Severity scale:  

Remove Alma Locker ransomware / virus (Tutorial)

removal by Julie Splinters - - | Type: Ransomware

Reasons to remove Alma Locker virus:

Alma Locker virus is a new computer threat has recently appeared and joined the huge family of ransomware viruses. While the Internet community has been continuously attacked by CryptXXX, Cerber 2.0, and other infamous file-encrypting malware, the current virus seems to possess new features in contrast to the mentioned viruses. Ransomware is the object of the research for IT experts but for ordinary users it has become a pain in the neck. Therefore, it is important to remove Alma Locker as soon as possible. It has been revealed that it employs Tor command and control servers. Moreover, while other viruses of the same kind mainly disperse through malicious spam email attachments, this sample prefers using the exploit kit. If your computer and valuable data have been victimized, read carefully to get acquainted with Alma Locker removal methods. To save time, install Reimage Reimage Cleaner Intego to initiate elimination process.

It seems that the ransomware already made its first steps in the virtual community. Luckily, IT expert Darien Huss managed to detect it. The threat is still under investigation, so users, who are waiting for a free Alma Locker Decrypter, might need to collect some patience. It is suspected that the virus contains programming errors or bugs which might be exploited to break it. Speaking about technical characteristics, the virus employs AES-128 algorithm. Due to this technique, it manages to lock important data. Later on, it attaches five character extension to the corrupted files and documents.

The picture showing AlmaLocker virus

Additionally, a victim is given a unique identification code. It is used for paying the ransom. Speaking of which, the developers do not seem to be greedy as they demand 1 BTC for the blocked information. In any case, it is unwise to pay the money as there are no guarantees that the hackers will spare you and return the data after receiving the transaction. Ransomware has been an online business, so few reports are known that the cyber criminals kept their word.

Questions about Alma Locker ransomware virus

Moreover, Alma Locker ransomware targets a wide range of file extensions. It might encode image,text, excel, and music files. In short, it threatens to decode all the files which usually contain the most important information. Interestingly, the threat escapes several folders, for example, Recycle Bin, Program Files, Internet Explorer, Mozilla, Chrome, Local Settings and a few others. Thus, if you happen to store your data there, there is a chance to avoid Alma Locker malware.

Regarding the decryption of the files, the hackers offer the chance to decode a few files for free. Victims are encouraged to download Alma Locker Decrypter. However, at the moment, this software seems to malfunction as it retrieves server error. Finally, the virus leaves Unlock_files_[random_extension].html and Unlock_files_[random_extension].txt files with the instructions to remit the payment.

How does this virus spread?

Mainly, the malware prefers infiltrating computers with the help of RIG exploit kit. The latter has emerged at the beginning of the year. It has been revealed that this trojan was part of the major cyber campaign. Moreover, it affected millions of users‘ data. It is also related to SmokeLoader malware. The latter is able to work in the system background and download necessary malicious files. All in all, there is a way to protect yourself against this malware and trojans by improving your computer security. Download and install proper security applications. The best combination would be an anti-virus and anti-spyware applications. The latter is able to detect a broader range of minor and more serious threats.

Good news! Victims can now decrypt the encoded data for free

Fascinating news for everyone who has become a victim of Alma Locker ransomware. It appears that modus operandi of this virus has some flaws that allowed malware researchers create a free Alma Locker decryption tool. This ransomware variant uses AES key to encrypt files, and the same key can be used to decrypt them back. Apparently, crooks have forgotten to fix one flaw in virus’ code – they send the AES key via HTTP in a clear text, and can be easily discovered. Of course, if the victim does not save network activity logs, it might be impossible to get this decryption key for free. To decrypt files, the user has to download a C# compiler, add the provided code, compile and run it. You can find a complete tutorial on how to decrypt your files in the instructions provided at the end of this post. If you have any questions about the decryption procedure, please send a question to our support team.

Ransomware removal instructions

Though other malware might be eliminated using the manual method, we do not recommend deleting Alma Locker virus manually. This cyber threat is surely a puzzle for IT researchers so there are few chances that you might succeed in deleting the file-encrypting virus. Therefore, remove Alma Locker with the help of a powerful security program such as Reimage Reimage Cleaner Intego or SpyHunter 5Combo Cleaner. Either of them will exterminate the threat shortly. Unfortunately, neither of them decodes the blocked data. You might use data recovery software while IT experts are working on the free decryptor. After the malware is completely terminated, consider data storing alternatives. Keep it in several locations and perform regular back-ups. Lastly, if you encountered problems and cannot perform Alma Locker removal, follow the recovery instructions.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove Alma Locker virus, follow these steps:

Remove Alma Locker using Safe Mode with Networking

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Alma Locker

    Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Alma Locker removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Alma Locker using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Alma Locker. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage Reimage Cleaner Intego and make sure that Alma Locker removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Alma Locker from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

It is possible to decrypt your files for free now because malware experts have discovered a flaw in ransomware’s operation that allowed them to create a free decryption tool. Therefore, you do not need to pay Bitcoins for Alma Locker Decrypter.

If your files are encrypted by Alma Locker, you can use several methods to restore them:

How to retrieve your files with a help of Windows Previous Versions feature?

If you enabled System Restore function on your PC a while ago, now you can use this method to restore your encrypted files. This method is useful only if you wish to decrypt certain files, but not all of them. Please follow the following instructions:

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

How to decrypt your files using the free Alma Locker decryption program?

Security experts have created a tool that allows victims to decrypt their files for free. In order to decrypt files touched by Alma Locker’s encryption, do the following:

1. Download a trustworthy C# compiler (software that can compile C# codes).

2. Copy the code provided in this link.

3. Paste the code in the C# compiler and compile it. Run the program. The program will indicate information required to decrypt your files.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Alma Locker and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes

Access your website securely from any location

When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. It is a hassle when your website is protected from suspicious connections and unauthorized IP addresses.

The best solution for creating a tighter network could be a dedicated/fixed IP address. If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for server or network manager that need to monitor connections and activities. This is how you bypass some of the authentications factors and can remotely use your banking accounts without triggering suspicious with each login. 

VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world. It is better to clock the access to your website from different IP addresses. So you can keep the project safe and secure when you have the dedicated IP address VPN and protected access to the content management system.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.

About the author
Julie Splinters
Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions

Removal guides in other languages

  1. michellerhys says:
    August 24th, 2016 at 3:01 am

    The hackers just wont stop…to be honest, is there anything that can guarantee the safety against this threat?

  2. C.Barbosa says:
    August 24th, 2016 at 3:02 am

    Im waiting for the decrypter. can you hurry up, please?

  3. FillRichie says:
    August 24th, 2016 at 3:04 am

    I guess this virus is more dangerous than the others.

  4. Craig4555555 says:
    August 24th, 2016 at 3:06 am

    their decrypter doesnt would I know they gonna give me back my files?

  5. Tracey says:
    August 24th, 2016 at 3:07 am

    My friend got infected by this virus. eventually, she lost all her important reports as she didnt pay the money. I guess I need to install additional security programs as well.

Your opinion regarding Alma Locker ransomware virus