How to remove DilmaLocker ransomware virus

DilmaLocker is yet another virtual extortion tool set to encrypt your files 

DilmaLocker is a new ransomware-type virus that compromises victim’s files to demand a ransom^[1]. The malicious software employs AES-256 cipher to encode all user’s files and leaves a ransom note called RECUPERE_SEUS_ARQUIVOS.html and dilminha.dat. When encrypting the data, ransomware appends .__dilmaV1 file extension to each file.

The malicious virus triggers a pop-up message saying “Seus arquivos foram criptografados,” which roughly translates from Portuguese to “Your files were encrypted.” The virus presents itself as Trojan.Ransom.Win32.Dilma.Locker. The virus also changes the background image that suggests writing to dilmaonion@keemail.me to get data recovery instructions. Dilma virus also informs the victim that all files on the system will be deleted after four days.

DilmaLocker authors demand to pay 3000 Brazilian Reals in Bitcoin. The sum is equal to 968 US dollars. However, the criminals admit that they are ready for negotiations if the user cannot afford to pay a ransom of nearly thousand USD.

In addition, cyber criminals suggest to prove their intentions and say that they can decrypt one file of victim’s choice. The only condition is that the file cannot be larger than 3MB in size.

However, we do not recommend paying the ransom because you get no guarantees that your files will be decrypted. The criminals can disappear at any moment and leave you with piles of encrypted data. Therefore, if your computer got hit by ransomware, we recommend you to remove DilmaLocker virus immediately. You should consider using a good anti-malware software such as FortectIntego to eliminate it.

However, it is not that easy to remove a ransomware virus. For a successful DilmaLocker removal, you might need to use instructions provided below this article to reboot your PC into Safe Mode with Networking. This helps to deactivate the virus (temporarily) to delete it without any interruptions.

Distribution of Dilma virus

It is suspected that DilmaLocker spreads via malicious spam and possibly RDP attacks. However, it is unknown whether the virus uses more sophisticated distribution methods such as malvertising^[2] or exploit kits. According to Udenvirus.dk team^[3], to prevent the ransomware from infecting your PC and taking your files hostage, you simply need to:

• Install a reliable security software;
• Create a data backup;
• Enable automatic software updates or just install software updates manually (and regularly!);
• Avoid opening suspicious emails or clicking on questionable ads or links when browsing the Internet.

Remove DilmaLocker virus for good

You can remove DilmaLocker quite easily. All that you need to do is to restart your PC using the given instructions, and allow your security software run. Keep in mind that a system reboot into a Safe Mode with Networking is required in order to eliminate the virus without facing any possible obstacles.

Do not delay DilmaLocker removal and clean your computer now. Remember – paying the ransom is not the solution to the problem and this option might not help to recover your data. Instead of paying the extortionists, consider trying one of the provided data recovery methods (see instructions below).