Dads Legal Files Infected

It sounds like a ransomware malware. When you get more information let us know.

 

Adding to IJAC's comment - I agree, it's ransomeware. You can pay the fee, but there's no guarantee that you'll get the files decrypted. The bad actor may not send you the key and if you made changes to your computer, that may prevent the key from working.

Here's where a backup would come in handy. You wouldn't have to be concerned about paying a fee. You would just restore your files from your backup. It's also the reason I prefer to have backup off-line. If the backup drive was connected to the computer when it was hit with the malware, in addition to all your files being encrypted, the malware would attack the attached backup drive and encrypt all those backed up files also.

 

Hi Justin,

That isn't the best way to deal with ransomware, I'm afraid.
With the files in place and a copy of the ransomware note, it makes it easier to see what we are dealing with.
What did he use to remove the ransomware program?
Is he sure that he removed it all?

That's not a ransomware file extension that I'm aware of.

There are some decryptors available for some of the older ransomware types, but these don't always work.
Unfortunately there's a good chance that the encrypted files are lost.

@Tony D is spot on with this.
Unfortunately a lot of people don't bother with regular backups.

With a regular backup, it would have been a simple case of reinstalling the OS and then running the backup.

 

I found this: https://www.2-spyware.com/remove-zepto-virus.html
Don't click on the green remove it now though. That is for a program called reimage and they scan your computer but you have to buy it to remove anything. I know because way back I fell for it but I didn't buy it. If you need help we have a malware removal specialist in here that can help.

Here is another one of how to remove it: https://medium.com/@malwarehelp/how-to-completely-remove-zepto-virus-7f36c4a82cce

 

Zepto has been around since 2016. If he got infected 5 years later, he must not be keeping up with Security programs and scanning regularly.

Paid malwarebytes protects anything like that from getting on my system.
https://www.malwarebytes.com/solutions/ransomware-protection

 

Yes it's version of the Locky ransomware....

New Locky version adds the .Zepto Extension to Encrypted Files


As at 30th April last year there was still no decryptor for the files.

https://www.bleepingcomputer.com/fo...support-and-help-topic-lukitushtml/?p=4985035

 

Yup, I spent some time looking at quite a few sites that had decryption tools but I came up empty. I was hoping to find a solution.

Several things to keep in mind so other files are not lost forever to malware:
1. Get a malware detection program
2. Keep at minimum 2 copies of important files off the computer (I've been working on a large database for 6 years. One copy is kept on a computer. 1 copy is kept on a USB stick. A 2nd copy is kept on a different USB stick and from time to time I've uploaded a copy to my google drive.)
3. Learn to make images of the computer. If the computer does manage to pick up something, restore the image and you will be back in business in under an hour. You might lose a few things. (I keep a list of everything that has been updated since the last image so if I need to restore, I know exactly what updates/new versions I need to install.)