Nowadays, data, especially digital data, is one of the most valuable resources which is why protecting it is so essential and important. And though the methods of keeping one’s important and valuable data safe are currently more accessible and easier to employ than they’ve ever been in the past, there are still many users out there who seem to forget just how essential it is to ensure that any important files they may have on their computers are kept safe. One of the most popular and easy to apply methods of protecting important files is the backup – it basically allows you to have intact copies of all of your valuable pieces of data on a location that is typically safer than your computer. However, there is still an overall lack of proper backups and this is is precisely what allows file-encrypting Ransomware viruses like .Dutan (which is the latest successor of the strain that includes .Hofos, .Roldat, .Todarius  and .Verasto) to thrive. Infections like this one have one single goal and that goal is to make all potentially important files in the targeted machine inaccessibly by employing a special, highly advanced encryption process. Ironically, the process of encrypting files is actually another very popular data-protection method that many people use to add an extra layer of security to their important files. However, when used by a cryptovirus Ransomware such as .Dutan (, this same helpful process gets turned at 180 degrees and becomes a tool of blackmailing and money extortion.

Since in most of the cases the only thing capable of unlocking an encrypted file is the unique key that corresponds to the applied encryption, the hackers behind viruses like .Dutan are able to blackmail their victims for that key, demanding a ransom payment in exchange for it. Usually, there would be some specific steps that need to be followed to complete the payment for the decryption key and those steps are explained within a ransom-demanding note that gets shown on the infected computer’s screen once the files on it are no longer accessible. Some hackers may even tell their victims that they would decrypt a a couple of their files for free in order to prove that they do indeed have a working decryption solution. Oftentimes, the victims of such an infection would be given a deadline, after which the decryption key would (supposedly) get destroyed or the demanded sum of money would go up.

So, is the payment of the ransom a viable option

Normally, we wouldn’t advise you to go for this course of action as it hides many risks, the most obvious of them being the risk of simply wasting the money you send as the criminals blackmailing you may easily decide to keep the key and not send it to you. Also, even if you pay and get your data back, the malware may still be left in your computer and cause issues in the future. Therefore, we advise you to use the steps we’ve provided in the removal guide for .Dutan down below and, through them, eliminate the infection. After that, you can try some of the suggested alternatives of data recovery – though they may not always work, they are still worth the try.

.Dutan SUMMARY:

[add_third_banner]

Remove .Dutan File Virus Ransomware 

1: Preparations

Note: Before you go any further, we advise you to bookmark this page or have it open on a separate device such as your smartphone or another PC. Some of the steps might require you to exit your browser on this PC.

2: Task Manager

Press Ctrl + Shift + Esc to enter the Task Manager. Go to the Tab labeled Processes (Details for Win 8/10). Carefully look through the list of processes that are currently active on you PC.

If any of them seems shady, consumes too much RAM/CPU or has some strange description or no description at all, right-click on it, select Open File Location and delete everything there.

Also, even if you do not delete the files, be sure to stop the process by right-clicking on it and selecting End Process.

3: IP related to .Dutan

Go to c:\windows\system32\drivers\etc\hosts. Open the hosts file with notepad.

Find where it says Localhost and take a look below that. 

If you see any IP addresses there (below Localhost) send them to us here, in the comments since they might be coming from the .Dutan.

[add_forth_banner]

4: Disable Startup programs

Re-open the Start Menu and type msconfig.

Click on the first search result. In the next window, go to the Startup tab. If you are on Win 10,  it will send you to the Startup part of the task manager instead, as in the picture:

If you see any sketchy/shady looking entries in the list with an unknown manufacturer or a manufacturer name that looks suspicious as there could be a link between them and .Dutan , disable those programs and select OK.

5: Registry Editor

Press Windows key + R and in the resulting window type regedit.

Now, press Ctrl + F and type the name of the virus.

Delete everything that gets found. If you are not sure about whether to delete something, do not hesitate to ask us in the comments. Keep in mind that if you delete the wrong thing, you might cause all sorts of issues to your PC.

6: Deleting potentially malicious data – .Dutan

Type each of the following locations in the Windows search box and hit enter to open the locations:

%AppData%

%LocalAppData%

%ProgramData%

%WinDir%

%Temp%

Delete everything you see in Temp linked to .Dutan Ransomware. About the other folders, sort their contents by date and delete only the most recent entries. As always, if you are not sure about something, write to us in the comment section.

7: .Dutan Decryption

The previous steps were all aimed at removing the .Dutan Ransomware from your PC. However, in order to regain access to your files, you will also need to decrypt them or restore them. For that, we have a separate article with detailed instructions on what you have to do in order to unlock your data. Here is a link to that guide.

The post Remove .Dutan File Virus Ransomware (+File Recovery) appeared first on Malware Complaints.