Rectot Virus - How to remove

Rectot is a serious virus that affects computers running the Windows operating system. Rectot is a type of ransomware (cyber extortion) that encrypts files to make them inaccessible until a ransom is paid.

The symptoms of Rectot

Files that are encrypted by Rectot are named [old file name].rectot. Not only are they renamed, but they’re also totally encrypted. Editing them will not fix them.

A ransom note put into a _readme.txt file. The ransom note changes very little from the other DJVU/STOP viruses (Dotmap, Drume, Promorad2) and starts like this:

ATTENTION!
Don’t worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.

The criminals’ email addresses are included in the ransom note – [email protected], [email protected], and @datarestore (a Telegram account).

Rectot’s note also gives the price of fixing the files: $490 to $980.

The impact

A Rectot infection can easily cause stress and lose time and even money.

Rectot is part of the STOP/DJVU group which has been going strong for a few months now. The encryption that Rectot uses on the files is strong and hard to break. Almost all the user-created files are encrypted — pictures, songs, documents. If the encryption is well implemented, it won’t be broken without the decryption keys (which only the developers of Rectot have). Decryption is generally very useful for protecting private information, for example, securing banking operations, so it has been developed to be very resistant to breaking.

Contacting Rectot might seem tempting, especially when they threaten that the decryption will become more expensive if too much time passes between the infection and the contact: $490 might rise to $980. However, even if the ransom is paid, the files are not sure to be restored by the criminals. Online extortionists do not have a good reputation for keeping their promises.

A Rectot infection might also signify more malicious viruses being present because some versions of the DJVU/STOP virus are distributed together with some other malware, like keyloggers. Rectot can even modify Windows settings to prevent you from accessing some websites, or cripple the installed antivirus program.

The best defense against ransomware is having good backups, but even then, the files there might be slightly outdated, and it can take a lot of time to remove all malware and restore the files.

How Rectot is distributed

Rectot might sneak into a computer through:

• malicious spam email (this seems to be the primary way for ransomware to spread).
• hacked Remote Desktop connection,
• freeware bundles,
• peer-to-peer filesharing.

It’s important to always update your antivirus and scan files before opening or running them. Even files that look innocent could cause harm.

To be safe against infected spam emails, learn about phishing messages and their red flags: the impersonal way of addressing the recipient, the urgency, the unnecessary attachments or link, and how unexpected the message is. Phishing might seem crude, but it can be powerful, especially spear phishing. A lot of high-profile hacking is done by obtaining someone’s login credentials through phishing.

Don’t overlook the importance of passwords — they should not be easy to guess.

And finally, it’s essential to keep multiple copies of any important files. Not just because of ransomware; disks can break or fail, a laptop could be stolen, things might be deleted accidentally. Backups should:

• be recent (and updated when needed),
• be disconnected from the computer that is being backed (otherwise a virus would still be able to reach it),
• be tested (know that the backups will work, that you know how to quickly restore from them).

How to remove Rectot

First, it’s important to get rid of all malware, if any is still infecting your computer. Spyhunter, or another powerful antivirus would be able to do that.

As for the files, if you don’t have backups to restore the files from, there is a decryptor — direct link — that might decrypt a few of the Rectot files (or none, there’s no guarantee). The decryptor is being developed by a volunteer named @demonslay335 on his spare time.

As a final resort to recover the lost files, look at the guide below and see if something works, for example, data recovery might be able to restore some of them, depending on your circumstances.

Automatic Malware removal tools

How to recover Rectot Virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Rectot Virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Rectot Virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Rectot Virus. You can check other tools here.  

Step 3. Restore Rectot Virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Rectot Virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Rectot Virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.