A ransomware virus going by the name N1N1N1 has been reported to use a very stron encryption algorithm to encode the files of unsuspecting users. The virus leaves behind the .n1n1n1 file extension to every file it has encrypted along with ransom instructions, name “how return files” in .txt and .html document. In those instructions the victim is notified that the files can no longer be opened by this ransomware and is asked to make a ransom payoff of 1.5 BTC to get the files back. Everyone who has become victims of the N1N1N1 crypto-virus is strongly advised to follow the instructions in this article to remove this malware and use alternative methods to try and restore encrypted files instead of paying the ransom.
|Short Description||The malware encrypts users files using a strong RSA encryption algorithm, making direct decryption possible only via a unique decryption key available to the cyber-criminals.|
|Symptoms||The user may witness ransom notes and “instructions” and a sound message all linking to a web page and a decryptor. Changed file names and the file-extension .n1n1n1 has been used.|
|Detection Tool|| See If Your System Has Been Affected by N1N1N1 |
Malware Removal Tool
|User Experience||Join our forum to Discuss N1N1N1 Ransomware.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
N1N1N1 Ransomware – Spread
N1N1N1 Ransomware – What Does It Do
As soon as it has infected your computer, the N1N1N1 virus may drop several types of malicious files on your computer:
The malicious files may be programmed to perform various activities such as changing he wallpaper of the infected computer, changing settings in the registry, connect to the cyber-crooks server and most importantly encrypt the files in it. They may be located in the following folders under different, usually random names:
After having created the malicious files, the N1N1N1 virus may run it’s primary executable which encrypts the files on the compromised computer. The virus may also heavily modify the Windows Registry Editor to make the encryptor run again and again every time you start Windows.
The file types that N1N1N1 is looking for to encrypt are many, but they are primarily associated with often used files, such as:
- Audio files.
- Image files.
- Database Files.
- Files associated with programs, like Photoshop, etc.
The N1N1N1 virus also cleverly skips the encryption of files that may pose a direct threat to the operating system and cause it to disfunction.
After having encrypted your files, the N1N1N1 ransomware leaves them with it’s distinctive .n1n1n1 file extension, for example:
The files can no longer be opened since their code structure is no longer the same.
After encrypting the files on a compromised machine, the N1N1N1 malware drops two files in each folder with encrypted files:
The ransom notes have the following ransom message:
The HTML document leads to the primary web page where the user can enter the decryption key after paying the ransom amount. After paying the user is provided with a decrypter and a master key to decode his files.
Remove N1N1N1 Ransomware and Decrypt .n1n1n1 Files
Before trying to restore the encrypted files, it is strongly advisable to get rid of this virus from your computer. You can follow the instructions below to remove N1N1N1 ransomware effectively, but it is also possible to remove it via an advanced anti-malware program automatically, swiftly and effectively.
The encryption algorithm used by the N1N1N1 ransomware is believed to be RSA cipher which generates a unique private and public keys after every infection. Direct decryption may be a time costly process and this is why researchers recommend not to pay any type of ransom money to cyber-criminals and to seek alternative solutions to decode the files, while a free decrypter is released out to the public. This is why we strongly advise using the alternative file restoration methods below in step “3. Restore files encrypted by N1N1N1” to help recover at least some of your files while a free decryptor is released which can happen in the near future. Make sure to often check this article as we will update it as soon as a free decryption method is discovered.