use trustworthy websites. Also, it is a good idea to scan the directory containing the downloaded objects with the antivirus as soon as the downloading is done.

How to remove ransomware?

It is crucial to inform you that besides encrypting your data, the Xznshirkicry virus will probably deploy Vidar Stealer on your machine to get access to credentials to various accounts (including cryptocurrency wallets). That spyware can extract your logins and passwords from your browser’s auto-filling data.

How сan I avert ransomware infection?

Xznshirkicry ransomware doesn’t have a superpower, nor as any similar malware.

You can protect your PC from ransomware infiltration in several easy steps:

• Ignore any letters from unknown senders with strange addresses, or with content that has nothing to do with something you are waiting for (can you win in a lottery without even taking part in it?). If the email subject is more or less something you are expecting, check all elements of the questionable email with caution. A hoax email will surely contain a mistake.
• Do not use cracked or untrusted programs. Trojans are often spread as a part of cracked software, possibly as a “patch” preventing the license check. But untrusted programs are difficult to tell from trustworthy software because trojans sometimes have the functionality you need. Try to find information on this program on the anti-malware forums, but the best way is not to use such software.

FAQ

🤔 Is it possible to open “.locked” files?

There’s no way to do it unless the files “.locked” files are decrypted.

🤔 What should I do to make my files accessible as fast as possible?

It’s good if you have fаr-sightedly saved copies of these important files elsewhere. Otherwise, you might try to employ System Restore. The only question is whether you have saved any Restore Points that would be helpful now. There are other ways to beat ransomware, but they take time.

🤔 What actions should I take if the Xznshirkicry virus has blocked my computer and I can’t get the activation key?

🤔 What could help the situation right now?

Some of the blocked data can be located elsewhere.

• If you exchanged your important files by email, you could still download them from your online mail server.
• You may have shared images or videos with your friends or family members. Just ask them to send those pictures back to you.
• If you have initially downloaded any of your files from the Web, you can try doing it again.
• Your messengers, social networks pages, and cloud drives might have all those files as well.
• It might be that you still have the needed files on your old computer, a laptop, mobile, memory stick, etc.

HINT: You can employ data recovery utilities¹ to retrieve your lost information since ransomware encrypts the copies of your files, removing the authentic ones. In the video below, you can see how to use PhotoRec for such a recovery but remember: you can do it only after you kill the virus with an antivirus program.

1. Here are Top 10 Data Recovery Software Of 2024.