Maktub Locker virus. How to remove? (Uninstall guide)
Maktub Locker virus – another ransom demanding computer threat
Computer users should be aware of a new ransomware, called Maktub Locker. It is a computer infection that can make all user’s files inaccessible. The cyber criminals send this virus via email – they send attachments disguised as Terms of Service update. Judging by the file icon, it seems to be .txt or .pdf document, but in reality, it is a .scr file. If a user downloads and launches such file, it opens up an actual document, but it also runs a malicious process in the background. Maktub Locker ransomware scans the whole computer system for personal files and encrypts them using the AES-256 encryption algorithm. What is interesting, is that the file size drops after the encryption. It is also notable that this virus attaches a file extension to the filenames of encrypted data. For each victim, the extension is randomly generated.
After the data encryption is done, Maktub Locker virus leaves a ransom note – a .html file, which is named _DECRYPT_INFO_(random code here). This message provides information what happened to the computer. It states that the personal files were encrypted using “the strongest encryption and unique key, generated for this computer.” It promises to give the decryption key if the user pays the ransom in a particular period of time, but if the user decides not to do as commanded, the unique decryption key will be destroyed for good. Like any other ransomware, Maktub Locker asks to install Tor browser and go to one of the URLs provided to access the secret server. Then, using a given code, the user can enter a special website designed only for him/her. It’s a website, which is incomparable to the websites provided by other ransomware viruses. It is designed quite well, and the information on it is written faultlessly.
Questions about Maktub Locker virus
This site consists of 5 different pages. It starts with a “HELLO!” Page. Criminals state that the files have been encrypted, but they are not gone yet – the user can get them back by buying them out. The second page, titled “WE ARE NOT LYING!”, informs that googling “Maktub Locker” will advise the victim to remove this virus immediately. According to the cyber criminals, no programs except of the one this virus provides will help the victim to decrypt the data. It even suggests uploading two files to test the decryption key. The next page, called “HOW MUCH DOES IT COST?”, explains that one must pay the ransom as soon as possible. Otherwise, the ransom price will increase. If the victim pays the ransom within the three days of infection, he/she has to pay approximately 588 US dollars. Later on, the price increases every three days. The virus announces that it does not guarantee to keep the decryption key more than 15 days. It informs that the site can be disconnected at any moment, and then victim’s data will be lost forever. The fourth page is called “WHERE DO I PAY?” It explains that victim needs to pay the ransom in Bitcoins and then wait a few hours. The fifth page, titled “BITCOIN PURCHASE,” provides information about Bitcoin payment system and lists websites where the user can buy Bitcoins.
What to do if Maktub Locker virus infects your computer?
First of all, you have to decide whether you wish to support cyber criminals or not. If you pay the ransom, it only strengthens them and makes them believe that people are submissive and afraid of computer viruses. As a consequence, that encourages them create even more complex viruses and demand bigger ransoms. Besides, do you believe that criminals are actually going to give you the decryption key?
If you decide not to pay up, you must remove Maktub Locker from your computer immediately. It is a must to delete all of its components. Otherwise, its remains might download similar viruses to your computer. In addition, if you do not remember opening any suspicious emails, it might be that you have a trojan installed on your computer, which could download this virus into your PC. It is hard to detect trojans, and that is why we recommend users who were affected by Maktub virus to download a reliable anti-malware software and scan the compromised computer with it.
You can use Reimage program.
FAQ:
Question: I have already deleted this virus but how can I decrypt the data?
Answer: Unfortunately, no decryption utility for Maktub Locker ransomware is found yet. That is why we encourage computer users to create and keep data backups on external drives, unplugged from the computer.
Question: How can I prevent Maktub Locker virus attack?
Answer: It is quite easy – just stay away from suspicious emails sent by people you do not personally know, avoid visiting suspicious websites and refrain yourself from clicking on pushy banners or pop-up ads. However, it is also strongly recommended to protect your computer with a help of anti-malware program.
How to remove Maktub Locker?
We do not recommend dealing with Maktub Locker ransomware manually. It is a disastrious and well-constructed virus, which tends to hide its components in the computer system. If you are an inexperienced PC user, we suggest you to use a strong malware removal program, for example, Reimage. If you still wish to remove this virus manually, follow Maktub Locker removal guide, which is provided below.
To remove Maktub Locker virus, follow these steps:
Remove Maktub Locker using Safe Mode with Networking
-
Step 1: Reboot your computer to Safe Mode with Networking
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Safe Mode with Networking from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window.
-
Step 2: Remove Maktub Locker
Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Maktub Locker removal.
If your ransomware is blocking Safe Mode with Networking, try further method.
Remove Maktub Locker using System Restore
-
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
-
Select Command Prompt from the list
Windows 10 / Windows 8- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
-
Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
-
Step 2: Restore your system files and settings
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
-
Now type rstrui.exe and press Enter again..
-
When a new window shows up, click Next and select your restore point that is prior the infiltration of Maktub Locker. After doing that, click Next.
-
Now click Yes to start system restore.
-
Once the Command Prompt window shows up, enter cd restore and click Enter.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Maktub Locker and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes
About the author
If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.