Online hackers or cyber criminals use Trojan-Ransom.Win32.Rector for normal working for disrupting normal working of PC and for illegal c
hanges of data making it of no use. How to overcome this problem?
Before telling the solution, Kaspersky Tech support professionals explain you the different signs of infection.
Signs of Infection
The Trojan-Ransom.Win32.Rector malware encrypts files with the following extensions: .jpg, .doc, .pdf, .rar. Then a cybercriminal nicknamed “††KOPPEKTOP††” offers to unblock the files and prompts to contact him:
ICQ: 557973252 or 481095
EMAIL: v-martjanov@mail.ru
Sometimes he asks to leave a message in the guest book of one of his websites:
http://trojan….sooot.cn/
http://malware….66ghz.com/
The messages displayed on the desktop of an infected computer are in Cyrillic.
Now that you know the signs, Kaspersky antivirus support laids below the steps to decrypt files.
Do the following to decrypt files encrypted by Trojan-Ransom.Win32.Rector:
- Download the utility RectorDecryptor.exe to an infected computer.
- Run the file RectorDecryptor.exe.
- The utility starts working by clicking the button Start scan
It finds and decrypts encrypted files. - Select the option Delete crypted files after decryption to delete copies of encrypted files with extensions .vscrypt, .infected, .bloc, .korrektor, etc. after successful decryption.
- By default, the utility saves its runtime log in the system disk (disk with installed operating system, usually С:\) root directory.
- Log files have names like: UtilityName.Version_Date_Time_log.txt.
- For example, C:\RectorDecryptor.2.3.7.0_10.02.2011_15.31.43_log.txt.
Know in the third step let’s know the command line options to use with the utility.
- -l <file_name> – create a log file.
- -h – show help on usable switches.
- -fpath <folder_path> – enforced decryption of all files in the indicated folder.
What to do if the utility did not help?
If the RectorDecryptor utility cannot disinfect files, download and launch the XoristDecryptor utility.
If the RectorDecryptor utility cannot disinfect files, download and launch the RakhniDecryptor utility.
To be protected from ransom malware, download and install Kaspersky Internet Security 2015. The application provides high-level protection against ransomware.
In case of any problem while removing trojan elements, contact third party Kaspersky Tech support on toll free number at 0-800-820-3300. They can be contacted via email, phone or chat – whatever medium you prefer. Contact today for online and offline assistance related to your antivirus software.
.png)
.png)
