Cetori Cryptovirus - How to remove

People have noticed their files becoming impossible to open and use normally after they were inexplicably converted to the Cetori type. This is a symptom of a new infection known as Cetori, a cryptovirus. Malware that uses cryptography to deny the victims access to their own files and, like Cetori, asks for money to unlock the files, is called ransomware.

There are more symptoms of Cetori than just renamed and unopenable files. For example, if you remove the “.cetori” suffix, you still won’t be able to use the files — they’re completely thrashed (except for the largest files which might have a few unencrypted patches). That’s Cetori’s encryption — the files were edited by a cryptographic algorithm. Without a decryption program and a secret key specific to you, there is no way to unlock those files. Modern ransomware is quire secure, and infections like Phobos or Maoloa can’t be decrypted without the help of the developers of these viruses.

Additionally, Cetori leaves files called “_readme.txt” on your computer. Those files contain a standard message from the developers of the virus. In it, the ransom price is stated ($980 or $490), as well as the criminals’ email addresses  ([email protected], [email protected]).

It’s not advised to pay the criminals or contact them at all. The chances of being cheated by them are very real, so even if you were able to spend the amount of money being asked, be careful. Cetori doesn’t offer refunds. Instead, look at the guide below this article for options to get your files back. Also, after you remove the virus and can use your computer without having constant re-encryption of new files, check out this forum which talks about Cetori’s ransomware family and the STOPDecrypter tool which saves the files of some (not all) victims.

How to avoid ransomware

Ransomware is an unfortunately popular type of threat online: every day, people on a variety of online forums come, saying that they lost their files to yet another type of a crypto file locker. Avoiding ransomware requires improving our cybersecurity with anti-malware tools and healthier browsing habits.

Important elements of your cybersecurity include:

• Timely security updates.
• Ability to recognize spam email.
• Use of legitimate and official software.
• Strong passwords and usernames.
• Use of data backups.

First of all, install security updates for your software. The OS, your browsers, your media players, and especially your antivirus program — and use it to scan files. Cetori removes the definitions of your installed antivirus protection tool and then disables its real-time protection, which absolutely cripples your anti-malware program, which should have had no problem recognizing Cetori before. An outdated antivirus is as good as no antivirus at all. Malicious websites scan for outdated browsers and use known vulnerabilities to infect the visiting computers. Outdated operating system are abused in a similar way.

Avoid illegitimate software. Cetori infects a lot of people by hiding in keygens, activators, and other nongenuine software. Instead, look for free programs, such as open-source software, or pay for genuine software.

Be careful of spam messages and emails that send you files or links. If an unfamiliar sender or even a friend randomly sends you a link or a file, don’t open it without scanning it first. Cetori could be sent to you this way, too — a lot of ransomware spreads via malicious spam emails, other malware uses messages on social media.

Secure your RDP. Even though Cetori isn’t installed using Remote Desktop, plenty of ransomware infections are, so make sure that your username and password are complex and that you use a VPN if that’s an option.

Finally, backups are super important to have. If your computer is infected, a backup with all of your files can be a lifesaver. Cetori can actually infect the backup if it’s on the local network, so it has to be completely offline, or in the Cloud.

How to remove Cetori cryptovirus

Even though your usual antivirus program might have been broken by Cetori, any other competent tool, like Spyhunter, should be able to work, just make sure that it can run in safe mode. If you have problems looking for and downloading new tools, check out this article — the cryptovirus might have messed with your settings, but you can fix it manually.

Automatic Malware removal tools

How to recover Cetori Cryptovirus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Cetori Cryptovirus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Cetori Cryptovirus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Cetori Cryptovirus. You can check other tools here.  

Step 3. Restore Cetori Cryptovirus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Cetori Cryptovirus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Cetori Cryptovirus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.