How to remove Maktub Locker virus

Maktub Locker virus – another ransom demanding computer threat

Computer users should be aware of a new ransomware, called Maktub Locker. It is a computer infection that can make all user’s files inaccessible. The cyber criminals send this virus via email – they send attachments disguised as Terms of Service update. Judging by the file icon, it seems to be .txt or .pdf document, but in reality, it is a .scr file. If a user downloads and launches such file, it opens up an actual document, but it also runs a malicious process in the background. Maktub Locker ransomware scans the whole computer system for personal files and encrypts them using the AES-256 encryption algorithm. What is interesting, is that the file size drops after the encryption. It is also notable that this virus attaches a file extension to the filenames of encrypted data. For each victim, the extension is randomly generated.

After the data encryption is done, Maktub Locker virus leaves a ransom note – a .html file, which is named _DECRYPT_INFO_(random code here). This message provides information what happened to the computer. It states that the personal files were encrypted using “the strongest encryption and unique key, generated for this computer.” It promises to give the decryption key if the user pays the ransom in a particular period of time, but if the user decides not to do as commanded, the unique decryption key will be destroyed for good. Like any other ransomware, Maktub Locker asks to install Tor browser and go to one of the URLs provided to access the secret server. Then, using a given code, the user can enter a special website designed only for him/her. It’s a website, which is incomparable to the websites provided by other ransomware viruses. It is designed quite well, and the information on it is written faultlessly.

This site consists of 5 different pages. It starts with a “HELLO!” Page. Criminals state that the files have been encrypted, but they are not gone yet – the user can get them back by buying them out. The second page, titled “WE ARE NOT LYING!”, informs that googling “Maktub Locker” will advise the victim to remove this virus immediately. According to the cyber criminals, no programs except of the one this virus provides will help the victim to decrypt the data. It even suggests uploading two files to test the decryption key. The next page, called “HOW MUCH DOES IT COST?”, explains that one must pay the ransom as soon as possible. Otherwise, the ransom price will increase. If the victim pays the ransom within the three days of infection, he/she has to pay approximately 588 US dollars. Later on, the price increases every three days. The virus announces that it does not guarantee to keep the decryption key more than 15 days. It informs that the site can be disconnected at any moment, and then victim’s data will be lost forever. The fourth page is called “WHERE DO I PAY?” It explains that victim needs to pay the ransom in Bitcoins and then wait a few hours. The fifth page, titled “BITCOIN PURCHASE,” provides information about Bitcoin payment system and lists websites where the user can buy Bitcoins.

What to do if Maktub Locker virus infects your computer?

First of all, you have to decide whether you wish to support cyber criminals or not. If you pay the ransom, it only strengthens them and makes them believe that people are submissive and afraid of computer viruses. As a consequence, that encourages them create even more complex viruses and demand bigger ransoms. Besides, do you believe that criminals are actually going to give you the decryption key?

If you decide not to pay up, you must remove Maktub Locker from your computer immediately. It is a must to delete all of its components. Otherwise, its remains might download similar viruses to your computer. In addition, if you do not remember opening any suspicious emails, it might be that you have a trojan installed on your computer, which could download this virus into your PC. It is hard to detect trojans, and that is why we recommend users who were affected by Maktub virus to download a reliable anti-malware software and scan the compromised computer with it.
You can use FortectIntego program.

FAQ:

Question: I have already deleted this virus but how can I decrypt the data?

Answer: Unfortunately, no decryption utility for Maktub Locker ransomware is found yet. That is why we encourage computer users to create and keep data backups on external drives, unplugged from the computer.

Question: How can I prevent Maktub Locker virus attack?

Answer: It is quite easy – just stay away from suspicious emails sent by people you do not personally know, avoid visiting suspicious websites and refrain yourself from clicking on pushy banners or pop-up ads. However, it is also strongly recommended to protect your computer with a help of anti-malware program.

How to remove Maktub Locker?

We do not recommend dealing with Maktub Locker ransomware manually. It is a disastrious and well-constructed virus, which tends to hide its components in the computer system. If you are an inexperienced PC user, we suggest you to use a strong malware removal program, for example, FortectIntego. If you still wish to remove this virus manually, follow Maktub Locker removal guide, which is provided below.