How To Delete Reductor From Infected PC

 

Threat Summary

Description About Reductor

The Turla APT (Advanced Persistent Threat) is an ill-famed group that originates from Russia which are known as Uroboros, Waterbug, Snake and Venomous Bear. The Turla APT is very popular in worldwide of cyber crime and has performed many devastating hacking campaigns over the years. Malware researchers believe that the hacking group is sponsored by the Kremlin but this information isn't confirmed yet. Most of their campaigns are concentrated in ex-Soviet states like Ukraine and Belarus but they have launched operations in Iran also.

One of the hacking tools used in the rather large arsenal of the Turla APT is the Reductor RAT (Remote Access Trojan). It is believed that the Reductor RAT is an upgraded variant of the COMpfun threat. The COMpfun Trojan's main destination was to cater as a first-stage payload while the Reductor RAT has been further weaponized and poses a much bigger threat to potential victims.

Researchers believe that the Reductor RAT is mostly propagated through file sharing websites. However, most of the related files have been wiped off from these platforms which means that studying this threat is rather difficult. Malware experts have managed to retrieve some data regarding the Reductor RAT from computer systems. This threat is compromised and managed to learn more about this Trojan. Researchers uncovered that the Reductor RAT is totally able to replace browser installer which is executable with illegitimate copies and compromise TLS traffic and redirect to compromised hosts as well.

The attackers ensure that the user's handle is personalized and traceable by adding unique hardware and software-based identifiers. Doing this allows them to monitor the network traffic of their targets even though the traffic is encrypted still and thus, it can't be considered as a data leak.

 

If the victim attempts to download a file randomly, the Reductor RAT is fully capable of replacing the desired file with a corrupted binary. Researchers have determined that the operators of the Reductor RAT are exploiting this function of their threat but it is ready and set to go whenever it is required.

Some of the other capabilities of the Reductor RAT includes collecting information about the hardware and software of the victim, issuing remote commands, listing and controlling the running processes, having the ability to run uploaded and downloaded files and capturing screenshots of the desktop and tabs.

This Turla APT isn't the one which to be underestimated and it is totally clear that the individuals which are involved with it are constantly developing new tools as well as upgrading old ones.

>>Free Download Reductor Scanner<<

Steps to Delete Reductor

Step: 1 Restart your Windows PC in Safe Mode

Find the complete details on how to Reboot your PC in Safe Mode (if you are a novice, follow the above given instructions on how to boot up your PC in Safe mode irrespective of the Windows Version that is being used as Windows XP, 7, Win 8, 8.1 and Windows 10)

Step:2 Remove Reductor from Task Manager

Press CTRL+ALT+DEL simulataneously to open Task manager. Find Reductor Related processes or any other suspicious processes that are running on it. Now Select and delete Reductor virus from Task Manager at once.

Step:3 How to Delete Reductor Related Startup Items

Press Win + R together and Type “msconfig”.

Now press Enter Key or Select OK.

“Startup” option is to be selected on the Pop-up Window Tab

Now Search for Reductor Related applications on Startup Items

Now Uncheck all Unknown or Suspicious items from “System Configuration” related to Reductor

Now Click and Select Restart to Start your Computer in Normal Mode

Step: 4 How to Delete Reductor from Windows Registry

1. Press Win + R in combination to Open Run Box, Type regedit on the search box and press enter.
2. This will Open the registry entries.
3. Find Reductor related entries from the list and carefully delete it. However be careful and do not delete any other entries as this could severely damage the Windows Component.

Also, after completing the above steps, it is important to search for any folders and files that has been created by Reductor and if found must be deleted.

Step 5 How to View Hidden Files and Folders Created by Reductor

1. Click on the Start Menu
2. Go to Control Panel, and Search for folder Options
3. Click on view hidden files and folders Options, For your convenience, we have included complete process on how to unhide files on all Windows Version. This will delete all the files and folders associated with Reductor that was existing on your compromised system.

Still, if you are unable to get rid of Reductor using manual steps, you need to scan your PC to detect Reductor.

Don’t forget to submit your questions or any other queries if you have and get complete solution from our Expert’s Panel. Good Luck!