How to remove LOTUS ransomware

LOTUS ransomware – a cryptovirus that locks victims' files and leaves MANUAL.txt ransom note

LOTUS ransomware is a treacherous computer infection developed to encrypt data on a targeted Windows computer and demand a ransom for decryption tools. During file lockage, they are renamed by appending a triple appendix to their original filenames, consisting of a unique user ID, one of the criminal emails, and .LOTUS extension. If your device is infected, a file that previously was 1.pdf would now appear as 1.pdf.id-XXXXXXXX.[paymei@cock.li].LOTUS.

Threats and demands of the criminals are displayed in two ransom notes. One appears as a pop-up window, the other one as a text file, names MANUAL.txt. With them, LOTUS file virus developers try to scare victims into reaching out to them by two provided emails (paymei@cock.li, paymei@tuta.io) and to pay an unspecified amount of money with cryptocurrency Bitcoins.

This article's culprit derives from the Dharma ransomware family, which is producing new virus variations each week. If your device is infected with this file-locker, the main thing is to stay calm and don't make any rash decisions. We'll explain how to safely eliminate it, prevent such perils in the future, and provide you with alternative data recovery options.

Mostly, all Dharma family ransomware, like Ovo virus, 22btc virus, 14x virus, and hundreds of others, have many similarities. For one, ransom note appearances are very alike. One big difference that stands out with .LOTUS file virus is that its pop-up ransom window looks different, and the name of the text file note isn't FILES ENCRYPTED.txt anymore. It's changed to MANUAL.txt.

Although appearances have changed, the contents stayed the same. The text file still contains too email addresses to reach out to the criminals:

all your data has been locked us
You want to return?
write email paymei@cock.li or paymei@tuta.io

While the pop-up ransom window adds some threats not to modify the encrypted files in any way:

YOUR FILES ARE ENCRYPTED
Don't worry,you can return all your files!
If you want to restore them, write to the mail: paymei@cock.li YOUR ID –
If you have not answered by mail within 12 hours, write to us by another mail:paymei@tuta.io
!ATTENTION!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

As usual, there are no details about the ransom amount, or the preferred payment method, although our research suggests that the threat actors behind LOTUS ransomware virus will ask for Bitcoins. No matter how important your files are to you, we highly advise against succumbing to the assailants' demands.

People who succumb to criminal threats and forward them money are helping them to:

• invest in the development of more elaborate malware,
• research more effective payload file delivery methods,
• attack more innocent people.

The only way to prevent cybercriminals from spreading their creations is by stopping the cash flow. That's why we recommend our readers to remove LOTUS ransomware. Best results are achieved when doing that with professional anti-malware tools, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes that would guarantee complete elimination.

To ensure that infection renewal won't happen and to restore system values back to normal, you should perform system diagnostics to finish LOTUS ransomware removal. IT experts from DieViren.de^[1] highly recommend entrusting this process to the powerful FortectIntego tune-up tool to automatically take care of system-related issues.

Take precautionary measures to avoid various malware

Malware is lurking on the internet and waiting for unprotected devices to download it. There are different kinds of malware^[2] with distinct purposes. For example, ransomware encrypts files and demands ransoms, while keyloggers try to steal your private information, such as passwords, credit card details, etc.

Although leading tech companies try to make the internet a safer place, it's very tough to keep up with cybercriminals. That's why you should take matters into your own hands and increase your cybersecurity level. Do that by sticking to our cybersecurity team suggestions:

• Always have your operating system and other software up-to-date.
• Acquire a professional security tool. Update its virus database regularly and scan your system a few times each week.
• Store backups of crucial data. Preferably on two different devices, one of which should be offline storage.
• Frequently scan your device with system repair tools to keep system files and settings in order.
• Stay away from shady websites, such as gambling, porn, online gaming, etc.
• Read our articles or google how to identify spam emails and other popular techniques used by hackers to spread their creations.

Quick tutorial for LOTUS ransomware removal and system repair

Unfortunately, there's no dedicated decryption tool for .LOTUS file virus. You can try our suggested data recovery options below. If none of them work, export all encrypted files to an external storage device, like a USB drive, HDD/SSD storage, etc., and get back to us as we inform our readers with the latest updates.

According to suspicious file analysis platform VirusTotal,^[3] 59 of 71 anti-malware tools have identified, isolated, and safely eliminated this file-locker. These are examples of its detection names:

• Ransom:Win32/Wadhrama!hoa
• Ransom.Crysis
• Win32:RansomX-gen [Ransom]
• Trojan.GenAsa!PU4zXkABPRE
• Trojan-Ransom.Win32.Crusis.to
• etc.

As you can see, professional anti-malware software is a must these days. We suggest downloading trusty apps such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Either of them will automatically remove LOTUS ransomware from your device and protect it from cyberattacks in the future.

Security tools are great for catching malware, but they can't fix virus damage. Corrupted system files, altered host files, and other damage that the system sustains during the infection can be reverted using proficient system diagnostics tools. Therefore, after LOTUS ransomware removal, we advise using the FortectIntego tool.