Rastakhiz ransomware / virus (Removal Guide) - Bonus: Decryption Steps
Rastakhiz virus Removal Guide
What is Rastakhiz ransomware virus?
Rastakhiz ransomware – a virus that locks all personal files and demands a ransom
Rastakhiz is a HiddenTear[1] based malware that is designed to encrypt files on the targeted computer. Ransomware appends .RASTAKHIZ file extension in order to make files inaccessible. Following this destructive behavior, the virus delivers a poorly written and impolite ransom note.
The ransom note tells that users are “screwed” because the ransomware encrypts their images, videos, songs, text files, and other data. Victims are asked to transfer the ransom of 250 USD to the provided Bitcoin wallet address until the given time expires.
| name | Rastakhiz |
|---|---|
| Type | Ransomware, cryptovirus, file-locker |
| Symptoms of infection | Personal files are encrypted and renamed; ransom note appears |
| Ransom amount | $250 |
| Criminal contact details | gsah5029@gmail.com, andalihacker8001@gmail.com |
| Distribution | Fake Flash Player updates, file-sharing platforms, spam emails |
| Elimination | Instead of paying the criminals, remove the ransomware and use alternative data recovery options |
| System health | Use the FortectIntego PC repair tool to fix all system irregularities that the infection might have caused |
The ransom note provides detailed instructions on how to pay the ransom and claims that developers are the only ones who can help to get back access to the encrypted files, and users should trust them:
“Don’t worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users.”
Victims are also asked to provide their unique ID number and email address in order to receive the decryption key. According to the researchers, the authors of the ransomware will respond within 6-8 hours via gsah5029@gmail.com or andalihacker8001@gmail.com email addresses. However, it’s doubtful that Google won’t notice such strange activities and won't suspend these accounts.
However, no matter what criminals promise, you should not believe them.[2] No one can assure if they keep their word or have a working decryption software. Thus, it’s better to remove Rastakhiz from the device to avoid money loss and make sure that your computer is safe to use again.
Additionally, some of the files might be restored with HiddenTear decryptor or other third-party software. However, if you have backups, you should not worry about criminals’ demands. You should opt for the removal immediately.
Keep in mind that crypto-viruses are complicated cyber threats. They might affect legit system processes and install numerous malicious components. Thus, you should use SpyHunter 5Combo Cleaner, Malwarebytes, or another legit malware removal tool to eliminate all malware-related files safely.
Once you eliminate .RASTAKHIZ file virus from your device, you must use the time-proven FortectIntego software to repair corrupted system files, fix broken DLLs, and remove all traces of the infection. This tool will also delete all tracking cookies that might endanger your privacy.
Avoid file-encrypting viruses by taking precautionary measures
Rastakhiz, as well as many other crypto-viruses, spread via malicious spam emails, bogus downloads, fake updates, or malicious ads. Malware researchers from Bedynet[3] report that any antivirus, anti-malware, anti-spyware, or another sophisticated security program cannot fully protect a device from malware. Thus, users should protect themselves by following these tips:
- Do not open suspicious or spam emails. If you open it, do not click on any content, such as links, buttons, or attachments, because they might install malware on the PC.
- Before opening email attachments or other content, always check the information about the sender and the issue.
- Download software from the publishers of developer’s websites only.
- Stay away from torrents, P2P networks, file-sharing sites, and similar free sources because they often include malicious content that looks like safe programs or cracks.
- Do not download illegal content, including programs, music, movies, etc.
- Update software from the official sources and ignore pop-up alerts that might appear on various websites. They are always malicious.
- Make backups and update them regularly.
Detailed instructions to remove Rastakhiz virus
If you are thinking about manual Rastakhiz removal, you should get rid of this idea right now. It’s a complicated and risky activity because you might damage the system or keep some malware-related entries on the device.
To remove the ransomware safely and entirely, you have to use a reputable anti-malware program and run a full system scan. We recommend using SpyHunter 5Combo Cleaner and Malwarebytes, but you can choose your preferred tool as well. However, if you cannot install a security program, follow the guide below.
When you remove Rastakhiz ransomware, don't forget to perform system diagnostics to ensure that all virus traces are gone and to ensure that your computer runs smoothly. We strongly recommend entrusting this task to the patented FortectIntego software.
Getting rid of Rastakhiz virus. Follow these steps
Manual removal using Safe Mode
If you cannot run automatic malware's elimination, reboot to Safe Mode with Networking:
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Rastakhiz using System Restore
System Restore might help to install or activate security software:
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Rastakhiz. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Bonus: Recover your data
Guide which is presented above is supposed to help you remove Rastakhiz from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.If your files are encrypted by Rastakhiz, you can use several methods to restore them:
Data Recovery Pro might help to restore encrypted files
This tool is created to recover files after system wreckage or accidentally deleted data. However, some users report that it also helped after various ransomware attacks. Thus, you should give it a try.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Rastakhiz ransomware;
- Restore them.
Take advantage of Windows Previous Versions feature
Computer users who enabled the System Restore method before ransomware attack can copy individual versions of files by following these steps:
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Try ShadwoExplorer to restore data
If malware did not delete Shadow Volum Copies of the targeted tiles, do not hesitate and try this tool:
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
HiddenTear decryptor
The official decryptor for the article's culprit is not available yet. However, you can try tools that help restore files encrypted by HiddenTear because malware is based on its code. Try decryptor 1 and decryptor 2.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Rastakhiz and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Protect your privacy – employ a VPN
There are several ways how to make your online time more private – you can access an incognito tab. However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of Private Internet Access VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise. Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and Private Internet Access VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers – human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence. In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. Data Recovery Pro is one of the leading file recovery solutions you can find on the market – it is likely to restore even lost emails or data located on an external device.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
- ^ Ransomware Recap: The Ongoing Development of Hidden Tear Variants. Trend Micro. Cyber security solutions.
- ^ Tim Greene. Consultant urges never pay ransomware demands. NetworkWorld. etwork news, trend analysis, product testing and the industry's blogs.
- ^ Bedynet. Bedynet. Russian security news.