How to remove Yyto ransomware virus

Yyto ransomware — a dangerous cryptovirus that has been active since July 2018

Yyto is a ransomware virus that encrypts files and demands ransom for the alleged decryption key. This virus encodes data with AES-256 cryptography^[1] and marks it with .YYTO file extension^[2]. This cryptovirus already has a few versions discovered and the last one appends the .davilarita@mail.com.yyy0 file extension to the encrypted data. This version is already the fifth one discovered in these two months of 2018. Yyy0 ransomware encrypts files using the same AES encryption method and delivers a ransom note in a file named as help.txt that contains an offer to test decryption of several encrypted files. You shouldn't do that. Unfortunately, any contact between you and these hackers cannot lead to positive results.

Since the release of the original version of the Yyto, developers have presented a bunch of new versions of the virus. The main difference is the appended file extension, used contact email address and titles of the ransom notes. Currently, it is known that this ransomware family provides identical data recovery instructions. The ransom note is supposed to be one of these files:

• help_to_decrypt.txt;
• read_to_txt_file.yyt;
• help.txt;
• encrypt.txt;
• Readme.txt.

All of these documents begin with the following text:

Hello. Your files have been encrypted. 

For help, write to this e-mail: codyprince92@mail.com

Attach to the letter 1-2 files (no more than 3 MB) and your personal key. 

If within 24 hours you have not received a response, you need to follow the following instructions:

Unlike other crypto-malware, Yyto virus refers to an .onion link which leads to TorBox. According to the information provided on its homepage, it is a secret email domain designed for communication and separated from the public net. It should ensure the anonymous connection between a perpetrator and a victim.

It doesn’t matter which version of ransomware attacks the computer; the instructions remain the same. Victims should contact the cyber criminals via cutterswish@torbox3uiot6wchz.onion, isabell@torbox3uiot6wchz.onion, albertkerr94@mail.com or colecyrus@mail.com email address.

Usually, perpetrators provide Tor or Bitcoin wallet address for collecting ransoms. In this case, the authors behave differently. Instead, they opt for Torbox. However, neither of the ransom notes provide the actual sum of money that victims have to pay in order to get back their files. However, contacting criminals and following their further instructions is not recommended.^[3] It may lead to the money loss, so it’s better to proceed to Yyto removal.

Users are advised to remove Yyto virus using powerful and reputable malware removal program, such as FortectIntego or MalwarebytesMalwarebytes. However, if you cannot install or run security software, you should scroll down to the end of the article and learn how to disable the virus first.

Developers of Yyto ransomware constantly come up with new versions

.read_to_txt_file.juuj file extension virus. The first variant of the Yyto malware appeared at the beginning of July. The ransomware uses the same AES cryptography but appends a new file extension – .read_to_txt_file.juuj. It delivers a ransom note in the help.txt file and asks to contact via isabell@torbox3uiot6wchz.onion to get data recovery instructions.

.m5m5 file extension virus. The second version of the virus has been released in September. Since then crypto-malware adds .m5m5 file extension to corrupted audio, video, image and other targeted files. This time ransomware drops either help.txt or encrypt.txt files with recovery instructions. There’s nothing new in hackers' demands. Victims have to contact them via albertkerr94@mail.com to learn about recovery possibilities.

Colecyrus ransomware virus. The latest version of the Yyto malware appends .b007 file extensions to prevent users from opening their files. The virus uses an unbreakable AES-CBC cryptography. Even though criminals offer data recovery possibility in Readme.txt file, victims are not advised contacting crooks via colecyrus@mail.com address and paying demanded sum of Bitcoins.

.codyprince92@mail.com.ovgm file extension virus. In June 2018, a new version of Yyto ransomware was discovered and this time new “.codyprince92@mail.com.ovgm” extension is added for files after encryption. Ransom message delivered in “Readme.txt” file and contact email codyprince92@mail.com is now also on the list. Ransomware viruses are dangerous enough so you should not contact these people. But it is more harmful because Yyto is evolving and new version after version come to the public. These new ransomware variants are even more dangerous than the previous. 

yyy0 ransomware is the newest variant of Yyto that emerged in September 2018. It has file extension .davilarita@mail.com.yyy0 which is added to encrypted files after the process is done to mark encoded files from other ones. In every folder with encrypted data virus places ransom file help.txt that contains instructions on creating the cryptocurrency wallet, so you can pay the ransom. We always advise you not to do so. Ransomware file is detected by 51/69 AVs^[4], so you can remove this threat using your antivirus or anti-malware tools like FortectIntego and SpyHunterCombo Cleaner.  

Ransomware comes with spam email attachments

Despite dozens of written articles about Yyto ransomware and their distribution ways, spam emails remain the most popular method of transmission. Ransomware executable is wrapped into .zip folder and presented as supposed invoice or package delivery information. Security experts from Finland^[5] warn to be careful with received emails and stay away from letters that are sent from the unknown sender and includes attachments.^[6] 

Speaking of which, the virus also disguises its executable in 2.exe or RS01bz.exe file. Note that the trojan which may be identified as TR/Crypmodadv.tuglz, Win32.Trojan.WisdomEyes.16070401.9500.9945, or Spyware (004c76c01) delivers Yyto hijack payload as well. Thus, mere vigilance is not sufficient in securing your computer and personal data from virtual threats. Install an anti-virus and anti-spyware tools to fortify the protection.

Removal of the Yyto ransomware virus is crucial for the PC

Data recovery always seems the most important task after the ransomware attack. However, it's not quite true. It's crucial to perform Yyto removal as soon as launches the attack. Malware might cause various system changes, alter Windows registry or install malicious programs. Therefore, you won't be able to use your computer normally and safely again.

In order to remove Yyto virus correctly, you have to obtain a reputable malware removal program, such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. If your computer security tool is forcefully shutdown, you may benefit from below instructions. After restoring the access, you will be able to finish Yyto removal.