Nemty Ransomware – Guide to remove it from system

Guide to Remove Nemty Ransomware –

Nemty Ransomware is the recent weapon in the arsenal of the gigantic Ransomware family. It is a high-risk Ransomware-infection that has been developed with a strong financial motive. It is currently spreading at an alarming rate via exposed Remote Desktop Connections.

Once the system is infected, it searches the system for the targeted files. When found, it employs complex Encryption Algorithms to make encrypt the files & instantly makes its inaccessible. It renames the files by adding Nemty extension to the file names.

Following the encryption of the targeted files, it drops a ransom-demanding note in all the existing folders that contain .Nemty files. This ransom-demanding note is in text format & named “NEMTY-DECRPYT.txt”

The note suggests that the only way to restore the encrypted files is to contact the hackers & pay ransom amount. It further states that failing to co-operate with the hackers can lead to permanent loss of the encrypted data.

The developers claim to restore the encrypted files, only if the victim agrees to follow the instructions given by the hackers.

You may wonder about the authenticity of the claims made by hackers. Well, we suggest you not to contact the hackers. Analysis by the cyber security experts has revealed that victims that pay the ransom not always receive positive answer from the hackers.

Hackers avoid responding the victims after receiving the ransom amount. Therefore, victims should act smart & not let the hackers extort money from them.

So, how can you stop Nemty Ransomware from infecting your system? Read on to learn how you can protect yourself from Ransomware & prevent your data from getting encrypted.

Threat Summary

Name	Nemty
Type	Ransomware
Category	Malware
Targeted OS	Windows
Symptoms	It infiltrates your system with the motive to encrypt stored files. After successful encryption, the virus demands Ransom money to decrypt them.
Damage	You cannot open a locked file without paying the asked ransom. Additionally, it may increase the malicious payload in your system.
Removal	Download Removal Tool

Threat Behavior of Nemty Ransomware –

Nemty Ransomware is the name of the recent threat to the computer users around the world. This brand-new addition to the gigantic family of Ransomware is spreading mainly through the exposed Remote Desktop Connections.

While Remote Desktop Connections distribution technique is not new for Ransomware propagation, it is considered a more treacherous method when compared to phishing techniques.

After gaining illicit access to the systems via RDP, the hackers get an unregulated entry to the targeted system to launch attacks & propagate wider distribution of malware without the user’s intervention.

Once installed, Nemty crypto virus looks for certain targeted file extensions on the infected system. When found, it employs highly complex Encryption Methods like RAS (Rivest–Shamir–Adleman) & AES (Advanced Encryption Standard) to encrypt the files. These algorithms are also used to generate unique decryption keys for each targeted system.

The encrypted are renamed by appending .Nemty Extension to the file-names. For example, a file named “presentation1.ppt” might be renamed as “presentation.ppt.nemty”.

Detailed analysis has revealed that Nemty File virus also deletes the shadow copies for the encrypted files. Hence, it effectively removes the only way using which the victims could restore the encrypted files for free.

In addition to that, it modifies the Windows Registry & primarily targets certain system files. It is capable of gathering personal information of the victim’s system such as Username, OS Version, and Computer ID & send it back to the hackers.

Details of the Ransom Note & Ransom Amount Demanded by Hackers

Once the files are encrypted, .Nemty virus Ransomware drops a ransom note in all the existing folders that contain .Nemty files. This ransom note is a text file named as NEMTY-DECRYPT.txt.

The note contains certain instructions for the victims for getting their data decrypted. It asks the victims to visit a payment portal hosted on a Tor Network, a dark web course designed for anonymous web surfing. Victims are required to pay 0.09981 Bitcoin (equivalent to $1,010.74) in exchange of the Nemty decryption tool & unique key. Failing to pay the ransom in the predefined time limit can lead to increase in the ransom amount by 50%.

However, contacting the hackers & paying the ransom is not always a reliable way to recover .Nemty files. Studies have shown that hackers avoid responding the victims once the payments are received.

Therefore, all the encouragements to contact the hackers & pay the ransom should be ignored.

Sadly, the removal steps of Nemty & .Nemty file decryption are not known at this time. Hence, computer users are advised to employ good security practices & take back-up of the data regularly on an external storage device.

New Variant of Nemty Ransomware distributing through fake PayPal sites-

While Nemty Ransomware is a relatively new addition to the family of Ransomware, it has witnessed a few iterations in a considerable short span. Nemty Ransomware variants used different spread techniques to propagate its infection.

• The first variant of Nemty File Virus was associated with the Russian President and antivirus industry. The code for the Nemty contained a link that redirected to the image of Russian President Putin and displayed a message to the antivirus industry. This variant used exploited & weak Remote Desktop Connections to spread.
• The second Nemty Ransomware variant used RIG Exploit Kits to spread its infection. The attack occurred after a vulnerable software/application was found on the targeted system. Successful exploit was followed by download & execution of the payload, which is the Ransomware itself.
• The third wave of attack of the nasty Nemty Ransomware was carried out using phishing & fake PayPal sites. These sites offer to return 3 to 5 % of the amount if users make purchases using their payment system. However, the prime motive behind this claim was to swindle the users & make them download & run a malicious executable file named as “cashback.exe”.

Upon execution, this file loaded a malicious version 1.4 of the Nemty Crypto Virus.

Behavior of the Latest Nemty Ransomware variant

The last of the Nemty Ransomware variants used an entirely different exploit kit named Radio Exploit Kit to propagate. In addition to that, phishing e-mails containing infected attachments are being used to trick the users. A mere click on the infected attachments runs the executable files; hence it makes the exploit successful. Thus, Nemty Ransomware is downloaded & executed on the targeted system.

This new Nemty variant contains malign codes for killing the processes & services so as to encrypt the files currently in use with ease.

Some of the processes at the target of the Nemty include WordPad, Microsoft Word, SQL, VirtualBox Software, Microsoft Excel & Outlook Thunderbird E-mail Clients.

Countries currently at the target of Nemty include Russia, Belarus, Kazakhstan, Tajikistan, Ukraine, Azerbaijan, Armenia, Kyrgyzstan and Moldova.

Distribution Techniques of Nemty Ransomware –

The cyber-criminals use various strategies for Nemty Ransomware distribution which include –

1. Software Bundling: Software bundling is the process in which a malicious program is distributed with other free software, to get an unnoticed entry into your computer system. When a user installs a free application, the malicious programs gains a front door entry with the free application, the user has downloaded. Thus, it is a good idea to keep an eye on the installation screens while installing these free applications.
2. Spam Emails – Spamming is the most economic and common method used for the distribution of such malware. The targeted users get genuine looking emails which contain .doc, .txt, and other similar attachments. These attachments can be named as anything which can grab the user’s attention and triggers him/her to open the attachment. As soon as the user opens this attachment, the malware infects the user’s computer system.
3. Malicious Websites or Malevolent Advertisements: The malicious websites are the ones which are created just for promoting the malware infections. Such websites include but are not limited to porn sites, torrent sites and other free downloading platforms. By visiting such websites, the adware infects the user’s computer without permission. Fake advertisements and updates like Flash player and windows updates which ask the user to update to the latest version are a few examples. When the users click on such links, their computer system gets infected. That is why, it is highly recommended to resist clicking on such links. Also avoid clicking on advertisements offering free stuff such as Win an iPhones, cars or free overseas trips etc.

Other prominent spread techniques include exposed Remote Desktop Connections, fake PayPal Sites, RIG Exploit Kits & Radio Exploit Kits.

Download Vipre Malware Remover

Removal guidelines for Nemty Ransomware-

The removal steps of the Nemty Ransomware are still not known at this time. However, here are few common measures that have been concluded after proper research & analysis by our analysts.

STEP A: Reboot your system to Safe Mode

To restart the system to Safe Mode with Networking,  if already switched ON then follow the below steps:

Windows 7/ Vista/ XP

1. Click on Windows icon present in the lower left corner of the computer screen.
2. Select and click  Restart.
3. When the screen goes blank, Keep tapping  F8  Key until you see the Advanced Boot Options window.
4. With the help of arrow keys on keyboard, Select Safe Mode with Networking  option from the list and press the Enter Key. The system will then restart to Safe Mode with Networking.

5 Once the system restarts, click on the username and enter the password (if any) to log in.

Windows 10 / Windows 8

1. Press and hold the Shift Key and simultaneously click on the windows icon present in the lower left corner of your computer screen.
2. While the Shift key is still pressed click on the Power button and then click on Restart.
3. Now select Troubleshoot → Advanced options → Startup Settings.
4. When the Startup Settings screen appears which is the first screen to appear after restart, select and click on Enable Safe Mode with Networking. The system will then restart to Safe Mode with Networking.
5. Once the system restarts in Safe Mode, click on the username and enter the password, if any to log in.

STEP B: Delete the suspicious key from the Configuration Settings

1. Type “Msconfig” in search box / Run Box, select it and press Enter.
2. Click on “Services” Tab and click on “Hide all Microsoft services”.
3. Select Nemty Ransomware from the list of remaining services and disable it by removing the tick mark from the checkbox and click on Apply button.

Windows 7

1. Click on the next tab – “Startup”.
2. Find any blank or suspicious entry or the entry with Nemty Ransomware mentioned and remove the check mark.
3. Click on Apply button and then click on OK.

Windows 10

1. Click on the next tab – “Startup”.
2. Take the mouse cursor to ‘Open task Manager‘ link and click on it.  This opens the Task Manager window.
3. Find any blank or suspicious entry or the entry with Nemty Ransomware mentioned and click on it.
4. Then click on Disable button.

STEP C: Remove Malicious Program from Command Prompt

Once the system starts, ensure to use an account with administrative privilege to access Safe Mode with Command Prompt.

After the user enters admin credentials, Command prompt window is displayed wherein you are entitled to enter the below commands:

1. Type the command “sc delete Nemty Ransomware” in the command prompt and press Enter.
2. Type “exit” to exit the command prompt and restart the system in safe mode with command prompt.

STEP D: Restore the System Files & Settings

From Control Panel

For Windows 7

1. Click on the ‘Start’ button on the taskbar. This will open the Start menu.
2. Click on the ‘Control Panel’ button in the Start menu. This will open the control panel window.
3. In the Control Panel window, click on the ‘View by:’ button on the top right. Select the Large Icon option
4. In the control Panel window click on the ‘Recovery Icon’. This will open a window that will ask ‘Restore the computer to an earlier point in time’.
5. Click on the ‘Open system restore’ button. This will open the ‘system restore ’window where you need to click on the Next Button.
6.  Select the restore point that is prior the infiltration of Nemty Ransomware. After doing that, click Next.
7. This will open the ‘Confirm your restore point’ dialog box. Click on Finish button. This will restore your system to a previous restore point before your system was infected by Nemty Ransomware.

OR

From Command Prompt

1. Type cmd in the search box and click on the command prompt to open the Command Prompt window. box and clicking on it.
2. Once the Command Prompt window shows up, enter cd restore and click Enter.(Ensure that you in the system32 directory of Windows folder in C Drive)
3. Now type rstrui and press Enter again.
4. When a new window shows up, click Next and select your restore point that is prior the infiltration of Nemty Ransomware. After doing that, click Next.
5. This will open the ‘Confirm your restore point’ dialog box. Click on Finish button. This will restore your system to a previous restore point before your system was infected by Nemty Ransomware.

OR

Using Run Command

1. Type ‘Rstrui’ in the search box present on the task bar. This will open the System restore dialog box.

Continue to follow steps 4 & 5 of Method 2 to restore the System Files and settings.

How to prevent Nemty Ransomware from infecting your system-

1. Keeping the Operating System Updated- In order to remain protected and avoid such infections, it is recommended to keep your Operating System updated by enabling the automatic update on your system. The systems with outdated or older versions of Operating System become an easy target for the attackers.
2. Resist clicking on spam emails – One of the major techniques used for malware distribution is forwarding spam emails to the user. The system gets infected as soon as the user clicks on the attachment. These mails appear to be genuine, so be aware and resist falling for these tricks.
3. Keep an eye on third party installations- It is quite important that you take due care while installing any third party applications for they are major source of such infections. Such malware programs come bundled with the free applications thereby requiring the user to remain cautious.
4. Regular periodical backup- In order to keep your data and files safe, it is recommended to take regular back up of all your data and files either on an external drive or cloud.
5. Use Anti-Virus Protection- We strongly recommend the use of antivirus protection/internet security in your PC like Vipre and BULL GUARD so that it remains safe.
6. Enable the Ad Blocker/Popup Blocker in your browser- Enabling the popup blocker/ ad blocker in your chosen browser will help you to stay protected from annoying adware.