RedDot Ransomware - How to remove

RedDot ransomware, aka Findnotefile, is a malicious file-encrypting extortion program. It infects Windows PCs, breaks files, and demands the victim to contact the attackers via email to work out the details of the ransom payment. If the victim doesn’t pay the ransom, their files remain encrypted – as good as corrupted.

Red Dot is also the name of an old exploit kit, but it’s not related to the RedDot/Findnotefile ransomware.

About RedDot:

Threat type	Ransomware.
How RedDot attacks PCs	It encrypts files, it changes file names to end with “reddot”, “findnotefile”, or another extension, it leaves ransom notes to encourage victims to contact the extortionists.
Can you get your files back?	Restore data from backups, hope for a decryptor, undelete files, use file repair services.
How to delete RedDot ransomware	Use antivirus scanners (Spyhunter, others) to get rid of it, reset Windows.

How to recognize a RedDot infection

RedDot encrypts files and changes their names

RedDot is a malicious program that infects PCs without the victim’s permission. There are a few possibilities for how this could happen. RedDot might arrive in infected email attachments, programs and files downloaded from unreliable websites, or be installed when a malicious actor hacks the victim’s RDP account.

Once RedDot is on a computer, it encrypts common files: audio recordings, images, documents, archives, text and code files, databases, etc. Encrypted files can’t be opened and read as their internal contents are scrambled by RedDot’s encryption algorithm.

The RedDot-encrypted files also have their names changed. The ransomware adds a new file extension to the ends of file names. You can see it if your Windows is configured to display file extensions. Here’s an example of what a changed file name might be:

important.docx.findthenotefile

File extensions associated with RedDot/Findnotefile include findnotefile, findthenotefile, and reddot. Since Windows doesn’t recognize these extensions, it gives the files a blank page icon.

It asks for money to fix the files

And then RedDot creates ransom notes called HOW_TO_RESTORE_MY_FILES.txt. In these notes, the extortionists leave their contacts and threaten to pay the ransom for your files as quickly as possible.

RedDot Presents

ALL YOUR FILES ARE ENCRYPTED!

All your files have been encrypted due to a security problem with your PC.
If you want to restore them, write us to the Email [email protected]

To prove that we can decrypt files, we can decrypt one file for free,
it should be no more than 3 MB and should not contain important information.

The price depends on how fast you write to us.

Write this ID in your message:

Key ID:

Can you restore your files?

Don’t pay the ransom

As RedDot encrypts files, the only way to get them back is to decrypt them. But decryption is impossible without the correct decryption program and a unique to each victim key.

Do not pay the ransom unless you absolutely have to.

• The people behind RedDot/Findnotefile are not yet known and they could easily be scammers who just take your money and ignore you.
• Even if they do mean to decrypt your files if you pay them enough money, there could be technical problems with the decryptor, as is common with new ransomware.
• Not to mention, if you accidentally reveal personal information to the extortionists, they may target you in later attacks (spear phishing).

Other possibilities

It’s possible, although very unlikely, that a free decryptor will be released at some point. Check Nomoreransom.org.

You can look into file repair tools and services – some ransomware leaves some data in some encrypted files untouched. But repairing files can be hard, complicated, time-consuming, and will only help you with a few file types.

If you were using a hard disk, you may be able to find something with file recovery programs – tools that can undelete files. But again, there’s no guarantee that you’ll get anything back.

The best way to stay safe from ransomware is to backup your data regularly to offline or properly configured cloud storage. If you had a backup from before RedDot attacked, you can recover all the backed files after deleting RedDot malware.

How to remove RedDot ransomware

You can use antivirus programs (such as Spyhunter to find all infections and delete them.

Depending on how RedDot infected your PC, additional malware could have been infiltrated with RedDot. One victim said they found a remote access program installed unexpectedly.

Or you can reformat your drive and reset your Windows. If you keep any of your old files, remember to delete those that infected your computer with Findnotefile. You can scan the files with antivirus tools as well as review them yourself. Any suspicious downloads and other documents that were created at around the time that Findnotefile attacked your PC are suspicious.

Automatic Malware removal tools

How to recover RedDot Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before RedDot Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of RedDot Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to RedDot Ransomware. You can check other tools here.  

Step 3. Restore RedDot Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually RedDot Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover RedDot Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.