What is Nyton Ransomware
Discovered in 2019, Nyton Ransomware is a dangerous virus that ruthlessly encrypts users’ data. Likewise other ransomware, Nyton targets various sorts of files like images, videos, text documents, and others that will be locked after penetration. After encryption, Nyton changes the icons of all files/apps to blank sheets and assigns the .nyton extension. To illustrate, normal 1.mp4 files will be changed to 1.mp4.nyton after restriction. Unfortunately, the decryption of such files is often impossible. Even the best third-parties tools are not able to access the data because developers use sophisticated algorithms that make files unrecoverable. Besides that, once the program blocked the data, it instantly creates a ransom note on the desktop (!NYTON_HELP.TXT) that displays the information about encryption. Another victim’s informant is the onion website web page.
All your files have been encrypted with Nyton Virus.
Your unique id: C59B2C0A617F4D40BBACF75BF699CAFD
As a private person you can buy decryption for 300$ in Bitcoins.
But before you pay, you can make sure that we can really decrypt any of your files.
The encryption key and ID are unique to your computer, so you are guaranteed to be able to return your files.
To do this:
1) Download and install Tor Browser ( https://www.torproject.org/download/ )
2) Open the yfnsui2onmw5fb4ekr4r64mrcxw6pwcwrhxx4k5ylp7u7c66jti2y3id.onion web page in the Tor Browser and follow the instructions.
1) Send a few encrypted files (no more 3 files, no more 10 MB per letter) to nyton@cock.li. Dont forget to include you ID from !NYTON_HELP.TXT.
2) We will decipher them and send you back with bitcoin address for payment.
3) After payment ransom for Bitcoin, we will send you a decryption program and aes-key with instructions. If we can decrypt any of your files, we have no reason to deceive you after payment.
Extortionists demand 300$ in BTC to get a unique decryption key. The payment needs to proceed via the Tor browser since it is the safest ground for running shady transactions. The note also contains your personally generated ID number that needs to be included whilst buying the key. Although deleting ransomware from your computer will not get your files back, it will undoubtedly guarantee further safety and carefulness on the web.
How Nyton Ransomware infected your computer
Ransomware is very sneaky and usually distributed via trojans, e-mail spams, untrustworthy downloads, and other suspicious resources. Unfortunately, most people are not careful enough when opening unknown messages categorized as spam. E-mails designed for infiltrations usually contain trojans that are camouflaged under the attached files. The list of files may vary from innocent PDFs to executable or JavaScript files. After opening, the file will issue the trojan infection on your PC. Trojans themselves are meant to initiate so-called chain infiltrations that will deliver various malware like Nyton Ransomware along the way. This is why you should beware of clicking or opening unknown files received by suspicious addresses. Visiting only trusted and official websites will decrease the number of malicious pages that are trying to impose viruses via intrusive ads or fake software. To uninstall Nyton Ransomware from your PC, follow the free guide removal mentioned below.
- Download Nyton Ransomware Removal Tool
- Get decryption tool for .nyton files
- Recover encrypted files with Stellar Data Recovery Professional
- Restore encrypted files with Windows Previous Versions
- Restore files with Shadow Explorer
- How to protect from threats like Nyton Ransomware
Download Removal Tool
To remove Nyton Ransomware completely, we recommend you to use SpyHunter 5 from EnigmaSoft Limited. It detects and removes all files, folders, and registry keys of Nyton Ransomware. The trial version of SpyHunter 5 offers virus scan and 1-time removal for FREE.
Alternative Removal Tool
To remove Nyton Ransomware completely, we recommend you to use Norton Antivirus from Symantec. It detects and removes all files, folders, and registry keys of Nyton Ransomware and prevents future infections by similar viruses.
Nyton Ransomware files:
!NYTON_HELP.TXT
{randomfilename}.exe
Nyton Ransomware registry keys:
no information
How to decrypt and restore .nyton files
Use automated decryptors
Download Kaspersky RakhniDecryptor
Use following tool from Kaspersky called Rakhni Decryptor, that can decrypt .nyton files. Download it here:
There is no purpose to pay the ransom because there is no guarantee you will receive the key, but you will put your bank credentials at risk.
Dr.Web Rescue Pack
Famous antivirus vendor Dr. Web provides free decryption service for the owners of its products: Dr.Web Security Space or Dr.Web Enterprise Security Suite. Other users can ask for help in the decryption of .nyton files by uploading samples to Dr. Web Ransomware Decryption Service. Analyzing of files will be performed free of charge and if files are decryptable, all you need to do is purchase a 2-year license of Dr.Web Security Space worth $120 or less. Otherwise, you don’t have to pay.
If you are infected with Nyton Ransomware and removed it from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:
Use Stellar Data Recovery Professional to restore .nyton files
- Download Stellar Data Recovery Professional.
- Click Recover Data button.
- Select type of files you want to restore and click Next button.
- Choose location where you would like to restore files from and click Scan button.
- Preview found files, choose ones you will restore and click Recover.
Using Windows Previous Versions option:
- Right-click on infected file and choose Properties.
- Select Previous Versions tab.
- Choose particular version of the file and click Copy.
- To restore the selected file and replace the existing one, click on the Restore button.
- In case there is no items in the list choose alternative method.
Using Shadow Explorer:
- Download Shadow Explorer program.
- Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
- Select the drive and date that you want to restore from.
- Right-click on a folder name and select Export.
- In case there are no other dates in the list, choose alternative method.
If you are using Dropbox:
- Login to the DropBox website and go to the folder that contains encrypted files.
- Right-click on the encrypted file and select Previous Versions.
- Select the version of the file you wish to restore and click on the Restore button.
How to protect computer from viruses, like Nyton Ransomware, in future
1. Get special anti-ransomware software
Use ZoneAlarm Anti-Ransomware
Famous antivirus brand ZoneAlarm by Check Point released a comprehensive tool, that will help you with active anti-ransomware protection, as an additional shield to your current protection. The tool provides Zero-Day protection against ransomware and allows you to recover files. ZoneAlarm Anti-Ransomware is compatible with all other antiviruses, firewalls, and security software except ZoneAlarm Extreme (already shipped with ZoneAlarm Anti-Ransomware) or Check Point Endpoint products. The killer features of this application are: automatic file recovery, overwrite protection that instantly and automatically recovers any encrypted files, file protection that detects and blocks even unknown encryptors.
2. Back up your files
As an additional way to save your files, we recommend online backup. Local storages, such as hard drives, SSDs, flash drives or remote network storages can be instantly infected by the virus once plugged in or connected to. Nyton Ransomware uses some techniques to exploit this. One of the best services and programs for easy automatic online backup is iDrive. It has the most profitable terms and simple interface. You can read more about iDrive cloud backup and storage here.
3. Do not open spam e-mails and protect your mailbox
Malicious attachments to spam or phishing e-mails is most popular method of ransomware distribution. Using spam filters and creating anti-spam rules is good practice. One of the world leaders in anti-spam protection is MailWasher Pro. It works with various desktop applications, and provides very high level of anti-spam protection.
