Vitya Ransomware EXPOSED: .vitek Files and a Telegram Pop-Up

You open the folder you used yesterday. The vacation photo should be there. The invoice should be there. The tax spreadsheet should be there. The names are still familiar. Then you see the extra ending. vacation.jpg is now vacation.jpg.vitek. The PDF is invoice-2026.pdf.vitek. The sheet is taxes.xlsx.vitek. The video is family.mp4.vitek. The contract is contracts.docx.vitek. Windows may call the type a VITEK file and offer you a useless “choose an app” box.

Then a window you did not open takes over the screen. That window is the ransom demand. Vitya ransomware does not leave a text note in the folder. It does not drop a README. It does not print a wallet. It talks through a pop-up. The heading is loud on purpose. OOPS, YOUR FILES ARE ENCRYPTED! The rest of the pitch is short. Documents, photos, and videos are locked. The window says recovering files is impossible without our private key. A countdown timer sits in the same frame so the next minute feels expensive.

The window also hands you a person to write to. That is the part that separates this strain from other pop-up lockers. It points at Telegram. The support handle is @VityaSupport. The news channel is the one people write as t.me/VityaNews. There is no $ amount on the glass. Nobody printed a bill. The missing number is not a kindness. It is how they get you into a chat. This page is for the moment those names appear. It is about this strain, the one that writes .vitek on the end and then sells the unlock through a Telegram pop-up.

Overview

The first tell is the rename. Vitya keeps the original name and the original extension, then appends .vitek. A file named 1.jpg becomes 1.jpg.vitek. A file named vacation.jpg becomes vacation.jpg.vitek. You can still read what the object used to be. You cannot open it. That is the point of a visible stamp. The folder still has one object per file. The shock lands harder because the photo still “looks” like it is there.

The second tell is the pop-up. After the files are locked, the demand appears on the screen. Most lockers drop a README or a decrypt text file next to the photos. Vitya skips that paper trail. The pitch lives in a window. The window shouts that the files are encrypted. It names the everyday things people actually care about. Documents. Photos. Videos. It tells you, in their words, that recovering files is impossible without our private key. It runs a countdown so you watch the clock instead of looking for last month’s backup.

The third tell is the Telegram aisle. Look at that window the way you would look at a shop that hid the price tag and left a clerk at the door. There is a support handle. There is a channel. There is no $ figure printed as a bill. The conversation is the product. Once you write to @VityaSupport, or once you open the VityaNews channel on Telegram, you are no longer looking at a locked folder. You are talking to the people who locked it.

Some other pop-up lockers do the opposite. Kreepr ransomware also uses a window instead of a text note. Kreepr leaves you with no inbox, no wallet, and no chat. Vitya does not do that. Vitya wants the chat. That difference matters when a later helper tries to “complete” your case. If your screen already showed Telegram, you do not need a stranger to invent a second contact. If a later note claims Vitya “forgot” a wallet, that later note is a new shop.

Ransomware is malware that encrypts files so the system that relies on them becomes useless. Payment is common in many families. A printed $ amount is not a required feature. If the files end in .vitek and the apps that created them will not open the contents, you are in a ransomware incident even if the pop-up never named a price. The missing number does not make the lock smaller. It makes the next step a conversation.

The .vitek name is the first warning

Ransomware families pick an extension so you notice the change in seconds. Vitya uses .vitek and leaves the rest of the filename alone. That choice is not kindness. It is a billboard. You can still read invoice-2026.pdf in front of the new ending. You can still see that the family video is the family video. The listing looks almost right, which is why the first instinct is to double-click.

Double-clicking does not bring the photo back. An app cannot talk ciphertext back into a JPEG. Taking .vitek off the name does not reverse the lock. You may get a file that Photos or Excel tries to open and then fails. You may also scramble a later trusted tool that expected the stamped name to stay put. The extra letters are a label. The lock is in the bytes.

The same stamp makes a later scam easier. Anyone who sees a pile of .vitek files can pretend they already “have your case.” They can quote the ending back to you. They can offer a paid unlock. They can invent an email address the original pop-up never printed. They can even quote @VityaSupport so they sound close to the window you already saw. The extension is branding. It is not a hint that the file can be renamed back to normal, and it is not a ticket number for a recovery desk that exists.

Do not bulk-rename the files to hide .vitek. Do not run a random “extension fixer” you found in an ad. Do not drag the locked copies into a cloud sync folder “so they upload clean.” Leave the locked copies as they are until you have a clean machine and a plan that does not start inside that pop-up or inside a Telegram chat.

The demand lives in a pop-up, not a text file

Most households learn ransomware from a note on the desktop. The note has a filename that sounds like a product. People print it. People photograph it. People search the exact words. Vitya does not give you that file. The demand is a window. That is unusual enough that some victims waste the first hour hunting for a README that is not there.

The pop-up talks in a theatrical, inevitable tone. OOPS, YOUR FILES ARE ENCRYPTED! is the opening shout. Then it narrows the damage to the files people actually open. Documents. Photos. Videos. Then it closes the other doors. Recovering files is impossible without their private key. That sentence is sales copy. It is meant to make every honest option feel pointless so Telegram feels like the only adult in the room.

A window is a better trap than a text file in one specific way. A text file can be closed. A window can sit on top of the work you are trying to do. It can keep a timer in your peripheral vision. It can make a restart feel like a dare. That is sales theater. A pop-up cannot unlock a file. Closing it cannot unlock a file. Writing to the handle inside it cannot unlock a file unless the authors already decide to hand you a key, which you cannot enforce.

If you still have the window on screen, treat it as evidence, not as a control panel. A photograph of the pop-up can help a later technician identify the strain. Interacting with the timer is not identification. Opening Telegram from that window is how the authors keep you in the chair.

Telegram is the storefront

Classic lockers finish the job with a storefront. They print a mailbox. They print a Bitcoin address. They print a Tor site and a case ID. Vitya prints a chat app. The support handle is @VityaSupport. The channel is VityaNews on Telegram, the one written as t.me/VityaNews. Those are human Telegram names, not a repair team and not a software company. They are the checkout.

A chat handle looks friendlier than a wallet string. That is the point. A wallet feels like crime. A Telegram name feels like a person who might explain the bill. The first message is the moment they learn you are awake, scared, and reachable. After that, the price can appear. After that, a “sample decrypt” can appear. After that, a file can arrive that is not a key at all.

Do not open those chats to “see what they want.” Do not join the channel to “collect evidence” if you can photograph the pop-up from the locked machine instead. Do not forward the handle to a relative and ask them to negotiate. The contact is already complete. You do not need a second opinion from the people who locked the disk.

Keep the contrast with Kreepr in your pocket for later. If a comment, an ad, or a callback says pop-up ransomware never includes a way to pay, that person is describing a different strain. Vitya already gave you a way to talk. The fact that it skipped a $ figure does not mean the shop is closed. It means the shop wants you to walk in before you see the tag.

The missing $ amount is part of the pitch

The pop-up does not name a price. This page will not invent one. A number that never appeared on the glass is not a fact, and writing one here would only help the next scammer sound specific. The blank is the tactic. If the window had printed a $ bill, you could walk away from that number. If the window stays quiet, you have to ask. Asking is the funnel.

People will want a motive for the blank. A pop-up that talks like a ransom note and then withholds the price can look unfinished. It can also look like a shop that prices each victim after a short interview. It can look like a strain that plans to name a coin amount later, in chat, after it knows whether you are a household or a business. You do not have to pick a motive to protect the folder. The blank is enough. Treat it as a reason to stay out of Telegram, not as a puzzle you have to solve before you isolate the machine.

The honest reading stays narrow. This strain presents a ransom-style window, a countdown, and two Telegram names. It does not present a printed $ figure. That can mean the authors want room to haggle. It can mean the build is unfinished. It can mean a later sample will grow a wallet line. None of those readings unlocks contracts.docx.vitek. Do not invent a contact so the story feels complete. Do not help a stranger invent a price so the story feels complete.

How The Scam Works

You do not need a build guide to understand what Vitya does to a home or office PC. The victim-facing story is short. Something runs. Everyday files pick up .vitek. A pop-up appears instead of a text note. The pop-up shouts that the files are encrypted, names documents and photos and videos, and claims recovering files is impossible without their private key. A countdown runs in the same window. Then the story points at Telegram. @VityaSupport. The VityaNews channel at t.me/VityaNews. No $ bill. The rest of the sale happens after you write in.

This section stays on that story. It is not a list of switches, offsets, or sample hashes. If someone asks you how to “make a Vitya” or how to pull a key out of a binary, the answer is no. The useful work is isolation, a clean scan, and a restore from a backup that was not sitting on the same disk.

1. Something already ran

By the time you notice .vitek, the infection step is already behind you. Ransomware like this usually arrives the same ordinary ways other lockers do. A file from a chat. A cracked installer. A “codec” that was supposed to play one video. A remote-access leftover from last month’s “computer help” call. A document that asked you to enable something you should not have enabled.

You do not need to reconstruct the exact click to start protecting the rest of the house. Unplug the network if you can do that without turning the story into a reboot test. Stop the machine from talking to shared folders, cloud sync, and other PCs. The pop-up wants you staring at its clock. The first useful move is quieter. Cut the path it can still walk.

If other computers use the same NAS, the same USB disk, or the same cloud account that was mounted on this PC, assume those copies may be in danger too. A locker that has already finished one Documents folder can still be hungry. Do not plug the backup drive into the sick machine “just to check.” Check it from a clean computer after you know the infected one is contained.

2. Everyday files pick up .vitek

The visible work is a pass through the folders people actually use. Photos. PDFs. Spreadsheets. Videos. Word documents. The original name stays. The original extension stays. Then .vitek is glued on the end. 1.jpg becomes 1.jpg.vitek. vacation.jpg becomes vacation.jpg.vitek. invoice-2026.pdf becomes invoice-2026.pdf.vitek. taxes.xlsx becomes taxes.xlsx.vitek. family.mp4 becomes family.mp4.vitek. contracts.docx becomes contracts.docx.vitek.

Windows may start calling each object a VITEK file. That is the operating system reading the new ending, not a new file format you can install an app for. There is no official Vitya viewer. There is no store page that turns those bytes back into a vacation photo. “Open with” is a dead end. So is a bulk rename that tries to hide the stamp.

The listing can also show a tight cluster of modified times. A locker is a script with a job. It walks a tree and writes as it goes. A row of timestamps within a minute is a common look after an automated pass. It is a clue that the folder was processed, not a countdown you should try to beat by copying files while the machine is still infected.

Copying locked files to another disk can still be wise later, from a clean environment, so you keep a copy of the ciphertext. Doing that copy while the pop-up is live, onto the only backup you own, is how a second folder dies. Preserve first. Experiment never.

3. A window replaces the usual ransom note

After the rename, the demand is a pop-up. That is the costume change that throws people who have read about other families. They look for README.txt. They look for a decrypt HTML file. They look for a wallpaper with a wallet. Vitya puts the speech on the glass instead.

The window is written to feel personal and final. OOPS, YOUR FILES ARE ENCRYPTED! is not a system error. Windows does not talk like that when a photo is merely corrupt. The line is a pitch. Then the pitch lists the rooms in the house it just locked. Documents. Photos. Videos. Other files. Then it tells you recovering files is impossible without their private key. Then it tells you, in one form or another, not to waste time on anything else.

Because there is no text file, victims sometimes feel they have “less evidence.” You still have evidence. You have a folder of .vitek names. You have a screenshot of the pop-up if you can take one safely. You have the Telegram names printed in that window. Those three things identify the incident. You do not need a $ figure to prove you were hit, and you should not go hunting for one so the paperwork feels normal.

4. The window sells panic with a clock

The pop-up runs a countdown timer. This page will not invent the hours, the minutes, or a deletion schedule the window never explained in a way that can be trusted. The clock is there so your body feels late. A ticking number next to a locked photo is a simple trick. People watch the digits. People stop opening drawers. People start looking for the fastest human on the screen, which in this strain is a Telegram handle.

A countdown is attacker text. It is not a measurement published here. Some lockers really do destroy more files when a timer hits zero. Some lockers only want the feeling of a deadline. You cannot tell from the wording. You can tell that the wording is trying to own your next click. Do not sit in front of the timer to see if the next batch is real. Do not reboot as a test because the clock made a restart feel expensive. Do not let a stranger offer to “stop the clock” for a deposit.

The restart moment is the other half of the same trick. A normal person restarts to “clear the glitch.” A relative says to restart. A scanner asks for a reboot. The pop-up wants that moment to feel like a dare. Sometimes interrupting a locker makes the damage worse. Sometimes the sentence is only theater. A calm plan still beats a hostile timer. Disconnect the machine from the network. Do not keep working in the same user session as if the pop-up were a dialog box in a real program. Get a second opinion from a person who is not on the screen.

5. Telegram is where they want the conversation

A support handle plus a news channel is a complete storefront for a product you cannot return. It looks like customer service. It looks like the authors expect a ticket. The missing half of that interface is any reason to trust the person on the other end. Nobody offered a contract. Nobody offered an escrow you can enforce. Nobody mailed a key in advance. The chat is there so you will talk.

Talking is how people turn a bad hour into a worse one. A reused password typed into a hostile chat is now a password you should retire. A “sample file” uploaded to prove the damage is now a document the other side did not have in a convenient package. A helper app that claims it will speak to @VityaSupport for you is a second infection wearing a lab coat.

The channel is the other hook. VityaNews, written as t.me/VityaNews, looks like a status page. Channels are good at looking official. They can post a fake decryptor. They can post a wallet after the pop-up stayed quiet. They can post a warning that “only this chat is real” so any later honest advice looks like a competitor. You do not need that feed to identify the strain. The .vitek names and the pop-up already did that.

There is also a quieter harm. Time spent in Telegram is time not spent finding the real copies. Phone photos. An old USB disk in a drawer. A cloud version from last month. A work share that was not mounted. Those copies are the recovery path that does not depend on a handle the authors printed. The pop-up wants the opposite. It wants you in their chat, not in your backup drawer.

6. There is no $ figure, and that is not a coupon

This is the step that makes Vitya feel unfinished if you came here from a family that prints a wallet and a number. There is no amount on the glass. There is no coin address sitting next to the shout. The pop-up ends where other notes begin the checkout, then points you at Telegram so the checkout can happen in private. That is not a kindness. It is not a 0 % discount. It is a blank price tag sitting on top of a file lock.

Some readers will hear “no $ amount” and think the incident is smaller. It is not smaller. A household can lose the only copy of a year of photos while the authors wait for the first message. A shop can lose invoices while someone on Telegram decides what the week is worth. The missing number removes one printed demand. It does not restore the files. It does not prove the lock is fake. It does not mean a random unlocker from a video description is going to open contracts.docx.vitek.

It does mean you should be suspicious of anyone who later “finds” a price for you. If the original window had a $ figure, you would have seen it. If the original window had a wallet, you would have seen it. A helper who appears after you search the extension is not the missing half of the pop-up. That person is a new shop using your panic as inventory. So is the person already waiting at @VityaSupport.

7. A second shop copies the Telegram branding

After a ransomware incident, search results and inbox ads fill up with companies that say they can decrypt Vitya or “all .vitek files.” Some of those shops are ordinary overpriced consultants. Plenty are a second scam. They will quote the extension back to you. They will mention the pop-up so they sound close to the case. They will mention @VityaSupport as if repeating the handle were a credential. They will ask for a sample file, a remote-access session, or a deposit.

The second scam has a friendly website and a case manager. It may even open one junk file, because anyone can decrypt a file they themselves just locked. Then the price rises, the chat dies, or the remote tool installs more malware. A detection name in their sales copy does not make them a vendor. A screenshot of the VityaNews channel does not make them the original authors, and being the original authors would not make them a safe checkout either.

A real public decryptor, when one exists, shows up on an official project page that already existed before your incident. It does not need a deposit in cryptocurrency. It does not need you to “hold a slot.” It does not need a first message to @VityaSupport. If the pitch is “we can decrypt, pay us first,” you are still in the market the ransomware created, even though the ransomware itself never named a $ figure.

8. A chat is not an unlock, and a later payment still closes nothing

Writing to the handle is not identification work. It is the sale. Even in families where a key sometimes arrives, payment is not a contract. The people on the other end can take the money and disappear. They can send a tool that only unlocks a few files. They can come back later and lock the same machine again. Vitya makes that warning simpler, because the only printed path is a chat app you do not control.

If someone later adds a wallet and a $ quote, they are still selling a product you cannot enforce. If the quote arrives inside Telegram, that is the original shop finishing the flyer. If the quote arrives in email from a company that found you after you searched .vitek, that is a second shop. Neither one is a recovery plan.

The same access that delivered Vitya the first time can still be open. A payment, a Telegram bargain, or a remote “unlock session” does not close the hole. Official advice from projects such as No More Ransom and from CISA StopRansomware has been consistent for years. Isolate. Keep the locked files. Look for clean backups. Look for a trusted decryptor if one exists. Do not start a relationship with the people who locked the disk, and do not start one with a stranger who only appeared after you searched the extension.

What To Do If Your Files End in .vitek

Do not message @VityaSupport. Do not open the VityaNews channel on Telegram, the one written as t.me/VityaNews. Do not sit in front of the countdown to see what happens at zero. Do not invent a $ amount so the incident feels complete. Do not pay a later helper who claims they found “the real Vitya wallet” the pop-up forgot to print. If you already sent a first Telegram message before you found this page, stop there. Do not keep the chat alive.

• STEP 1: Use Rkill to terminate suspicious programs.
• STEP 2: Use Malwarebytes to remove for Ransomware and Unwanted Programs
• STEP 3: Use HitmanPro to remove Trojans and other Malware
• STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware
• STEP 5: Perform a final check with ESET Online Scanner
• STEP 6: Restore the files encrypted by ransomware

STEP 1: Use Rkill to terminate suspicious programs.

In this first step, we will download and run Rkill to terminate suspicious programs that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Use Malwarebytes to remove Ransomware and Unwanted Programs

In this second step, we will install Malwarebytes to scan and remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   DOWNLOAD MALWAREBYTES FOR WINDOWS (FREE)
   
   (The link opens in a new page where your download will start)

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.

   

STEP 3: Use HitmanPro to remove Rootkits and other Malware

In this third step, while the computer is in normal back, we will download and run a scan with HitmanPro to remove Trojans, rootkits, and other malicious programs.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   DOWNLOAD HITMANPRO (FREE SCAN)
   (The link opens in a new page where your download will start)

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 4: Use AdwCleaner to remove Malicious Browser Extensions and Adware

In this next step, we will use AdwCleaner to remove malicious browser policies and unwanted browser extensions from your computer.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   DOWNLOAD ADWCLEANER (FREE)
   (The link opens in a new page where your download will start)

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner_x.x.x.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 5: Perform a final check with ESET Online Scanner

This final step involves installing and running a scan with ESET Online Scanner to check for any additional malicious programs that may be installed on the computer..

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   DOWNLOAD ESET ONLINE SCANNER (FREE)
   (The link opens in a new page where your download will start)

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

STEP 6: Restore the files encrypted by ransomware

Unfortunately, in most cases, it’s not possible to recover the files encrypted by this ransomware virus because the private key which is needed to unlock the encrypted files is only available through the attackers. However, below we’ve listed three options you can use to try and recover your files.

Option 1: Search a decryption tool for this ransomware

The cybersecurity community is constantly working to create ransomware decryption tools, so you can try to search these sites for updates:

• https://id-ransomware.malwarehunterteam.com/
• https://decrypter.emsisoft.com/
• https://noransom.kaspersky.com/
• https://www.avast.com/ransomware-decryption-tools

Option 2: Use EaseUS Data Recovery Wizard Free to recover the encrypted files

EaseUS Data Recovery Wizard Free can restore files and repair corrupted files with simple clicks. Its powerful scanning algorithms can identify and retrieve huge file type library, including all of the popular video files, audio files, photos, and document formats.
While the free version only allows you to recover 2 GB of data, this can be helpful to see if the recovery is possible and restore back the most important files from your computer.

1. Download EaseUS Data Recovery Wizard Free.

   You can download EaseUS Data Recovery Wizard Free by clicking the link below.

   

   EASEUS DATA RECOVERY WIZARD FREE DOWNLOAD LINK
   (The above link will open a new page from where you can download EaseUS Data Recovery Wizard)

2. Double-click on the EaseUS Data Recovery Wizard Free setup file.

   When EaseUS Data Recovery Wizard Free has finished downloading, double-click on the setup file to install EaseUS Data Recovery Wizard on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow EaseUS to make changes to your device. If this happens, you should click “Yes” to continue with the EaseUS Data Recovery Wizard Free installation.

3. Follow the on-screen prompts to install EaseUS Data Recovery Wizard.

   When the EaseUS Data Recovery Wizard installation begins, click on the “Install Now” as seen in the image below.
   

   When your EaseUS Data Recovery Wizard installation completes, click the “Start Now” button to start the program.
   

4. Select a location to start recovering the encrypted files.

   Choose the drive or folder where you are the encrypted files that you want to recover and click “Scan“.
   

5. Wait for the EaseUS Data Recovery Wizard scan to complete.

   EaseUS Data Recovery Wizard will now scan your computer files that can be restored. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
   

6. Find the files you want to recover.

   When the EaseUS Data Recovery Wizard scan is finished scanning it will show a screen that displays the files that can be recovered. This tool can recover a lot of data, use the “Filter” button to quickly filter specific file types and find the files that you want to recover.
   

   Click the “Preview” button or double-click on a file for a full preview.
   

7. Select your files and click “Recover”.

   Finally, select the the files you want to recover and click “Recover“.
   
   Choose a safe location to save all the files.
   
   The free version only allow you to recover 2 GB of data, however, this will allow you to recover the most important files and see if EaseUS Data Recovery Wizard can correctly recover them.
   

Option 3: Try to restore your files with ShadowExplorer

This ransomware will attempt to delete all shadow copies when you first start any executable on your computer after becoming infected. Thankfully, the infection is not always able to remove the shadow copies, so you should continue to try restoring your files using this method.

1. Download ShadowExplorer.

   You can download ShadowExplorer from the below link.

   SHADOW EXPLORER DOWNLOAD LINK
   (This link will open a new web page from where you can download “ShadowExplorer”)

2. Install ShadowExplorer.

   Double-click on the ShadowExplorer-x.x-setup file to start the installation process, then follow the on-screen promts to install this program.
   

3. Select snapshot date.

   Open ShadowExplorer and then from the top bar select the drive where the files that you want to save are located, then select from the snapshot available one previous to this infection.

   

4. Export the files that you want to recover.

   Once you have found a copy of the original file or folder, right-click on it and the select “Export”. A window will prompt you where you want to save the file or folder.
   

Keep every .vitek name exactly as it is. Do not bulk-rename vacation.jpg.vitek, invoice-2026.pdf.vitek, taxes.xlsx.vitek, family.mp4.vitek, or contracts.docx.vitek back to the old endings. Taking the stamp off is not a repair. It can make a later trusted tool worse, not better. 1.jpg.vitek should stay 1.jpg.vitek until a clean machine and a real plan are in place.

Keep a screenshot of the pop-up if you already have one. That window is how you prove this was Vitya and not a different locker that only uses a pop-up. The shout OOPS, YOUR FILES ARE ENCRYPTED!, the line about documents and photos and videos, the private-key sentence, the countdown, and the two Telegram names are the fingerprint. The window is evidence. It is not a control panel. Do not keep poking the timer. Do not enter a password you use for email or banking. Do not paste a string a commenter called a universal key.

Read the Telegram names the same way. @VityaSupport is not support. VityaNews is not a status blog you need. Those handles are how this strain differs from a pop-up locker such as Kreepr, which prints no contact at all. Do not treat that difference as an invitation. Do not write in “just to get the price.” There was no $ amount on the glass, and this page is not going to invent one so you can decide whether the number feels small.

If a later message, a later wallpaper, or a later phone call offers a second contact because “Telegram is down” or “Vitya moved to email,” that is a new shop, not a repair of the old one. If that later pitch names a $ figure, that is still a ransom the original window never printed. Do not answer. Do not help them finish the flyer. Do not send a sample photo so they can “prove the key.”

There is no public decryptor known for this strain. Do not download a “Vitya decryptor” from a video description, a comment, a file-sharing page, or the VityaNews channel. Do not assume a tool written for a different pop-up locker will open .vitek files. A family name on a scanner report, if you have one, is a label. It is not an unlock. Keep that name in your notes for a technician. Then leave the folklore alone.

The Bottom Line

Vitya ransomware is a locker with a visible stamp and a Telegram pop-up. It appends .vitek to the original name. 1.jpg becomes 1.jpg.vitek. vacation.jpg becomes vacation.jpg.vitek. invoice-2026.pdf becomes invoice-2026.pdf.vitek. taxes.xlsx becomes taxes.xlsx.vitek. family.mp4 becomes family.mp4.vitek. contracts.docx becomes contracts.docx.vitek. The demand is a window, not a text note. The window shouts OOPS, YOUR FILES ARE ENCRYPTED! It says documents, photos, and videos are locked. It says recovering files is impossible without our private key. It runs a countdown.

The window also prints a way to talk. The support handle is @VityaSupport. The channel is VityaNews on Telegram, written as t.me/VityaNews. There is no $ amount on the glass. The blank price is the funnel into chat. That is the tell that separates Vitya from a pop-up locker such as Kreepr, which never names a contact at all. Telegram is not a help desk. The countdown is attacker text, not a stopwatch published here.

There is no public free decryptor known for this strain. A scanner label is not a key. An old unlocker for a different family is not something this page will vouch for against .vitek files. Do not rename the stamp away. Do not message the handle. Do not join the channel. Do not invent a checkout. Do not buy one from a stranger who arrived after the pop-up.

If you take one sentence with you, take this. A folder of names ending in .vitek, plus a ransom pop-up that points at Telegram and never prints a $ figure, is ransomware on the first sighting. Treat it that way before anyone later names a price the original window never showed.