Remove gladius_rectus@aol.com ransomware (Restore encrypted files)

The gladius_rectus@aol.com ransomware uses very strong hybrid encryption with a large key. When the ransomware encrypts a file, it will add the crypton or cezar extension to each encrypted file. Once the ransomware infection finished enciphering of all files, it will drop a file with guide on how to decrypt all files.

The gladius_rectus@aol.com ransomware encourages to make a payment in Bitcoins to get a key to decrypt files. Important to know, currently not possible to decrypt .crypton or cezar files without the private key and decrypt program. If you choose to pay the ransom, there is no 100% guarantee that you can decrypt all photos, documents and music! If you do not want to pay for a decryption key, then you have a chance to restore encrypted photos, documents and music.

Therefore it is very important to follow the few simple steps below as soon as possible. The few simple steps will help you to remove gladius_rectus@aol.com ransomware virus. What is more, the step-by-step guide below will allow you recover encrypted personal files for free.

What is gladius_rectus@aol.com ransomware

The gladius_rectus@aol.com ransomware is a variant of crypto viruses (malicious software which encrypt personal files and demand a ransom). It affects all current versions of Microsoft Windows operating systems such as Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10. This ransomware infection uses a hybrid AES + RSA encryption mode to eliminate the possibility of brute force a key which will allow to decrypt encrypted personal files.

When the ransomware infects a personal computer, it uses system directories to store own files. To run automatically whenever you turn on your PC system, gladius_rectus@aol.com virus creates a registry entry in Windows: sections HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce.

Immediately after the launch, the ransomware virus scans all available drives, including network and cloud storage, to determine which files will be encrypted. The ransomware uses the file name extension, as a method to define a group of files that will be subjected to encrypting. Encrypted almost all types of files, including common as:

.pak, .dmp, .wpw, .bc7, .desc, .yal, .wpg, .wbz, .dxg, .odm, .jpeg, .cas, .big, .icxs, .sr2, .xll, .sis, .wbk, .sb, .r3d, .apk, .indd, .sav, .arw, .fos, .vtf, .wp6, .docm, .dbf, .zi, .wgz, .wpd, .txt, .z3d, .zif, .png, .xxx, .wdp, .dba, .wpd, .webdoc, .xmmap, .py, .0, .kf, .xmind, .wotreplay, .xml, .crw, .slm, .vpp_pc, .re4, .wps, .pkpass, .mddata, .wmv, .rb, .bay, .7z, .csv, .rar, .xls, .sidd, .erf, .xf, .vfs0, .rofl, .pem, .xlgc, .tor, .wmv, .lrf, .crt, .mef, .esm, .x, .sid, .pef, .ltx, .xpm, .fpk, .pfx, .ibank, .kdb, .xld, .wpe, .gho, .ptx, .srw, .1st, .ztmp, .nrw, .wri, .raw, .eps, .db0, .mov, .menu, .p7b, .qic, .wsc, .bik, .pptx, .cdr, .wpt, .epk, .litemod, .ybk, .z, .itdb, .avi, .odc, .bkf, .wbd, .syncdb, .xy3, .cfr, .vcf, .x3f, .cr2, .wav, .ws, .p7c, .ncf, .xlsb, .jpg, .xar, .wcf, .doc, .dcr, .bar, .dng, .srf, .vpk, .iwi, .wp7, .wbc, .upk, .xwp, .3fr, .ysp, .mdbackup, .lvl, .arch00, .blob, .odp, .x3f, .pdf, .xlsx, .hkdb, .wpa, .tax, .wmd, .rw2, .ntl, .w3x, .fsh, .sql, .bc6, .css, .gdb, .zip, .xlsm, .xdb, .mp4, .rim, .sie, .mcmeta, .xlsm, .wmf, .webp, .pdd, .pst, .ods, .m2, .ai, .layout, .wma, .wire, .svg, .hvpl, .mdf, .odt, .1, .orf, .p12, .xbdoc, .zdc, .zw, .bkp, .wsd, .sidn, .xx, .asset, .wsh, .xls, .mlx, .wps, .itl, .ff, .js, .mdb, .wma, .yml, .sum, .zip, .m3u, .xdl, .wmo, .das, .rwl, .iwd, .xyw, .wot, .wb2, .xbplate, .kdc, .wpb, .wpl

Once a file is encrypted, its extension changed to crypton or cezar. Next, the ransomware creates a file that contain instructions on how to decrypt all encrypted files. The gladius_rectus@aol.com ransomware actively uses scare tactics by giving the victim a brief description of the encryption algorithm and showing a ransomnote on the desktop. It is trying to force the user of the infected machine, do not hesitate to pay a ransom, in an attempt to restore their files.

How to decrypt files encrypted by gladius_rectus@aol.com ransomware

Currently there is no available way to decrypt your files, but you have a chance to restore files encrypted by gladius_rectus@aol.com ransomware for free. The ransomware infection repeatedly tells the victim that uses a strong encryption algorithm with 2048-bit key. What does it mean to decrypt the files is impossible without the private key. Use a “brute forcing” is also not a method because of the big length of the key. Therefore, unfortunately, the only payment to the creators of the gladius_rectus@aol.com ransomware virus entire amount requested – the only way to try to get the decryption key and decrypt all your files.

There is absolutely no guarantee that after pay a ransom to the developers of the gladius_rectus@aol.com ransomware infection, they will provide the necessary key to decrypt your files. In addition, you must understand that paying money to the cyber criminals, you are encouraging them to create a new ransomware infection.

How to remove gladius_rectus@aol.com ransomware

Most often it is not possible to remove the gladius_rectus@aol.com virus manually. For that reason, our team developed several removal ways which we have combined in a detailed guidance below. Therefore, if you have the gladius_rectus@aol.com virus on your personal computer and are currently trying to have it removed then feel free to follow the guidance below in order to resolve your problem. Some of the steps will require you to restart your system or close the web site. So, read this guide carefully, then bookmark or print it for later reference.

Remove gladius_rectus@aol.com ransomware with Zemana Anti-malware

Zemana Anti-malware highly recommended, because it can scan for security threats such gladius_rectus@aol.com virus, adware and other malware that most ‘classic’ antivirus programs fail to pick up on. Moreover, if you have any gladius_rectus@aol.com removal problems which cannot be fixed by this tool automatically, then Zemana Anti-malware provides 24X7 online assistance from the highly experienced support staff.

1. Download Zemana anti-malware (ZAM) by clicking on the link below. Save it on your Windows desktop or in any other place.
   
   

   Zemana AntiMalware
   164030 downloads
   Author: Zemana Ltd
   Category: Security tools
   Update: July 16, 2019
   
2. After the downloading process is finished, close all software and windows on your computer. Open a file location. Double-click on the icon that’s named Zemana.AntiMalware.Setup.
3. Further, click Next button and follow the prompts.
4. Once setup is finished, click the “Scan” button to perform a system scan for the gladius_rectus@aol.com virus . While the utility is checking, you can see number of objects it has identified as being infected by malware.
5. Once the scan get completed, a list of all threats found is produced. In order to get rid of all items, simply press “Next”. Once disinfection is finished, you can be prompted to restart your PC system.

Scan and clean your computer of ransomware virus with Malwarebytes

Manual gladius_rectus@aol.com ransomware removal requires some computer skills. Some files and registry entries that created by the virus can be not completely removed. We suggest that run the Malwarebytes Free that are completely free your system of ransomware infection. Moreover, the free program will help you to get rid of malware, PUPs, ‘ad supported’ software and toolbars that your personal computer may be infected too.

1. Download Malwarebytes (MBAM) by clicking on the link below and save it directly to your MS Windows Desktop.
   
   

   Malwarebytes Anti-malware
   326382 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: April 15, 2020
   
2. Once the download is complete, close all software and windows on your personal computer. Open a directory in which you saved it. Double-click on the icon that’s named mb3-setup.
3. Further, press Next button and follow the prompts.
4. Once installation is finished, click the “Scan Now” button to perform a system scan with this tool for the gladius_rectus@aol.com virus and other trojans and malicious applications. Depending on your PC, the scan may take anywhere from a few minutes to close to an hour. When a malicious software, adware or PUPs are detected, the number of the security threats will change accordingly. Wait until the the checking is done.
5. Once the system scan is finished, a list of all items detected is produced. When you are ready, click “Quarantine Selected”. Once disinfection is finished, you may be prompted to restart your PC.

The following video offers a step by step tutorial on how to delete browser hijacker with Malwarebytes.

Remove gladius_rectus@aol.com ransomware virus with KVRT

KVRT is a free removal tool that can scan your PC for a wide range of security threats such as the gladius_rectus@aol.com ransomware infection, ad-supported software, potentially unwanted applications as well as other malicious software. It will perform a deep scan of your machine including hard drives and Windows registry. After a malicious software is found, it will help you to remove all found threats from your personal computer with a simple click.

Download Kaspersky virus removal tool (KVRT) from the link below and save it directly to your MS Windows Desktop.

After the downloading process is complete, double-click on the KVRT icon. Once initialization procedure is finished, you will see the Kaspersky virus removal tool screen as on the image below.

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next click Start scan button for scanning your PC system for the gladius_rectus@aol.com ransomware virus and other known infections. When a threat is detected, the count of the security threats will change accordingly. Wait until the the scanning is complete.

Once it has finished scanning your machine, the results are displayed in the scan report as shown in the following example.

Make sure all malicious entries are ‘selected’ and click on Continue to begin a cleaning process.

How to restore files encrypted by gladius_rectus@aol.com ransomware

In some cases, you can recover files encrypted by gladius_rectus@aol.com ransomware virus. Try both methods. Important to understand that we cannot guarantee that you will be able to restore all encrypted documents, photos and music.

Use ShadowExplorer to recover files encrypted by gladius_rectus@aol.com ransomware

If automated backup (System Restore) is enabled, then you can use it to recover all encrypted files to previous versions.

Download ShadowExplorer from the following link and save it to your Desktop. This tool is available for Windows Vista, Windows 7, Windows 8 and Windows 10.

After the download is finished, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder like below.

Start ShadowExplorerPortable. You will see the a window as displayed on the screen below.

From the first drop down list you can choose a drive which contains encrypted files, from the second drop down list you can choose the date that you wish to recover from. 1 – drive, 2 – restore point, as shown below.

Righ-click entire folder or any one encrypted file and choose Export, as displayed below.

It will open a dialog box which asking whether you would like to restore a file or the contents of the folder to.

Run PhotoRec to recover files encrypted by gladius_rectus@aol.com ransomware

Before a file is encrypted, the gladius_rectus@aol.com ransomware infection makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to restore your files using file restore programs such as PhotoRec.

Download PhotoRec by clicking on the following link. Save it on your Windows desktop or in any other place.

When downloading is finished, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder like below.

Double click on qphotorec_win to run PhotoRec for MS Windows. It’ll show a screen as on the image below.

Choose a drive to recover as displayed in the figure below.

You will see a list of available partitions. Select a partition that holds encrypted photos, documents and music like below.

Press File Formats button and specify file types to recover. You can to enable or disable the restore of certain file types. When this is complete, click OK button.

Next, click Browse button to select where recovered personal files should be written, then press Search.

Count of restored files is updated in real time. All recovered personal files are written in a folder that you have chosen on the previous step. You can to access the files even if the recovery process is not finished.

When the recovery is finished, press on Quit button. Next, open the directory where recovered personal files are stored. You will see a contents as on the image below.

All restored files are written in recup_dir.1, recup_dir.2 … sub-directories. If you are looking for a specific file, then you can to sort your recovered files by extension and/or date/time.

How to prevent your machine from becoming infected by gladius_rectus@aol.com ransomware virus?

Most antivirus applications already have built-in protection system against the virus. Therefore, if your personal computer does not have an antivirus application, make sure you install it. As an extra protection, use the CryptoPrevent.

Run CryptoPrevent to protect your machine from gladius_rectus@aol.com ransomware virus

Download CryptoPrevent by clicking on the link below and save it directly to your MS Windows Desktop.

www.foolishit.com/download/cryptoprevent/

Run it and follow the setup wizard. Once the installation is finished, you will be shown a window where you can select a level of protection, as shown on the image below.

Now click the Apply button to activate the protection.

Finish words

After completing the few simple steps outlined above, your computer should be clean from gladius_rectus@aol.com ransomware virus and other malware. Your PC system will no longer encrypt your personal files. Unfortunately, if the step-by-step guide does not help you, then you have caught a new variant of ransomware, and then the best way – ask for help.

1. Download HijackThis from the link below and save it to your Desktop.
   
   

   HijackThis download
   4691 downloads
   Version: 2.0.5
   Author: OpenSource
   Category: Security tools
   Update: November 7, 2015
   
2. Double-click on the HijackThis icon. Next click “Do a system scan only” button.
3. Once finished, the scan button will read “Save log”, press it. Save this log to your desktop.
4. Create a Myantispyware account here. Once you’ve registered, check your e-mail for a confirmation link, and confirm your account. After that, login.
5. Copy and paste the contents of the HijackThis log into your post. If you are posting for the first time, please start a new thread by using the “New Topic” button in the Spyware Removal forum. When posting your HJT log, try to give us some details about your problems, so we can try to help you more accurately.
6. Wait for one of our trained “Security Team” or Site Administrator to provide you with knowledgeable assistance tailored to your problem with the gladius_rectus@aol.com ransomware.