How to eliminate Trojan-Ransom.Win32.Rector

In
this section you will find recommendations how to fight malicious
programs which cannot be disinfected by Kaspersky Lab's products. In
order to disinfect/remove malicious programs you may have to modify the
system registry or use an additional utility. If you failed to find the
necessary information or you find these recommendations too complicated
or inadequate, please send a request to the Technical Support service
via the [You must be registered and logged in to see this link.].

How to eliminate Trojan-Ransom.Win32.Rector
ID Article: 4264	Other languages: [You must be registered and logged in to see this link.]	1 583	2010 Aug 05 10:49	[You must be registered and logged in to see this link.]

Cybercriminals use Trojan-Ransom.Win32.Rector
for disrupting normal performance of computers and for unauthorized
modification of data making it unusable. Once the data has been “taken
hostage” (blocked), its owner (user) receives a ransom demand. The
victim is supposed to deliver the ransom in exchange for pirate's
promise to send a utility that would restore the data or repair the PC.

Kaspersky Lab specialists have developed a special utility for decrypting the data encrypted by Trojan-Ransom.Win32.Rector.

Do the following to decrypt files encrypted by Trojan-Ransom.Win32.Rector:

1. download the utility [You must be registered and logged in to see this link.] to an infected computer;
   
2. extract its content using an archiver (WinZip, e.g.);
   
3. run the file RectorDecryptor.exe;
   

Command line switches for the utility RectorDecryptor.exe:

• -c – delete copies of encrypted files with extensions .vscrypt, .infected, .bloc, .korrektor… upon successful disinfection.
  
• -l - create a log file.
  
• -y – close the utility upon disinfection.
  

The malicious program Trojan-Ransom.Win32.Rector encrypts files with extensions .jpg, .doc, .pdf, .rar. An offers to unblock files comes in from a cybercriminal named “††KOPPEKTOP††”. He is offering to communicate with him using the following contacts:

ICQ: 557973252 or 481095
EMAIL: [You must be registered and logged in to see this link.]

Sometimes he asks to leave a message in the guest book of one of his websites:

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

The messages displayed on the desktop of an infected computer are in Cyrillic.