YAYA Ransomware

YAYA Ransomware is a dangerous threat that takes users’ files as hostages. To be more precise, the malware encrypts them with a robust encryption algorithm. As a result, files become locked and cannot be opened unless they get decrypted. Of course, the hackers behind the malware claim to have the needed decryption tools and offer them to users who agree to pay a ransom. Such information should be available in the malware’s ransom note that gets dropped as soon as the malicious application finishes encrypting targeted files. If you want to learn more about what happens if this ransomware gets in and how to erase it if it does, we recommend reading the rest of this article. In addition, we can offer our deletion instructions that explain how users could remove YAYA Ransomware manually. However, keep in mind that it might be easier to use a reputable antimalware tool that would eliminate the ransomware for you.

Researchers say that YAYA Ransomware might be spread through spam emails, malicious file-sharing websites, fake notifications, or even via unsecured Remote Desktop Protocol (RDP) connections. Therefore, if you want to protect your computer from threats alike, you may have to take several precautions. First, we advise removing weaknesses like unsecured RDP connections, weak passwords, or outdated software. Next, we recommend being careful with files received via email or downloaded from questionable sources. If you are not sure that a file is safe to interact with, you should scan it with a reliable antimalware tool. Last but not least, we advise paying attention to notifications and advertisements you encounter. Never click on links or buttons if something seems suspicious or if you cannot verify that such content comes from reputable sources.

If YAYA Ransomware finds a way to enter your system, it should create a couple of files that we mention in the deletion instructions located below this article. In short, the created files might be necessary so that the malicious application could restart with the operating system. Such ability might place your future files at risk because the malware could encrypt new data each time when it restarts. The threat encrypts files with a robust encryption algorithm and appends the .yaya extension, for example, picture.jpg.yaya. Our researchers say that the malware ought to be after pictures, photos, various types of documents, and other files that are often considered private. That is because such data can be irreplaceable if users do not back it up. The next thing that YAYA Ransomware should do is display a ransom note after it finishes encrypting targeted files.

The malware’s ransom note should be called how_to_back_files.html. Inside of it you should find instructions telling how to contact the malicious application’s creators. According to the note, hackers will send decryption tools that could decrypt all YAYA Ransomware’s locked data. However, it is said that cybercriminals will only do so when they receive a payment. They offer decrypting a file that has nothing important on it for free to prove that they have the needed decryption tools. The bad news is that decrypting a single file does not prove that the YAYA Ransomware’s developers will send the promised decryption tools to those who pay the ransom. Meaning, you might not get what is promised even if you put up with all of the hackers’ demands.

We advise deleting YAYA Ransomware because, as said earlier, keeping it could be risky. If you decide you want to try to erase it manually, you could use the instructions we provide a bit below this paragraph. On the other hand, if you do not feel up to the task, you could employ a reliable antimalware tool that could remove YAYA Ransomware for you. In this case, you would need to install a chosen tool, let it perform a full system scan, and then press its displayed deletion button.

Restart your system in Safe Mode with Networking

Windows 8/Windows 10

1. Tap Win+I for Windows 8 or open the Start menu for Windows 10.
2. Click the Power button.
3. Press and hold the Shift key and click Restart.
4. Choose Troubleshoot and pick Advanced Options.
5. Select Startup Settings and click Restart.
6. Press the F5 key to restart the PC.

Windows XP/Windows Vista/Windows 7

1. Go to Start, pick Shutdown options and click Restart.
2. Press and hold the F8 key when the computer starts restarting.
3. Select Safe Mode with Networking from Advanced Boot Options window.
4. Click Enter and log on to the computer.

Remove YAYA Ransomware

1. Press Win+E.
2. Check these directories:
   %USERPROFILE%\Desktop
   %USERPROFILE%\Downloads
   %TEMP%
3. Search for the malware’s installer, right-click the threat’s launcher and press Delete.
4. Go to: %APPDATA%
5. Find randomly named malicious .exe file, for example, ransomware.exe, right-click it, and press Delete.
6. Find and right-click files called how_to_back_files.html, and select Delete to erase them.
7. Exit File Explorer.
8. Press Win+R.
9. Type Regedit and press Enter.
10. Navigate to: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
11. Look for a value name created by the malware, for example, CertificatesCheck.
12. Right-click the threat’s value name and choose Delete.
13. Exit Registry Editor.
14. Empty Recycle Bin.
15. Restart your device.