Remove Maktub Locker virus (Free Instructions)
Maktub Locker virus – another ransom demanding computer threat
Computer users should be aware of a new ransomware, called Maktub Locker. It is a computer infection that can make all user’s files inaccessible. The cyber criminals send this virus via email – they send attachments disguised as Terms of Service update. Judging by the file icon, it seems to be .txt or .pdf document, but in reality, it is a .scr file. If a user downloads and launches such file, it opens up an actual document, but it also runs a malicious process in the background. Maktub Locker ransomware scans the whole computer system for personal files and encrypts them using the AES-256 encryption algorithm. What is interesting, is that the file size drops after the encryption. It is also notable that this virus attaches a file extension to the filenames of encrypted data. For each victim, the extension is randomly generated.
After the data encryption is done, Maktub Locker virus leaves a ransom note – a .html file, which is named _DECRYPT_INFO_(random code here). This message provides information what happened to the computer. It states that the personal files were encrypted using “the strongest encryption and unique key, generated for this computer.” It promises to give the decryption key if the user pays the ransom in a particular period of time, but if the user decides not to do as commanded, the unique decryption key will be destroyed for good. Like any other ransomware, Maktub Locker asks to install Tor browser and go to one of the URLs provided to access the secret server. Then, using a given code, the user can enter a special website designed only for him/her. It’s a website, which is incomparable to the websites provided by other ransomware viruses. It is designed quite well, and the information on it is written faultlessly.
Questions about Maktub Locker virus
This site consists of 5 different pages. It starts with a “HELLO!” Page. Criminals state that the files have been encrypted, but they are not gone yet – the user can get them back by buying them out. The second page, titled “WE ARE NOT LYING!”, informs that googling “Maktub Locker” will advise the victim to remove this virus immediately. According to the cyber criminals, no programs except of the one this virus provides will help the victim to decrypt the data. It even suggests uploading two files to test the decryption key. The next page, called “HOW MUCH DOES IT COST?”, explains that one must pay the ransom as soon as possible. Otherwise, the ransom price will increase. If the victim pays the ransom within the three days of infection, he/she has to pay approximately 588 US dollars. Later on, the price increases every three days. The virus announces that it does not guarantee to keep the decryption key more than 15 days. It informs that the site can be disconnected at any moment, and then victim’s data will be lost forever. The fourth page is called “WHERE DO I PAY?” It explains that victim needs to pay the ransom in Bitcoins and then wait a few hours. The fifth page, titled “BITCOIN PURCHASE,” provides information about Bitcoin payment system and lists websites where the user can buy Bitcoins.
What to do if Maktub Locker virus infects your computer?
First of all, you have to decide whether you wish to support cyber criminals or not. If you pay the ransom, it only strengthens them and makes them believe that people are submissive and afraid of computer viruses. As a consequence, that encourages them create even more complex viruses and demand bigger ransoms. Besides, do you believe that criminals are actually going to give you the decryption key?
If you decide not to pay up, you must remove Maktub Locker from your computer immediately. It is a must to delete all of its components. Otherwise, its remains might download similar viruses to your computer. In addition, if you do not remember opening any suspicious emails, it might be that you have a trojan installed on your computer, which could download this virus into your PC. It is hard to detect trojans, and that is why we recommend users who were affected by Maktub virus to download a reliable anti-malware software and scan the compromised computer with it.
You can use ReimageIntego program.
FAQ:
Question: I have already deleted this virus but how can I decrypt the data?
Answer: Unfortunately, no decryption utility for Maktub Locker ransomware is found yet. That is why we encourage computer users to create and keep data backups on external drives, unplugged from the computer.
Question: How can I prevent Maktub Locker virus attack?
Answer: It is quite easy – just stay away from suspicious emails sent by people you do not personally know, avoid visiting suspicious websites and refrain yourself from clicking on pushy banners or pop-up ads. However, it is also strongly recommended to protect your computer with a help of anti-malware program.
How to remove Maktub Locker?
We do not recommend dealing with Maktub Locker ransomware manually. It is a disastrious and well-constructed virus, which tends to hide its components in the computer system. If you are an inexperienced PC user, we suggest you to use a strong malware removal program, for example, ReimageIntego. If you still wish to remove this virus manually, follow Maktub Locker removal guide, which is provided below.
To remove Maktub Locker virus, follow these steps:
Remove Maktub Locker using Safe Mode with Networking
-
Step 1: Reboot your computer to Safe Mode with Networking
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Safe Mode with Networking from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window.
-
Step 2: Remove Maktub Locker
Log in to your infected account and start the browser. Download ReimageIntego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Maktub Locker removal.
If your ransomware is blocking Safe Mode with Networking, try further method.
Remove Maktub Locker using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Maktub Locker. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Maktub Locker and other ransomwares, use a reputable anti-spyware, such as ReimageIntego, SpyHunter 5Combo Cleaner or Malwarebytes
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files. More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, Data Recovery Pro can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
Your opinion regarding Maktub Locker virus
You must be logged in to post a comment.
March 26th, 2016 at 9:56 pm
So there is no way to decrypt the files?
March 28th, 2016 at 12:38 pm
seems that no… ive been searching for a decryption tool, too, unfortunately, no luck… I dont know whether should I pay up or no, I dont touch my PC now. I dont want to pay, they ask for just really a lot of money…
March 26th, 2016 at 9:58 pm
Damn virus! Ill backup my files. Thanks for the information.
March 28th, 2016 at 12:39 pm
I have become a victim of Maktub, too. I regret so much that I did not backup my files earlier…