Maktub Locker virus (Free Instructions)
Maktub Locker virus Removal Guide
What is Maktub Locker virus?
Maktub Locker virus – another ransom demanding computer threat
Computer users should be aware of a new ransomware, called Maktub Locker. It is a computer infection that can make all user’s files inaccessible. The cyber criminals send this virus via email – they send attachments disguised as Terms of Service update. Judging by the file icon, it seems to be .txt or .pdf document, but in reality, it is a .scr file. If a user downloads and launches such file, it opens up an actual document, but it also runs a malicious process in the background. Maktub Locker ransomware scans the whole computer system for personal files and encrypts them using the AES-256 encryption algorithm. What is interesting, is that the file size drops after the encryption. It is also notable that this virus attaches a file extension to the filenames of encrypted data. For each victim, the extension is randomly generated.
After the data encryption is done, Maktub Locker virus leaves a ransom note – a .html file, which is named _DECRYPT_INFO_(random code here). This message provides information what happened to the computer. It states that the personal files were encrypted using “the strongest encryption and unique key, generated for this computer.” It promises to give the decryption key if the user pays the ransom in a particular period of time, but if the user decides not to do as commanded, the unique decryption key will be destroyed for good. Like any other ransomware, Maktub Locker asks to install Tor browser and go to one of the URLs provided to access the secret server. Then, using a given code, the user can enter a special website designed only for him/her. It’s a website, which is incomparable to the websites provided by other ransomware viruses. It is designed quite well, and the information on it is written faultlessly.
This site consists of 5 different pages. It starts with a “HELLO!” Page. Criminals state that the files have been encrypted, but they are not gone yet – the user can get them back by buying them out. The second page, titled “WE ARE NOT LYING!”, informs that googling “Maktub Locker” will advise the victim to remove this virus immediately. According to the cyber criminals, no programs except of the one this virus provides will help the victim to decrypt the data. It even suggests uploading two files to test the decryption key. The next page, called “HOW MUCH DOES IT COST?”, explains that one must pay the ransom as soon as possible. Otherwise, the ransom price will increase. If the victim pays the ransom within the three days of infection, he/she has to pay approximately 588 US dollars. Later on, the price increases every three days. The virus announces that it does not guarantee to keep the decryption key more than 15 days. It informs that the site can be disconnected at any moment, and then victim’s data will be lost forever. The fourth page is called “WHERE DO I PAY?” It explains that victim needs to pay the ransom in Bitcoins and then wait a few hours. The fifth page, titled “BITCOIN PURCHASE,” provides information about Bitcoin payment system and lists websites where the user can buy Bitcoins.
What to do if Maktub Locker virus infects your computer?
First of all, you have to decide whether you wish to support cyber criminals or not. If you pay the ransom, it only strengthens them and makes them believe that people are submissive and afraid of computer viruses. As a consequence, that encourages them create even more complex viruses and demand bigger ransoms. Besides, do you believe that criminals are actually going to give you the decryption key?
If you decide not to pay up, you must remove Maktub Locker from your computer immediately. It is a must to delete all of its components. Otherwise, its remains might download similar viruses to your computer. In addition, if you do not remember opening any suspicious emails, it might be that you have a trojan installed on your computer, which could download this virus into your PC. It is hard to detect trojans, and that is why we recommend users who were affected by Maktub virus to download a reliable anti-malware software and scan the compromised computer with it.
You can use ReimageIntego program.
FAQ:
Question: I have already deleted this virus but how can I decrypt the data?
Answer: Unfortunately, no decryption utility for Maktub Locker ransomware is found yet. That is why we encourage computer users to create and keep data backups on external drives, unplugged from the computer.
Question: How can I prevent Maktub Locker virus attack?
Answer: It is quite easy – just stay away from suspicious emails sent by people you do not personally know, avoid visiting suspicious websites and refrain yourself from clicking on pushy banners or pop-up ads. However, it is also strongly recommended to protect your computer with a help of anti-malware program.
How to remove Maktub Locker?
We do not recommend dealing with Maktub Locker ransomware manually. It is a disastrious and well-constructed virus, which tends to hide its components in the computer system. If you are an inexperienced PC user, we suggest you to use a strong malware removal program, for example, ReimageIntego. If you still wish to remove this virus manually, follow Maktub Locker removal guide, which is provided below.
Getting rid of Maktub Locker virus. Follow these steps
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Remove Maktub Locker using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Maktub Locker. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Maktub Locker and other ransomwares, use a reputable anti-spyware, such as ReimageIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files. More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, Data Recovery Pro can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.