Alma Locker ransomware / virus (Tutorial)

Alma Locker virus Removal Guide

What is Alma Locker ransomware virus?

Reasons to remove Alma Locker virus:

Alma Locker virus is a new computer threat has recently appeared and joined the huge family of ransomware viruses. While the Internet community has been continuously attacked by CryptXXX, Cerber 2.0, and other infamous file-encrypting malware, the current virus seems to possess new features in contrast to the mentioned viruses. Ransomware is the object of the research for IT experts but for ordinary users it has become a pain in the neck. Therefore, it is important to remove Alma Locker as soon as possible. It has been revealed that it employs Tor command and control servers. Moreover, while other viruses of the same kind mainly disperse through malicious spam email attachments, this sample prefers using the exploit kit. If your computer and valuable data have been victimized, read carefully to get acquainted with Alma Locker removal methods. To save time, install FortectIntego to initiate elimination process.

It seems that the ransomware already made its first steps in the virtual community. Luckily, IT expert Darien Huss managed to detect it. The threat is still under investigation, so users, who are waiting for a free Alma Locker Decrypter, might need to collect some patience. It is suspected that the virus contains programming errors or bugs which might be exploited to break it. Speaking about technical characteristics, the virus employs AES-128 algorithm. Due to this technique, it manages to lock important data. Later on, it attaches five character extension to the corrupted files and documents.

The picture showing AlmaLocker virus

Additionally, a victim is given a unique identification code. It is used for paying the ransom. Speaking of which, the developers do not seem to be greedy as they demand 1 BTC for the blocked information. In any case, it is unwise to pay the money as there are no guarantees that the hackers will spare you and return the data after receiving the transaction. Ransomware has been an online business, so few reports are known that the cyber criminals kept their word.

Moreover, Alma Locker ransomware targets a wide range of file extensions. It might encode image,text, excel, and music files. In short, it threatens to decode all the files which usually contain the most important information. Interestingly, the threat escapes several folders, for example, Recycle Bin, Program Files, Internet Explorer, Mozilla, Chrome, Local Settings and a few others. Thus, if you happen to store your data there, there is a chance to avoid Alma Locker malware.

Regarding the decryption of the files, the hackers offer the chance to decode a few files for free. Victims are encouraged to download Alma Locker Decrypter. However, at the moment, this software seems to malfunction as it retrieves server error. Finally, the virus leaves Unlock_files_[random_extension].html and Unlock_files_[random_extension].txt files with the instructions to remit the payment.

How does this virus spread?

Mainly, the malware prefers infiltrating computers with the help of RIG exploit kit. The latter has emerged at the beginning of the year. It has been revealed that this trojan was part of the major cyber campaign. Moreover, it affected millions of users‘ data. It is also related to SmokeLoader malware. The latter is able to work in the system background and download necessary malicious files. All in all, there is a way to protect yourself against this malware and trojans by improving your computer security. Download and install proper security applications. The best combination would be an anti-virus and anti-spyware applications. The latter is able to detect a broader range of minor and more serious threats.

Good news! Victims can now decrypt the encoded data for free

Fascinating news for everyone who has become a victim of Alma Locker ransomware. It appears that modus operandi of this virus has some flaws that allowed malware researchers create a free Alma Locker decryption tool. This ransomware variant uses AES key to encrypt files, and the same key can be used to decrypt them back. Apparently, crooks have forgotten to fix one flaw in virus’ code – they send the AES key via HTTP in a clear text, and can be easily discovered. Of course, if the victim does not save network activity logs, it might be impossible to get this decryption key for free. To decrypt files, the user has to download a C# compiler, add the provided code, compile and run it. You can find a complete tutorial on how to decrypt your files in the instructions provided at the end of this post. If you have any questions about the decryption procedure, please send a question to our support team.

Ransomware removal instructions

Though other malware might be eliminated using the manual method, we do not recommend deleting Alma Locker virus manually. This cyber threat is surely a puzzle for IT researchers so there are few chances that you might succeed in deleting the file-encrypting virus. Therefore, remove Alma Locker with the help of a powerful security program such as FortectIntego or SpyHunter 5Combo Cleaner. Either of them will exterminate the threat shortly. Unfortunately, neither of them decodes the blocked data. You might use data recovery software while IT experts are working on the free decryptor. After the malware is completely terminated, consider data storing alternatives. Keep it in several locations and perform regular back-ups. Lastly, if you encountered problems and cannot perform Alma Locker removal, follow the recovery instructions.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of Alma Locker virus. Follow these steps

Manual removal using Safe Mode

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):


After you are finished, reboot the PC in normal mode.

Remove Alma Locker using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Alma Locker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that Alma Locker removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Alma Locker from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

It is possible to decrypt your files for free now because malware experts have discovered a flaw in ransomware’s operation that allowed them to create a free decryption tool. Therefore, you do not need to pay Bitcoins for Alma Locker Decrypter.

If your files are encrypted by Alma Locker, you can use several methods to restore them:

How to retrieve your files with a help of Windows Previous Versions feature?

If you enabled System Restore function on your PC a while ago, now you can use this method to restore your encrypted files. This method is useful only if you wish to decrypt certain files, but not all of them. Please follow the following instructions:

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

How to decrypt your files using the free Alma Locker decryption program?

Security experts have created a tool that allows victims to decrypt their files for free. In order to decrypt files touched by Alma Locker’s encryption, do the following:

1. Download a trustworthy C# compiler (software that can compile C# codes).

2. Copy the code provided in this link.

3. Paste the code in the C# compiler and compile it. Run the program. The program will indicate information required to decrypt your files.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Alma Locker and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting ransomware

Choose a proper web browser and improve your safety with a VPN tool

Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.


Lost your files? Use data recovery software

While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.

To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.

About the author
Julie Splinters
Julie Splinters - Anti-malware specialist

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions

Removal guides in other languages