Severity scale:  
  (99/100)

Alma Locker ransomware virus. How to remove? (Uninstall guide)

removal by Julie Splinters - - | Type: Ransomware
12

Reasons to remove Alma Locker virus:

Alma Locker virus is a new computer threat has recently appeared and joined the huge family of ransomware viruses. While the Internet community has been continuously attacked by CryptXXX, Cerber 2.0, and other infamous file-encrypting malware, the current virus seems to possess new features in contrast to the mentioned viruses. Ransomware is the object of the research for IT experts but for ordinary users it has become a pain in the neck. Therefore, it is important to remove Alma Locker as soon as possible. It has been revealed that it employs Tor command and control servers. Moreover, while other viruses of the same kind mainly disperse through malicious spam email attachments, this sample prefers using the exploit kit. If your computer and valuable data have been victimized, read carefully to get acquainted with Alma Locker removal methods. To save time, install Reimage to initiate elimination process.

It seems that the ransomware already made its first steps in the virtual community. Luckily, IT expert Darien Huss managed to detect it. The threat is still under investigation, so users, who are waiting for a free Alma Locker Decrypter, might need to collect some patience. It is suspected that the virus contains programming errors or bugs which might be exploited to break it. Speaking about technical characteristics, the virus employs AES-128 algorithm. Due to this technique, it manages to lock important data. Later on, it attaches five character extension to the corrupted files and documents.

The picture showing AlmaLocker virus

Additionally, a victim is given a unique identification code. It is used for paying the ransom. Speaking of which, the developers do not seem to be greedy as they demand 1 BTC for the blocked information. In any case, it is unwise to pay the money as there are no guarantees that the hackers will spare you and return the data after receiving the transaction. Ransomware has been an online business, so few reports are known that the cyber criminals kept their word.

Moreover, Alma Locker ransomware targets a wide range of file extensions. It might encode image,text, excel, and music files. In short, it threatens to decode all the files which usually contain the most important information. Interestingly, the threat escapes several folders, for example, Recycle Bin, Program Files, Internet Explorer, Mozilla, Chrome, Local Settings and a few others. Thus, if you happen to store your data there, there is a chance to avoid Alma Locker malware.

Regarding the decryption of the files, the hackers offer the chance to decode a few files for free. Victims are encouraged to download Alma Locker Decrypter. However, at the moment, this software seems to malfunction as it retrieves server error. Finally, the virus leaves Unlock_files_[random_extension].html and Unlock_files_[random_extension].txt files with the instructions to remit the payment.

How does this virus spread?

Mainly, the malware prefers infiltrating computers with the help of RIG exploit kit. The latter has emerged at the beginning of the year. It has been revealed that this trojan was part of the major cyber campaign. Moreover, it affected millions of users‘ data. It is also related to SmokeLoader malware. The latter is able to work in the system background and download necessary malicious files. All in all, there is a way to protect yourself against this malware and trojans by improving your computer security. Download and install proper security applications. The best combination would be an anti-virus and anti-spyware applications. The latter is able to detect a broader range of minor and more serious threats.

Good news! Victims can now decrypt the encoded data for free

Fascinating news for everyone who has become a victim of Alma Locker ransomware. It appears that modus operandi of this virus has some flaws that allowed malware researchers create a free Alma Locker decryption tool. This ransomware variant uses AES key to encrypt files, and the same key can be used to decrypt them back. Apparently, crooks have forgotten to fix one flaw in virus’ code – they send the AES key via HTTP in a clear text, and can be easily discovered. Of course, if the victim does not save network activity logs, it might be impossible to get this decryption key for free. To decrypt files, the user has to download a C# compiler, add the provided code, compile and run it. You can find a complete tutorial on how to decrypt your files in the instructions provided at the end of this post. If you have any questions about the decryption procedure, please send a question to our support team.

Ransomware removal instructions

Though other malware might be eliminated using the manual method, we do not recommend deleting Alma Locker virus manually. This cyber threat is surely a puzzle for IT researchers so there are few chances that you might succeed in deleting the file-encrypting virus. Therefore, remove Alma Locker with the help of a powerful security program such as Reimage or Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus. Either of them will exterminate the threat shortly. Unfortunately, neither of them decodes the blocked data. You might use data recovery software while IT experts are working on the free decryptor. After the malware is completely terminated, consider data storing alternatives. Keep it in several locations and perform regular back-ups. Lastly, if you encountered problems and cannot perform Alma Locker removal, follow the recovery instructions.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Alma Locker ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Alma Locker ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

Manual Alma Locker virus Removal Guide:

Remove Alma Locker using Safe Mode with Networking

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Alma Locker

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Alma Locker removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Alma Locker using System Restore

Reimage is a tool to detect malware.
You need to purchase Full version to remove infections.
More information about Reimage.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Alma Locker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Alma Locker removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Alma Locker from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

It is possible to decrypt your files for free now because malware experts have discovered a flaw in ransomware’s operation that allowed them to create a free decryption tool. Therefore, you do not need to pay Bitcoins for Alma Locker Decrypter.

If your files are encrypted by Alma Locker, you can use several methods to restore them:

How to retrieve your files with a help of Windows Previous Versions feature?

If you enabled System Restore function on your PC a while ago, now you can use this method to restore your encrypted files. This method is useful only if you wish to decrypt certain files, but not all of them. Please follow the following instructions:

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

How to decrypt your files using the free Alma Locker decryption program?

Security experts have created a tool that allows victims to decrypt their files for free. In order to decrypt files touched by Alma Locker’s encryption, do the following:

1. Download a trustworthy C# compiler (software that can compile C# codes).

2. Copy the code provided in this link.

3. Paste the code in the C# compiler and compile it. Run the program. The program will indicate information required to decrypt your files.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Alma Locker and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Julie Splinters
Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions

Removal guides in other languages


  • michellerhys

    The hackers just wont stop…to be honest, is there anything that can guarantee the safety against this threat?

  • C.Barbosa

    Im waiting for the decrypter. can you hurry up, please?

  • FillRichie

    I guess this virus is more dangerous than the others.

  • Craig4555555

    their decrypter doesnt work..how would I know they gonna give me back my files?

  • Tracey

    My friend got infected by this virus. eventually, she lost all her important reports as she didnt pay the money. I guess I need to install additional security programs as well.