The attackers will explain in the ransom note that VTYM ransomware virus was able to encrypt the entire files including pictures, documents, and every other data contained in the infected computer. Not only that, but they will also claim to have made use of a very strong and unique encryption key that can’t be breached unless the victim pays a certain amount of money as ransom. Also included will be two email addresses namely: support@sysmail.ch and supportsys@airmail.cc which the victim is expected to respond with. Decryption service prices and terms of payment will also attached to the ransom notes. They will state that the amount of money the victim will be required to pay as ransom will depend on how fast they are able to make the transfer. For instance, if they are able to do so within 3 days or 72 hours of being notified, it will enable them to leverage 50% which would bring the ransom fee down to $490 but once the deadline is exceeded, only the full ransom fee of $980 will be acceptable. More conditions will be reeled out to the victim if they decide to get in touch with the cybercriminals, and it will state that ransom money could only be paid by transferring the crupocurrency equivalence to wallet address of their choice. The obvious reason why they use such an anonymous medium of payment is to preempt any possible move by law enforcement agents to come after them. As a way of showing their capability to restore the victim’s encrypted files and encourage them to pay up without hesitation, they may request for excerpts of file to be sent to them for test decryption but will emphasize that such excerpt must not contain information that could be seen as vital to the victim. Whatever be the case, our cybersecurity experts advise that victims should follow FBI guidelines in respect to ransom payments and the general consensus is that RANSOM MUST NOT BE PAID. The reason is that paying ransom does not guarantee that victim’s encrypted data would be recovered. Secondly, doing so would only encourage cybercriminals to continue in their criminal activities since they would find it lucrative. Also, more funds at their disposal would enable them to employ more rogue developers and the circle will continue as more computer users are made victims. The virus equally drops other Trojans that steal information like AZORULT and VIDAR on the already compromised computer, which they use to steal sensitive information such as software account credentials, cryptocurrency wallets, banking details, passwords, browsing history etc. Once these sorts of information are in the hands of the cybercriminals, it can even lead to further criminal acts such as blackmail and theft. For those that are already infected with STOP/DJVU variant, the most important thing to do is to remove VTYM ransomware virus from the computer without any delay. This can be done effectively by running updated antivirus software while the affected system is set up in Safe Mode with Networking. However, it is very important to make use of only strong and genuine antivirus to ensure optimal results. Therefore, if you’re not sure of what antivirus to use, then we highly recommend INTEGO Antivirus. Additionally, you may also consider downloading RESTORO which could be used to reverse the damaging effects of the virus on your Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

The most prolific method used by cybercriminals in spreading STOP/DJVU ransomware including the VTYM virus is when they lure victims to download malicious software programs from online torrents platform. The cybercriminals tent to hide the threats in some of these pirated contents such as key generators and “cracks”, but they become triggered once downloaded in any computer. A good number of victims have reported several particular software programs as often by often used by cybercriminals in spreading malware through online torrent libraries, and they are listed below in no particular order:

KMSPico (illegal Windows activation tool);Fifa 20;Tenorshare 4ukey;AutoCad;Opera browser;Corel Draw;VMware Workstation;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;Adobe Photoshop;Virtual DJ Pro.

From the explanations so far, it has become obvious that visiting online torrents software in search of pirated malicious software content is not only a dangerous act but also illegal and punishable by law. Therefore, instead of looking for cheap or free software contents that would put you at risk of cyber-attack, it is better to encourage the genuine producers who went the extra mile to create such contents by patronizing them. You have to put into consideration that whatever amount they place on such contents would always be insignificant when compared to the actual ransom fees cybercriminals demand from their victims. Also, neither will you be at risk of losing your important documents. Another method used to spread malware is malicious email attachments, whereby they create highly convincing messages that would be accompanied with certain documents formatted with the use of XLS, DOCX and PDF among others. These particular platforms are used because they allow JavaScript/macro functions, both of which can be used to attach, transport and trigger malware in diverse computers. Lastly, victims of any variant of STOP/DJVU ransomware are hereby advised to shun any suspicious website that may make bogus claims about offering such services. The reason is because such services rarely exist, and at the moment only Emsisoft and DiskTuna have proven beyond doubt of their expertise in decrypting STOP/DJVU encrypted files. Trying to make use of any other brand aside these two, can lead to double file encryption.

More details you need to know about the infection

Oftentimes, some victims do wonder about the extent to which VTYM ransomware attack must have affected their system or the exact things that took place while the attack was ongoing. Firstly, you should be aware that the initial action taken by the malware is to set up build.exe or build2.exe executables and would be followed by the winupdate.exe (the prompt brings up fake Windows screen). Following that, it then makes a connection with https[:]//api.2ip.ua/geo.json and would save the response in geo.json. It then proceeds to information gathering stage where details like the computer’s geolocation, time zone, zip code, latitude and longitude would all be sent to geolocation-related database. Here is an example of how geo.json files appear as shown in the image below. The ransom-demanding malware also creates another file called information.txt that contains hardware details, installed software list and active processes. Now it has gotten hold of the computer’s geolocation, the malware will now profile it against a list of countries they designated as encryption-exempted. The countries are listed as: Ukraine, Russian Federation, Syria, Tajikistan, Kazachstan, Kyrgyzstan, Armenia, Uzbekistan and Belarus. If it shows that the computer under attack is domiciled in any of these countries, it would instantly abort its mission. If otherwise, it will move to the next stage where it will request online encryption key from the C&C server and then merge it with the victim’s ID, both being saved into bowsakkdestx.txt file and the ID separately to PersonalID.txt file. Shown below are examples of these files. In situations whereby it fails to extract online encryption key from their server, it will opt for the use of a hardcoded key, also known as offline key, as an alternative. The major difference between these two encryption types is that online keys are uniquely created for each victim while offline key is a one-size-fits-all key that is given to every victim of a particular ransomware variant. What shows if a particular is offline is the addition of t1 characters suffixed to the victim’s personal ID. From the victim’s perspective, offline key is more desirable because it offers a higher chance of being decrypted. More information about this is provided below or in this guide. Having gotten to this point, the virus will now begin full data encryption process by scanning every folder and encrypting files with Salsa20. It then makes use of RSA-2048 to lock the encryption key. Also, while this ongoing, the virus will mark files with additional extension. This ransomware variant appends .vtym extension to make files distinguishable. Shown below is a screenshot of _readme.txt ransom note that is usually left in all the folders. Before completing the entire process, the malware will blacklist some websites in the Windows HOSTS file and also map them to localhost IP which effectively bars the victim from accessing them and any attempt would likely bring up DNS_PROBE_FINISHED_NXDOMAIN error message.

Remove VTYM Ransomware Virus and Retrieve Your Files

Like we stated earlier, victims should as a matter of urgency remove VTYM ransomware from the infected computer with immediate effect. You can use any reliable antivirus solution you want, but if you want to rely on our team’s recommendations, we suggest using INTEGO Antivirus. Additionally, you may want to download RESTORO and use it to repair virus damage on Windows OS files. Once VTYM ransomware virus removal is taken care of, the following steps should be taken by the victim as recommended by our team:

Report to local law enforcement agents nearest to you.Make use of data backup to recover lost files.Learn possible ways STOP/DJVU encrypted files could be repaired.Change all passwords used on the compromised computer without delay.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove VTYM Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove VTYM Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt VTYM files

Fix and open large VTYM files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. VTYM Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt VTYM files, follow the given tutorial.

Meanings of decryptor’s messages

The VTYM decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your VTYM extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of VTYM Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.