DMA Locker 3.0 ransomware / virus (Removal Guide) - May 2017 update

What is DMA Locker 3.0 ransomware virus?

DMA Locker 3.0 virus has its clones emerging in 2017

DMA Locker 3.0 ransomware is a noxious computer infection, which was released in February 2016 with bug fixes and updates. This time, crooks have patched the flaw in the ransomware (it was possible to decrypt files affected by the earlier version of it – DMA-Locker virus), and now it is impossible to recover files using any data recovery tools. Once installed, this virus encrypts all files on the computer and demands ransom. DMALocker3 malware is so complicated that it generates an individual encryption key for every single file, and, unlike the previous version of it, it uses RSA encryption algorithm along with AES. What is interesting about this ransomware is that it doesn't add particular file extensions to filenames – instead, it edits the header of every encrypted file and appends !DMALOCK3.0 prefix at the beginning of the content. This ransomware scans the whole computer system and detects music files, videos, images, documents, and various other file types and encrypts them. Afterward, it creates and saves a ransom note called cryptinfo.txt.

Once it finishes encrypting data, it sends a pop-up message to the computer screen, starting with a header “All your personal files are LOCKED!” The message includes information about the encryption and instructions how to decrypt DMA Locker 3.0. This virus dictates the victim to transfer 4 Bitcoins^[1] to a particular Bitcoin address provided. Approximately, 4 BTC is more or less 1789 USD, and that is a very high ransom price considering that other ransomware variants commonly ask for about 400-500 USD. The ransom note continues the instructions by commanding the user to contact crooks after transferring Bitcoins and promises to send the decryption key immediately. The third version of the ransomware leaves either week4004@fastmail.com or january0040@gmx.com email address as the only way of contacting them. However, instead of following criminals' commands and taking the risk of losing your money for nothing, you should think about possible DMA Locker 3.0 removal options.

You should not rely on cyber criminals because you do not know whether they will send you the decryption key or not. The ransom price is considerably high, so think twice before you try to pay up^[2]. In addition to that, no matter how important your files are, it is not advisable to support cyber criminals and transfer money to their Bitcoin accounts, because this will encourage them to continue creating more and more ransomware variants. We strongly recommend you to remove DMA Locker 3.0 using a strong anti-malware software (e.g. FortectIntego) and restore your files from backups stored on portable storage devices (if you have them).

Fake DMA Locker 3.0 version spotted in May 2017

Security experts spotted fake DMA Locker 3.0 virus^[3] making rounds on the Internet in the end of May 2017. The main difference between the real and the fake version is that the bogus one appends one of the following prefixes to encrypted files: !XPTLOCK5.0, !Locked#2.0, !Locked!### or !Encrypt!##. The fake ransomware provides identical GUI to victims, but clearly provides a different email address to the victims. The bogus ransomware suggests writing to data0001@tuta.io after paying the ransom worth of 1500 GB or 1 BTC. Victims attacked by this forged version of ransomware should contact experienced malware researcher who presents herself as Hasherezade. Her email address is hasherezade@gmail.com.

Comparison of the real DMA Locker 3.0 virus and the fake version.

Distribution of this ransomware virus

DMA Locker v3.0 works in a quite interesting way, and you can use one trick to prevent it from encrypting your files even if this threat manages to slither into the computer system. This malware is programmed to understand whether the system is infected or not, so you can deceive this malicious software by creating fake virus files. Create such files in the following folders:

1. C:\Documents & Settings\All Users\start.txt
2. C:\Documents & Settings\All Users\decrypting.txt
3. C:\ProgramData\start.txt
4. C:\ProgramData\decrypting.txt

The decrypting.txt file informs the software that the system is already infected, and the start.txt file informs it that files are being encrypted at the moment.

The majority of ransomware-type computer viruses spread via malicious emails; however, security experts claim that cyber criminals tend to install this virus to the victim’s computer via Remote Desktop. To secure your computer from such computer infections, we strongly advise you to protect it with a reliable anti-malware software that can ensure real-time protection^[4] from spyware and malware.

DMA Locker 3.0 removal

Are your files infected by DMALocker virus already? Unfortunately, we cannot say that it is possible to decrypt them now. You can only recover your files if you have backup copies of them^[5] stored on an external hard drive, flash memory card, CD or DVD. However, before you plug or insert any of these storage devices into your computer, remove DMA Locker 3.0 ransomware. You can perform a full removal using our recommended anti-malware software (FortectIntego), but if you want to, you can try to uninstall this malware manually. We do not recommend opting for this option unless you are an experienced computer user or an IT expert. The full DMA Locker 3.0 removal guide is provided below.