Alma Locker ransomware / virus (Tutorial)

What is Alma Locker ransomware virus?

Reasons to remove Alma Locker virus:

Alma Locker virus is a new computer threat has recently appeared and joined the huge family of ransomware viruses. While the Internet community has been continuously attacked by CryptXXX, Cerber 2.0, and other infamous file-encrypting malware, the current virus seems to possess new features in contrast to the mentioned viruses. Ransomware is the object of the research for IT experts but for ordinary users it has become a pain in the neck. Therefore, it is important to remove Alma Locker as soon as possible. It has been revealed that it employs Tor command and control servers. Moreover, while other viruses of the same kind mainly disperse through malicious spam email attachments, this sample prefers using the exploit kit. If your computer and valuable data have been victimized, read carefully to get acquainted with Alma Locker removal methods. To save time, install FortectIntego to initiate elimination process.

It seems that the ransomware already made its first steps in the virtual community. Luckily, IT expert Darien Huss managed to detect it. The threat is still under investigation, so users, who are waiting for a free Alma Locker Decrypter, might need to collect some patience. It is suspected that the virus contains programming errors or bugs which might be exploited to break it. Speaking about technical characteristics, the virus employs AES-128 algorithm. Due to this technique, it manages to lock important data. Later on, it attaches five character extension to the corrupted files and documents.

Additionally, a victim is given a unique identification code. It is used for paying the ransom. Speaking of which, the developers do not seem to be greedy as they demand 1 BTC for the blocked information. In any case, it is unwise to pay the money as there are no guarantees that the hackers will spare you and return the data after receiving the transaction. Ransomware has been an online business, so few reports are known that the cyber criminals kept their word.

Moreover, Alma Locker ransomware targets a wide range of file extensions. It might encode image,text, excel, and music files. In short, it threatens to decode all the files which usually contain the most important information. Interestingly, the threat escapes several folders, for example, Recycle Bin, Program Files, Internet Explorer, Mozilla, Chrome, Local Settings and a few others. Thus, if you happen to store your data there, there is a chance to avoid Alma Locker malware.

Regarding the decryption of the files, the hackers offer the chance to decode a few files for free. Victims are encouraged to download Alma Locker Decrypter. However, at the moment, this software seems to malfunction as it retrieves server error. Finally, the virus leaves Unlock_files_[random_extension].html and Unlock_files_[random_extension].txt files with the instructions to remit the payment.

How does this virus spread?

Mainly, the malware prefers infiltrating computers with the help of RIG exploit kit. The latter has emerged at the beginning of the year. It has been revealed that this trojan was part of the major cyber campaign. Moreover, it affected millions of users‘ data. It is also related to SmokeLoader malware. The latter is able to work in the system background and download necessary malicious files. All in all, there is a way to protect yourself against this malware and trojans by improving your computer security. Download and install proper security applications. The best combination would be an anti-virus and anti-spyware applications. The latter is able to detect a broader range of minor and more serious threats.

Good news! Victims can now decrypt the encoded data for free

Fascinating news for everyone who has become a victim of Alma Locker ransomware. It appears that modus operandi of this virus has some flaws that allowed malware researchers create a free Alma Locker decryption tool. This ransomware variant uses AES key to encrypt files, and the same key can be used to decrypt them back. Apparently, crooks have forgotten to fix one flaw in virus’ code – they send the AES key via HTTP in a clear text, and can be easily discovered. Of course, if the victim does not save network activity logs, it might be impossible to get this decryption key for free. To decrypt files, the user has to download a C# compiler, add the provided code, compile and run it. You can find a complete tutorial on how to decrypt your files in the instructions provided at the end of this post. If you have any questions about the decryption procedure, please send a question to our support team.

Ransomware removal instructions

Though other malware might be eliminated using the manual method, we do not recommend deleting Alma Locker virus manually. This cyber threat is surely a puzzle for IT researchers so there are few chances that you might succeed in deleting the file-encrypting virus. Therefore, remove Alma Locker with the help of a powerful security program such as FortectIntego or SpyHunter 5Combo Cleaner. Either of them will exterminate the threat shortly. Unfortunately, neither of them decodes the blocked data. You might use data recovery software while IT experts are working on the free decryptor. After the malware is completely terminated, consider data storing alternatives. Keep it in several locations and perform regular back-ups. Lastly, if you encountered problems and cannot perform Alma Locker removal, follow the recovery instructions.