Severity scale:  
  (99/100)

REKTLocker ransomware virus. How to remove? (Uninstall guide)

removal by Olivia Morelli - - | Type: Ransomware
12

New ransomware alert – REKTLocker virus. What should you know about it?

The first appearance of REKTLocker ransomware has been registered on August 2016. Once it compromises a computer, it implements RSA-2048 encryption procedure and locks all of the victim’s files. What is more, it adds .rekt file extension to each encrypted record. Encrypted files cannot be opened, edited, or manipulated in any way. Consequently, the virus drops ransom notes and asks to pay a ransom to rescue the encrypted data. Unlike other ransomware viruses, this one does not provide a payment website, but leaves a Bitcoin address in the ransom note (which is a Readme.txt file) and commands the victim to transfer 1 BTC (approximately 590$) to the given address. Authors of REKTLocker malware claim that they have the decryption tool and that the user needs to buy it if he wants to get access to his personal files ever again. That is nothing but a filthy blackmail! The full message is provided below:

Your computer has been encrypted.
Send 1 BTC to 1NuLLtgCmigRb5mXeFgsGDFnVLypLC4a8Y or your files will be permanently encrypted.
Decryptor:
other people’s keys will not work on your computer.
Do not think your antivirus will save you, it will not.

Please do not support criminals by paying them – this is the only way to stop cyber crime. If you paid, they would use your funds for further ransomware projects, and this is exactly what all of us, computer users, do not want to happen. To remove REKTLocker virus, use a strong malware removal program, for instance, Reimage. The anti-malware program will not decrypt your files, but it will remove the virus from the computer.

REKTLocker ransom note

How to decrypt your files?

Unfortunately, REKTLocker decryption tool has not been released yet, but let us tell you something promising. Malware experts research such viruses every day and put great efforts into their work. Sometimes, they come up with decryption tools, but we expect you to be understanding and realize that such analysis cannot be done in a few days or a week. In other words, you have to wait patiently – the decryptor might show up shortly. You can also recover your data from backups, so if you have such, implement REKTLocker removal immediately and plug in the storage device to your PC then.

How does this ransomware spread?

Just like we have mentioned before, this piece of malware spreads via Neutrino and Nuclear exploit kits. This means that if the user has any outdated or vulnerable programs on the system and visits a compromised Internet site, the malware can silently be dropped on the system and executed. To protect your PC from such threats, install a decent anti-malware program and update all programs.

Other ransomware threats also tend to spread via email; they come in a form of officially-looking emails with documents attached to them. Once the victim opens such attachment, the virus activates itself and starts to wreak havoc on the computer system.

How to remove REKTLocker malware?

REKTLocker virus is a severe computer infection, and if your computer has been compromised by it, you should take it seriously. Most likely you will not be able to retrieve your data now, so you should implement REKTLocker removal as soon as possible. We do not recommend you to attempt to delete this malware manually, as it is a complicated program that consists of many components, and you might not be experienced enough to identify, locate and delete all of them. Therefore, we recommend you to remove REKTLocker and all related threats with a help of the anti-malware program. The virus might attempt to block your antivirus program, or prevent you from downloading one, so in such case, follow these instructions:

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove REKTLocker ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall REKTLocker ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

Manual REKTLocker virus Removal Guide:

Remove REKTLocker using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove REKTLocker

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete REKTLocker removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove REKTLocker using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of REKTLocker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that REKTLocker removal is performed successfully.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from REKTLocker and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions


  • Blaire

    Yet another ransomware. How amazing. … NOT

  • Rizzle11893

    cannot get rid of this ransomware, i am so mad and i want to cry, i always thought antivirus is not necessary, i so regret not getting one! all my files documents work stuff is gone, i feel just completely lost rn…

  • Sira

    My dad downloaded this and he cannot decrypt the files, anyone has ideas how to decrypt those files

  • Cali

    This is frustrating, no way to get data back?