DMA Locker 3.0 ransomware virus. How to remove? (Uninstall guide)

removal by Jake Doevan - - | Type: Ransomware
12

DMA Locker 3.0 virus has its clones emerging in 2017

DMA Locker 3.0 ransomware is a noxious computer infection, which was released in February 2016 with bug fixes and updates. This time, crooks have patched the flaw in the ransomware (it was possible to decrypt files affected by the earlier version of it – DMA-Locker virus), and now it is impossible to recover files using any data recovery tools. Once installed, this virus encrypts all files on the computer and demands ransom. DMALocker3 malware is so complicated that it generates an individual encryption key for every single file, and, unlike the previous version of it, it uses RSA encryption algorithm along with AES. What is interesting about this ransomware is that it doesn’t add particular file extensions to filenames – instead, it edits the header of every encrypted file and appends !DMALOCK3.0 prefix at the beginning of the content. This ransomware scans the whole computer system and detects music files, videos, images, documents, and various other file types and encrypts them. Afterward, it creates and saves a ransom note called cryptinfo.txt.

Once it finishes encrypting data, it sends a pop-up message to the computer screen, starting with a header “All your personal files are LOCKED!” The message includes information about the encryption and instructions how to decrypt DMA Locker 3.0. This virus dictates the victim to transfer 4 Bitcoins[1] to a particular Bitcoin address provided. Approximately, 4 BTC is more or less 1789 USD, and that is a very high ransom price considering that other ransomware variants commonly ask for about 400-500 USD. The ransom note continues the instructions by commanding the user to contact crooks after transferring Bitcoins and promises to send the decryption key immediately. The third version of the ransomware leaves either week4004@fastmail.com or january0040@gmx.com email address as the only way of contacting them. However, instead of following criminals’ commands and taking the risk of losing your money for nothing, you should think about possible DMA Locker 3.0 removal options.

DMA Locker 3.0 virus encrypts files and asks for a ransom

You should not rely on cyber criminals because you do not know whether they will send you the decryption key or not. The ransom price is considerably high, so think twice before you try to pay up[2]. In addition to that, no matter how important your files are, it is not advisable to support cyber criminals and transfer money to their Bitcoin accounts, because this will encourage them to continue creating more and more ransomware variants. We strongly recommend you to remove DMA Locker 3.0 using a strong anti-malware software (e.g. Reimage) and restore your files from backups stored on portable storage devices (if you have them).

Fake DMA Locker 3.0 version spotted in May 2017

Security experts spotted fake DMA Locker 3.0 virus[3] making rounds on the Internet in the end of May 2017. The main difference between the real and the fake version is that the bogus one appends one of the following prefixes to encrypted files: !XPTLOCK5.0, !Locked#2.0, !Locked!### or !Encrypt!##. The fake ransomware provides identical GUI to victims, but clearly provides a different email address to the victims. The bogus ransomware suggests writing to data0001@tuta.io after paying the ransom worth of 1500 GB or 1 BTC. Victims attacked by this forged version of ransomware should contact experienced malware researcher who presents herself as Hasherezade. Her email address is hasherezade@gmail.com.

Distribution of this ransomware virus

DMA Locker v3.0 works in a quite interesting way, and you can use one trick to prevent it from encrypting your files even if this threat manages to slither into the computer system. This malware is programmed to understand whether the system is infected or not, so you can deceive this malicious software by creating fake virus files. Create such files in the following folders:

  1. C:\Documents & Settings\All Users\start.txt
  2. C:\Documents & Settings\All Users\decrypting.txt
  3. C:\ProgramData\start.txt
  4. C:\ProgramData\decrypting.txt

The decrypting.txt file informs the software that the system is already infected, and the start.txt file informs it that files are being encrypted at the moment.

The majority of ransomware-type computer viruses spread via malicious emails; however, security experts claim that cyber criminals tend to install this virus to the victim’s computer via Remote Desktop. To secure your computer from such computer infections, we strongly advise you to protect it with a reliable anti-malware software that can ensure real-time protection[4] from spyware and malware.

DMA Locker 3.0 removal

Are your files infected by DMALocker virus already? Unfortunately, we cannot say that it is possible to decrypt them now. You can only recover your files if you have backup copies of them[5] stored on an external hard drive, flash memory card, CD or DVD. However, before you plug or insert any of these storage devices into your computer, remove DMA Locker 3.0 ransomware. You can perform a full removal using our recommended anti-malware software (Reimage), but if you want to, you can try to uninstall this malware manually. We do not recommend opting for this option unless you are an experienced computer user or an IT expert. The full DMA Locker 3.0 removal guide is provided below.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove DMA Locker 3.0 ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall DMA Locker 3.0 ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

Manual DMA Locker 3.0 virus Removal Guide:

Remove DMA Locker 3.0 using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

As we said, we do not recommend paying the ransom as it does not guarantee successful data recovery. We suggest removing DMALocker3 with a help of this guide:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove DMA Locker 3.0

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete DMA Locker 3.0 removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove DMA Locker 3.0 using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of DMA Locker 3.0. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that DMA Locker 3.0 removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove DMA Locker 3.0 from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If you have already removed the virus, use your data backup to restore corrupted files. Simply drag healthy files to your computer after plugging the portable data storage device to it. if you do not have data backup, use these methods instead.

If your files are encrypted by DMA Locker 3.0, you can use several methods to restore them:

Test Data Recovery Pro

Data Recovery Pro might help you to restore part of encrypted data. Below, you can see a quick tutorial on how to use it.

Get older versions of your files

If you created a system restore point back in the day, you can restore previous file versions with a help of this feature.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Official DMA Locker 3.0 decryption tool is not available

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from DMA Locker 3.0 and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

More information about the author

References


  • Maaxim

    So now I cannot decrypt my files??? how do I know?

  • Theresa

    have removed this malware, but files stay encrypted, i cannot open them. does anybody know whether you really get the decryption key after paying the price dma locker demands??

    • jeremy

      im not sure if you can get the decryption key after u remove it, i think you cant, dont waste your money!

  • Olivy

    HELP I NEED TO GET MY FILES BACK BUT I DONT HAVE THAT MUCH MONEY….